Safetensors
The model-weight format that cannot execute code when you load it
Overview
Safetensors is an open-source tensor serialisation format from Hugging Face that stores model weights as raw tensor data with a small JSON header, removing the arbitrary code execution that Python pickle allows on load. It is the default weight format across the Hugging Face Hub and has moved under the PyTorch Foundation.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 1 Aug 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
Use cases
What you can produce with Safetensors
- Save and load model weights without the arbitrary code execution that pickle deserialisation permits
- Load large checkpoints with zero-copy and memory mapping instead of deserialising the whole file
- Convert existing pickle checkpoints to the format with Hugging Face conversion tooling
- Read a file header to inspect tensor names, shapes and dtypes before committing to a full load
- Ship weights that downstream users can accept without executing a stranger's Python on load
- Use the same format across PyTorch, TensorFlow, JAX and other supported runtimes
ASEAN Perspective
Safetensors in Southeast Asia
ASEAN-region availability and pricing notes coming soon. Drop the editorial team a note via /contact/ if you can supply local context (Singapore/Malaysia/Indonesia/Thailand/Vietnam).
One of the few genuinely uncomplicated wins in the ML toolchain. It removed a real remote-code-execution surface from the ordinary act of downloading a model, and it made loading faster at the same time, so nobody had to weigh safety against convenience. That combination is why it spread without an argument.
The caveat is not about the format but about the ecosystem around it. A meaningful share of models on public hubs still ship pickle files, so if your pipeline ingests community weights, verify what you are actually loading rather than assuming the migration is complete.
What people say
Safetensors solved a problem that most people did not realise they had. For years the default way to distribute model weights was Python pickle, a format that runs arbitrary code when it is deserialised. Downloading a model from a public hub meant executing whatever its author had put in the file, and the ecosystem had normalised that. Hugging Face published Safetensors to end it, and the format has since become the default across the Hub and moved under the PyTorch Foundation.
Developer reception has been unusually uncontentious for an infrastructure change, and the reason appears in the empirical literature rather than in forum arguments. An academic study of usage trends and developer perceptions found adoption driven substantially by automated conversion of existing models rather than by authors deliberately switching, which is a fair characterisation: most people got the safer format without doing anything, which is the best possible outcome for a security fix and also why it generated so little discussion.
The performance side earned goodwill independently. Zero-copy loading and memory mapping mean large checkpoints load faster than the format it replaced, so teams adopting it for safety reasons found it was not a trade-off. Frontier open-weight releases now ship in it as a matter of course.
The honest limitation is that adoption is not universal. Research through 2025 found a substantial share of popular Hub models still publishing a pickle file alongside or instead of the safe format, so anyone building a pipeline that ingests arbitrary community models cannot assume the risk has gone away. The format also deliberately stores tensors and nothing else, so anything requiring arbitrary Python objects in a checkpoint needs a different mechanism. Neither is a criticism of the design; both are reasons to keep checking what a file actually is rather than trusting the ecosystem to have finished the migration.
Summary of public user & expert reviews, compiled by RECATOOLS.
About this listing
This entry was compiled from publicly available data including Safetensors's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Safetensors unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Safetensors directly →
Spotted something out of date? Suggest an update →
Alternatives to Safetensors
More in Code & Dev Tools
