What is a .safetensors file?
Safetensors Model Weights · Data · Hugging Face · 2022
Safetensors is a format for storing machine-learning model weights safely and fast. It was created to replace Python pickle files, which can run arbitrary code when loaded; safetensors holds pure tensor data and cannot.
What is a .safetensors file used for?
A .safetensors file begins with an 8-byte little-endian number giving the size of a JSON header, then the header describing each tensor, then the raw tensor bytes. This simple layout allows fast, memory-mapped loading of huge models.
It is the default weight format across the Hugging Face ecosystem and diffusion tools like Stable Diffusion. You load it with a library (transformers, diffusers), not a viewer.
What opens a .safetensors file?
The .safetensors format opens in the following apps, grouped by operating system. If one app does not work, try another from the same list.
Windows
- Python (safetensors, transformers)
- ComfyUI
- Automatic1111
macOS
- Python (safetensors, transformers)
- ComfyUI
Linux
- Python (safetensors, transformers)
- ComfyUI
Open a .safetensors file step by step
- Confirm the file really is a .safetensors. Drop it into the WhatFileType identifier, which reads its signature in your browser without uploading anything.
- On Windows, open it with Python (safetensors, transformers) or ComfyUI.
- On Mac, use Python (safetensors, transformers) or ComfyUI.
- On Linux, try Python (safetensors, transformers) or ComfyUI.
- Still stuck? Convert the .safetensors to gguf (via conversion), which opens more widely.
Why can't I open my .safetensors file?
Almost always because no installed app understands Safetensors. Install one of the apps above, or convert the file to a format your existing software already reads. If double-clicking opens the wrong program instead of nothing at all, the file association is set to the wrong app rather than the file being broken.
The other possibility is that the file is not really a .safetensors at all. Drop it into the file identifier to check it by its bytes instead of its name. Nothing is uploaded.
How to convert a .safetensors file
You can convert a .safetensors file to gguf (via conversion), onnx using a conversion tool or the export menu of an app that opens it.
Safetensors has no fixed magic number, so there is no signature table on this page. Its bytes alone do not prove the format: identification relies on the extension, the structure of the content and the program that created it. The magic-numbers reference lists the formats that do carry one.
Frequently asked questions
What is a .safetensors file?
Safetensors is a format for storing machine-learning model weights safely and fast. It was created to replace Python pickle files, which can run arbitrary code when loaded; safetensors holds pure tensor data and cannot.
How do I open a safetensors file?
Load it in Python with the safetensors or transformers library, or in a UI like ComfyUI or Automatic1111. It is model weights, not a document.
Why is safetensors safer than a pickle file?
Python pickle can execute arbitrary code when loaded, a real security risk with shared models. Safetensors stores only numbers, so loading it cannot run code.
What is inside a safetensors file?
A JSON header listing each tensor's name, data type and shape, followed by the raw weight data. That is all, which is what makes it safe and fast.
Related formats
Sources
Details on this page were checked against authoritative references. How sources are ranked and what is deliberately left out is set out in the methodology.