---
title: Safetensors stores tensor data without pickle object loading
slug: hf-safetensors
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source: https://iinventedlight.com/library/notes/hf-safetensors.md
source_license: Apache-2.0
attribution: Original synthesis by iinventedlight, drafted by Librarian with AI assistance; based on the attributed sources
  below.
author: Librarian
client: Librarian
date: '2026-11-05'
checked_on: '2026-11-05'
as_of: '2026-11-05'
status: published
confidence: medium
category: coding-references
tags:
- hf
- safetensors
untested: Reference note. No code or commands were run to validate behavior.
sources:
- id: S1
  title: Safetensors
  publisher: Hugging Face Safetensors contributors
  url: https://raw.githubusercontent.com/huggingface/safetensors/main/docs/source/index.mdx
  accessed: '2026-11-05'
  license: Apache-2.0
  license_url: https://raw.githubusercontent.com/huggingface/safetensors/main/LICENSE
  license_verified: '2026-11-05'
  green: true
  attribution: Hugging Face Safetensors contributors; Safetensors; Apache-2.0
  snapshot: _fetched/safe-index.txt
- id: S2
  title: safetensors
  publisher: Hugging Face Safetensors contributors
  url: https://raw.githubusercontent.com/huggingface/safetensors/main/README.md
  accessed: '2026-11-05'
  license: Apache-2.0
  license_url: https://raw.githubusercontent.com/huggingface/safetensors/main/LICENSE
  license_verified: '2026-11-05'
  green: true
  attribution: Hugging Face Safetensors contributors; safetensors; Apache-2.0
  snapshot: _fetched/safe-readme.txt
---
# Safetensors stores tensor data without pickle object loading

## Summary
Safetensors is a tensor-storage format designed as an alternative to pickle. Its Python interface can read named tensors, and `safe_open` also supports reading a slice. [S1]

## Details
The file begins with a header-length field followed by a JSON header and a tensor byte buffer. Header entries describe tensor names, shapes, data types, and byte offsets. The README limits metadata to string-to-string values. Format safety is not a claim about the meaning of a tensor: the README notes that tensor values can include NaN and infinity. [S1, S2]

## Claims
- id: C1
  claim: "safe_open can retrieve only a portion of tensor data."
  source: S1
  evidence: "Loading only part of the tensors"
- id: C2
  claim: "The header is a UTF-8 JSON string."
  source: S2
  evidence: "a JSON UTF-8 string representing the header"
- id: C3
  claim: "Tensor values are not validated for NaN or infinity."
  source: S2
  evidence: "Tensor values are not checked against"

## Sources
- [S1] Safetensors. Hugging Face Safetensors contributors. https://raw.githubusercontent.com/huggingface/safetensors/main/docs/source/index.mdx. Apache-2.0; license: https://raw.githubusercontent.com/huggingface/safetensors/main/LICENSE. Accessed 2026-11-05.
- [S2] safetensors. Hugging Face Safetensors contributors. https://raw.githubusercontent.com/huggingface/safetensors/main/README.md. Apache-2.0; license: https://raw.githubusercontent.com/huggingface/safetensors/main/LICENSE. Accessed 2026-11-05.

## Attribution and notices
This note is CC BY 4.0. Source material has been condensed and restated; short evidence excerpts retain their source license.

Hugging Face Safetensors documentation is Apache-2.0. This note restates the documentation and includes only short evidence excerpts. See the accompanying source license.