Where apps hide your files

Composer's global folder, vendor/bin and cache

Updated 2026-10-28 · 6 min read

Composer keeps global packages in the vendor folder of its home directory, and which folder that is depends on your setup. One command prints the exact path, and the same folder's vendor/bin is what you put on your PATH.

The location

Ask Composer rather than guessing. This prints the home directory it uses and changes nothing:

composer config --global home

On a Mac it is usually one of these two folders:

~/.composer
~/.config/composer

Composer's documentation gives /Users/<user>/.composer as the macOS default. Its source code is more exact: if a COMPOSER_HOME environment variable is set, that folder wins. Otherwise Composer checks $XDG_CONFIG_HOME/composer (or ~/.config/composer) first, but only when your shell has any variable starting with XDG_ or the folder /etc/xdg exists, then ~/.composer, and uses the first that already exists. A plain Mac with no XDG variables ends up with ~/.composer.

Global packages and settings sit inside that home folder:

<composer home>/composer.json    the list of packages you required globally
<composer home>/composer.lock    the versions currently installed
<composer home>/vendor/          the packages themselves
<composer home>/vendor/bin/      command-line tools from those packages
<composer home>/config.json      global Composer settings, if you set any
<composer home>/auth.json        credentials for private repositories, if any

The folders start with a dot, so Finder hides them. Press ⇧⌘. in a Finder window to show hidden items, or choose Go > Go to Folder (⇧⌘G) and type the path. From Terminal:

open "$(composer config --global home)"

The Mac used for this guide has no Composer installed, so the layout comes from Composer's documentation and source code. The commands above only print paths.

Where the executables are

Tools such as PHP CS Fixer or the Laravel installer are installed globally with a command like:

composer global require friendsofphp/php-cs-fixer

Their launchers appear in vendor/bin inside the home folder. Composer's documentation says to make sure that directory is on your $PATH, and gives the command that prints it:

composer global config bin-dir --absolute

If you type a tool's name and Terminal says "command not found", that folder is missing from PATH. The fix is one line in your shell startup file, which is ~/.zshrc for zsh, the default shell on recent macOS. Back the file up first, then add the line using the path the command above printed:

cp ~/.zshrc ~/.zshrc.backup
echo 'export PATH="$HOME/.composer/vendor/bin:$PATH"' >> ~/.zshrc

Replace $HOME/.composer/vendor/bin with your real path if it differs, for example $HOME/.config/composer/vendor/bin. Open a new Terminal window and run echo $PATH to check. To undo, copy ~/.zshrc.backup back over ~/.zshrc.

What composer global does

Composer's documentation describes composer global as running a normal command as if you were in the home folder. So composer global require, composer global update and composer global remove all work on the one composer.json there. To see what you have installed globally:

composer global show

To remove a tool, use composer global remove vendor/package. Deleting a folder inside vendor by hand leaves composer.json still listing it, and the next composer global install or update brings it back.

Where the cache is

Composer keeps a download cache so it does not fetch the same archive twice. Both the documentation and the source put it at ~/Library/Caches/composer on macOS, with two exceptions: COMPOSER_CACHE_DIR sets it directly, and setting COMPOSER_HOME moves it to a cache folder inside that home. Ask to be sure:

composer config --global cache-dir

Older Composer versions kept the cache in ~/.composer/cache. Current versions move that folder to ~/Library/Caches/composer on the first run if the new one does not exist yet.

To empty it, run composer clear-cache. The documentation says it deletes all content from Composer's cache directories; Composer downloads packages again the next time it needs them. composer clear-cache --gc only runs garbage collection. Check the size first with du -sh on the path the command printed.

A project's own vendor folder, beside its composer.json, is a separate thing. Nothing above touches it.

What is safe to touch

• Safe to inspect: the ls, du -sh and composer config commands above, and composer global show.
• Regenerated: the cache. Clearing it only costs download time.
• Not for hand-editing: composer.lock and the vendor folder. Use composer global commands so the two stay in step.
• Keep: composer.json, the record of what you installed globally, and config.json if you have one.
• Private: auth.json can hold tokens for private repositories. Do not paste it anywhere or share it.

Where the composer program lives

This is separate from the home folder. A Homebrew install on Apple silicon puts composer under /opt/homebrew, and on an Intel Mac under /usr/local. Run which composer to see yours; a path elsewhere means it came from another route, such as the installer script, which puts the file wherever you chose. The global packages folder is in your home folder either way.

Moving to a new Mac

Install PHP and Composer first. Copy composer.json and composer.lock from the old home folder into the new one, then run composer global install, which rebuilds vendor at the locked versions. Copy config.json too if you have one. Skip the cache, and add the PATH line to ~/.zshrc again.

Why a normal search misses it

The home folder is hidden by its leading dot, which Spotlight and Finder searches leave out, and vendor holds thousands of small files with the same names in every package. Searching for composer.json also returns a hit in every PHP project you have cloned, which buries the global one.

Finding it next time

Type composer.json or php-cs-fixer into Everywhere and each match is listed with its folder, so the copy inside .composer or .config/composer stands out from your projects; dot-folders are scanned like any other. ⌘T opens a Terminal in the folder of the result you pick. It matches file names, not what is inside the files.

Common questions

Where does Composer install global packages on a Mac?

In the vendor folder of Composer's home directory, usually ~/.composer, or ~/.config/composer on a Mac with XDG variables set. Run composer config --global home to print the exact path.

How do I add Composer's global vendor/bin to my PATH on a Mac?

Run composer global config bin-dir --absolute to get the path, back up ~/.zshrc, then add export PATH="<that path>:$PATH" to it and open a new Terminal window.

Where is the Composer cache on a Mac?

In ~/Library/Caches/composer, unless COMPOSER_CACHE_DIR or COMPOSER_HOME is set. Run composer config --global cache-dir to confirm.

Is it safe to clear the Composer cache?

Yes, with composer clear-cache. It deletes only the cache contents, and Composer downloads packages again when it needs them.