Safetensors is a file format from Hugging Face for storing model weights safely and loading them fast, as a replacement for Python's pickle format.
In plain words
PyTorch has traditionally saved models using pickle, and loading a pickle file can run arbitrary code hidden inside it, which is dangerous for files downloaded from the internet. Safetensors stores only the tensors, the arrays of numbers that make up the weights, so loading one cannot run code. It is also zero-copy and supports lazy loading, so reading a file needs no extra memory and you can load just some of the weights.
A quick example
Imagine downloading a model from a stranger's repository. If the weights come as a pickle file, opening it could run hidden code on your machine. If they are a .safetensors file, your code simply reads the numbers, and can even load just the parts it needs.
Where you'll meet it
- Sharing model weights on Hugging Face.
- Loading large models quickly in PyTorch and other frameworks.
Related
Sources
- DocsSafetensors, Hugging Face documentation · read 29 Sept 2026
- Docshuggingface/safetensors, Hugging Face (GitHub) · read 29 Sept 2026
Checked by WhatIsAI against the sources above · 29 Sept 2026. Spotted an error? Report it.