What is a .safetensors file?
Safetensors Model Weights · Data · Hugging Face · 2022
Safetensors is a format for storing machine-learning model weights safely and fast. It was created to replace Python pickle files, which can run arbitrary code when loaded; safetensors holds pure tensor data and cannot.
What is a .safetensors file used for?
A .safetensors file begins with an 8-byte little-endian number giving the size of a JSON header, then the header describing each tensor, then the raw tensor bytes. This simple layout allows fast, memory-mapped loading of huge models.
It is the default weight format across the Hugging Face ecosystem and diffusion tools like Stable Diffusion. You load it with a library (transformers, diffusers), not a viewer.
How to open a .safetensors file
The .safetensors format opens in the following apps, grouped by operating system. If one app does not work, try another from the same list. For a step-by-step walkthrough, see how to open a .safetensors file.
Windows
- Python (safetensors, transformers)
- ComfyUI
- Automatic1111
macOS
- Python (safetensors, transformers)
- ComfyUI
Linux
- Python (safetensors, transformers)
- ComfyUI
How to convert a .safetensors file
You can convert a .safetensors file to gguf (via conversion), onnx using a conversion tool or the export menu of an app that opens it.
.safetensors file signature (magic bytes)
Programs recognise a .safetensors file by the bytes at the start of the file, not by its name. These are the signatures for Safetensors.
| Hex signature | Offset | Note |
|---|---|---|
| (no fixed signature) | 0 | 8-byte little-endian header length, then a JSON header; no fixed magic |
See the full magic-numbers reference for every format.
Frequently asked questions
What is a .safetensors file?
Safetensors is a format for storing machine-learning model weights safely and fast. It was created to replace Python pickle files, which can run arbitrary code when loaded; safetensors holds pure tensor data and cannot.
How do I open a safetensors file?
Load it in Python with the safetensors or transformers library, or in a UI like ComfyUI or Automatic1111. It is model weights, not a document.
Why is safetensors safer than a pickle file?
Python pickle can execute arbitrary code when loaded, a real security risk with shared models. Safetensors stores only numbers, so loading it cannot run code.
What is inside a safetensors file?
A JSON header listing each tensor's name, data type and shape, followed by the raw weight data. That is all, which is what makes it safe and fast.
Related formats
Sources
Details on this page were checked against authoritative references: