That is the real job when you learn how to install Composer for Laravel: get the right PHP, the right Composer, and a terminal that finds both. Laravel 13 needs PHP 8.3 or newer, and Laravel’s own docs now offer a one-line installer that sets up PHP, Composer and the Laravel installer together. If you’d rather install Composer by hand, the Windows installer and the verified command-line script both still work.
Quick answer: To install Composer for Laravel, install PHP 8.3 or newer, then download Composer-Setup.exe on Windows or run Composer’s verified installer script on macOS and Linux. Check it with
composer --version, install the Laravel installer withcomposer global require laravel/installer, and create an app withlaravel new example-app. Laravel’s php.new command does all of this in one step.
Table of Contents
What Is Composer and Why Does Laravel Need It?
Composer is PHP’s dependency manager. It reads a composer.json file, downloads the packages your project needs into a vendor folder, records their exact versions in composer.lock, and builds an autoloader so your code can use those classes. Laravel is a set of Composer packages, so it can’t be installed or updated without Composer.
Every Laravel app depends on dozens of packages, from routing and the database layer to testing tools. Composer resolves which versions work together, installs them, and keeps every developer and server on the same versions through the lock file. Composer’s docs recommend committing composer.lock to version control and keeping vendor out of it (Composer docs).
Requirements Before You Install Composer
The latest Composer needs PHP 7.2.5 or newer, but Laravel 13 needs PHP 8.3 or newer, so plan around Laravel’s number. You also need a few PHP extensions and command-line tools that Composer uses to download and unpack packages.
| Requirement | Minimum | Why it matters |
|---|---|---|
| PHP for Laravel 13 | 8.3 | Laravel’s deployment docs list PHP 8.3 as the minimum |
| PHP for Composer 2.10 | 7.2.5 | The latest Composer won’t run below this |
| PHP 5.3.2 to 8.1 | Composer 2.2 LTS | Only for legacy projects that can’t upgrade PHP |
| PHP extensions | openssl, curl, mbstring and others | Secure downloads and string handling |
| Unzip tools | unzip, 7z, gzip or tar | Composer unpacks package archives |
| Git | Recent version | Some packages install from Git repositories |
The PHP and LTS details come from Composer’s introduction page (Composer docs), and the Laravel minimum comes from Laravel’s deployment requirements (Laravel docs). Check your PHP version first:
php -vIf it prints something older than 8.3, upgrade PHP before you go further. For the full Laravel setup, see our guide on how to install Laravel.
Fastest Option: Install PHP, Composer and Laravel With php.new or Herd
Laravel’s own documentation now recommends a one-line installer from php.new that sets up PHP, Composer and the Laravel installer together on macOS, Windows or Linux. Laravel Herd is the graphical alternative for macOS and Windows. Either option skips most manual setup.
The commands below come straight from Laravel 13’s installation docs (Laravel docs).
macOS:
/bin/bash -c "$(curl -fsSL https://php.new/install/mac/8.5)"Windows PowerShell (run as administrator):
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol
-bor 3072; iex ((New-Object System.Net.WebClient).DownloadString(
'https://php.new/install/windows/8.5'))Linux:
/bin/bash -c "$(curl -fsSL https://php.new/install/linux/8.5)"Restart your terminal afterward. To update PHP, Composer and the Laravel installer later, run the same command again.
Laravel Herd
Herd is a free desktop app for macOS and Windows that bundles PHP, Nginx and command-line tools for php, composer, laravel, node and npm. Install it from herd.laravel.com and Composer is ready immediately. Herd suits developers who prefer settings screens to terminal setup.
How to Install Composer on Windows
On Windows, download Composer-Setup.exe from getcomposer.org and run it. The installer finds your PHP, installs the latest Composer, and adds it to your PATH so composer works from any folder. Close and reopen your terminal afterward, because Windows only reads the PATH when a terminal starts.
- Install PHP 8.3 or newer first, or use Herd, which includes it.
- Download and run Composer-Setup.exe.
- When asked for the PHP executable, point it to your
php.exe, for example in your PHP or Herd folder. - Finish the wizard, then open a new Command Prompt or PowerShell window.
- Run
composer --versionto confirm it works.
Composer’s docs note that the PATH change only applies to terminals opened after the install (Composer docs). If composer is still not recognized, see the troubleshooting table below.
How to Install Composer on macOS and Linux
On macOS and Linux, download Composer’s installer script, check its SHA-384 checksum against the signature Composer publishes, run it, then move composer.phar into a folder on your PATH. Verifying the checksum protects you from a tampered or corrupted download.
Composer’s documentation provides this script (Composer docs). Save it as install-composer.sh and run it with sh install-composer.sh:
#!/bin/sh
EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]
then
>&2 echo 'ERROR: Invalid installer checksum'
rm composer-setup.php
exit 1
fi
php composer-setup.php --quiet
RESULT=$?
rm composer-setup.php
exit $RESULTThen make Composer available everywhere:
sudo mv composer.phar /usr/local/bin/composerNever hard-code the checksum. It changes every time Composer updates its installer, so the script above fetches the current one each time.
What About Package Managers?
Many Linux distributions and Homebrew ship Composer packages. They work, but they can lag behind the latest release, and Composer’s docs warn that composer self-update isn’t available when Composer was installed by an operating system package manager. For Laravel work, the official installer or php.new is the safer default.
Verify That Composer Works
Run composer --version in a new terminal. It should print the Composer version, release date and the PHP version Composer is using. If the PHP version shown isn’t the one you expect, your system has more than one PHP install and your PATH points to the wrong one.
Here is the real output from our test machine:
$ composer --version
Composer version 2.8.12 2025-09-19 13:41:59
PHP version 8.3.6 (/usr/bin/php8.3)That machine was on 2.8.12, while the current Composer release is 2.10.3, so the next step was composer self-update. For a deeper check, run composer diagnose. It tests your PHP settings, Git and the connection to Packagist, Composer’s main package repository, and it is the fastest way to explain a failing install.
Create a Laravel Project With Composer
Once Composer works, install the Laravel installer globally with Composer, then create your app with laravel new. The installer asks which starter kit, database and testing tools you want, then runs Composer for you. Start the app with composer run dev.
composer global require laravel/installer
laravel new example-app
cd example-app
npm install && npm run build
composer run devOpen http://localhost:8000 to see the app. The composer run dev script starts Laravel’s server, queue worker and Vite together. If laravel isn’t found after the global install, add Composer’s global vendor/bin folder to your PATH.
You can also create a project with Composer alone:
composer create-project laravel/laravel example-appTo confirm which Laravel version you got, see our guide to checking your Laravel version.
Composer Commands Every Laravel Developer Uses
Most daily Composer work comes down to eight commands. The most important difference is between install and update. install uses the exact versions in composer.lock, while update looks for newer versions and rewrites the lock file.
| Command | What it does | When to use it |
|---|---|---|
composer install | Installs the exact versions in composer.lock | After cloning a project, and on servers |
composer update | Finds newer allowed versions and updates the lock file | When you deliberately upgrade packages |
composer require vendor/package | Adds a package to composer.json and installs it | Adding a new library |
composer require vendor/package --dev | Adds a development-only package | Debug tools, testing tools |
composer remove vendor/package | Removes a package | Cleaning up unused libraries |
composer outdated | Lists packages with newer versions | Planning upgrades |
composer dump-autoload -o | Rebuilds an optimized autoloader | After adding classes or before deploying |
composer self-update | Updates Composer itself | When a newer Composer is out |
Dev-only tools such as Laravel Debugbar belong under --dev, so they never reach production.
Hands-On: How Composer’s Autoloader Works
The autoloader is what lets Laravel load classes without require lines everywhere. We set up a tiny project to show it. First, create a composer.json with a PSR-4 autoload rule:
composer init --name=webzeto/demo --type=project --autoload=src/ --no-interactionThat generated this file:
{
"name": "webzeto/demo",
"type": "project",
"autoload": {
"psr-4": {
"Webzeto\\Demo\\": "src/"
}
},
"require": {}
}Then add a class in src/Greeter.php:
<?php
namespace Webzeto\Demo;
class Greeter
{
public function hello(string $name): string
{
return "Hello, {$name}!";
}
}And use it from index.php:
<?php
require __DIR__ . '/vendor/autoload.php';
use Webzeto\Demo\Greeter;
echo (new Greeter())->hello('Composer') . PHP_EOL;Running composer dump-autoload --optimize and then php index.php printed Hello, Composer!. Laravel’s App\ namespace works exactly this way, mapped to the app/ folder in its own composer.json.
Using Composer Safely in Production
On a live server, install only what the app needs with composer install --no-dev --optimize-autoloader, never run composer update, and don’t run Composer as root. The lock file you tested locally should decide every version in production.
Composer warns against running as root because package plugins and scripts run with the same permissions as the user running Composer. Since Composer 2.4.2, it disables plugins automatically when it detects root without your explicit consent (Composer docs). We saw that warning ourselves on our test machine:
Do not run Composer as root/super user! See https://getcomposer.org/root for detailsDeploy as a normal user instead. If you host on shared hosting, our guide to deploying a Laravel project on cPanel shows where to run these commands.
Composer Installation Errors and Fixes
Most Composer errors come from the wrong PHP version, a missing PHP extension, a PATH problem or a blocked network. The table below lists each one and its fix.
| Error or symptom | Cause | Fix |
|---|---|---|
'composer' is not recognized (Windows) | Terminal opened before the install, or PATH not set | Open a new terminal, or rerun Composer-Setup.exe |
composer: command not found (macOS or Linux) | composer.phar isn’t in a PATH folder | Run sudo mv composer.phar /usr/local/bin/composer |
| “Your PHP version does not satisfy that requirement” | Composer or Laravel needs a newer PHP | Upgrade to PHP 8.3+, or check which PHP composer --version shows |
| “The requested PHP extension ext-… is missing” | An extension is disabled in php.ini | Enable it in the php.ini file that php --ini reports |
| Allowed memory size exhausted | PHP memory limit too low for dependency resolution | Raise memory_limit in php.ini. Composer itself raises it to 1.5G internally |
curl error 56 ... CONNECT tunnel failed, response 403 | A proxy or firewall blocks Packagist | Set https_proxy correctly or ask IT to allow repo.packagist.org |
| “Do not run Composer as root/super user!” | Running as root or with sudo | Run as a normal user. Use sudo only for moving the file or sudo -H composer self-update |
laravel: command not found after global install | Composer’s global vendor/bin isn’t on PATH | Add that folder to your PATH and open a new terminal |
The proxy row is worth a closer look. On our test machine, composer diagnose returned curl error 56 while downloading https://repo.packagist.org/packages.json: CONNECT tunnel failed, response 403, which means the network refused the connection before it reached Packagist. Composer reads proxy settings from environment variables such as https_proxy, not from composer.json (Composer docs).
If you’d rather have experienced developers set up and maintain your Laravel stack, our Laravel development team handles new builds, upgrades and server setup. Teams adding a document database can continue with our guide on using MongoDB with Laravel.
FAQ
Short answers to the questions developers ask most about Composer and Laravel.
Do I need Composer to install Laravel?
Yes. Laravel is distributed as Composer packages, so Composer installs it and every package it depends on. Even the Laravel installer and Herd use Composer behind the scenes. Without Composer you can’t install, update or add packages to a Laravel app.
Which PHP version do I need for Composer and Laravel?
The latest Composer needs PHP 7.2.5 or newer, but Laravel 13 needs PHP 8.3 or newer, so install PHP 8.3 or later. Composer 2.2 LTS still supports PHP 5.3.2 to 8.1, but only for legacy projects that can’t upgrade.
How do I install Composer on Windows 10 or 11?
Download Composer-Setup.exe from getcomposer.org and run it. Point it to your php.exe when asked, finish the wizard, then open a new Command Prompt or PowerShell window and run composer --version. Herd for Windows is an easier alternative because it includes PHP and Composer.
How do I check if Composer is installed?
Run composer --version in a new terminal. It prints the Composer version, its release date and the PHP version it uses. If the command isn’t found, Composer isn’t on your PATH. Run composer diagnose for a full check of PHP, Git and network access.
What is the difference between composer install and composer update?
composer install installs the exact versions listed in composer.lock, so everyone gets the same code. composer update looks for newer versions allowed by composer.json, installs them and rewrites the lock file. Use install on servers and update only when you mean to upgrade.
How do I update Composer to the latest version?
Run composer self-update. If Composer is installed system-wide, you may need sudo -H composer self-update. If you installed Composer through php.new, rerun the php.new command instead. Composer installed by an operating system package manager can’t self-update, so update it through that package manager.
Should I commit the vendor folder or composer.lock?
Commit composer.lock and add vendor to .gitignore. The lock file makes every developer and server install the same versions. The vendor folder is rebuilt by composer install, so committing it only bloats your repository.
Why does Composer say not to run it as root?
Package plugins and scripts run with the permissions of the user running Composer, so running as root gives third-party code full access to your system. Since Composer 2.4.2, plugins are disabled automatically under root unless you confirm. Run Composer as a normal user.
Can I use Laravel Herd instead of installing Composer manually?
Yes. Herd for macOS and Windows includes PHP, Composer and the Laravel installer, so you can run laravel new my-app right after installing it. It’s the easiest route if you don’t want to manage PHP versions or PATH settings yourself.
Conclusion
Jake’s lost afternoon came down to a terminal using the wrong PHP. Most problems with how to install Composer for Laravel come from the same place: the version of PHP, the PATH, or a network that blocks Packagist. Fix those, and Composer itself installs in minutes.
For a new machine, start with php.new or Herd, since they set up PHP 8.3+, Composer and the Laravel installer together. For a manual install, use Composer-Setup.exe on Windows or the checksum-verified script on macOS and Linux, then confirm with composer --version. After that, commit your lock file, use install on servers, keep dev tools under --dev, and run Composer as a normal user.
Which PHP version does your terminal actually use right now? Run composer --version and check before your next Laravel install.
