Safetensors
Hugging FaceSafetensors is a file format and library for storing and loading tensors safely, designed as an alternative to Python pickle that avoids arbitrary code execution and supports fast zero-copy loading. It is implemented in Rust with Python bindings and works across PyTorch, TensorFlow and other frameworks. Hugging Face maintains it and publishes model weights in it.
Verified 2026-08-13 via GitHub and the LICENSE body.
Openness
5 high confidence- license
- Apache-2.0(OSI)
- source
- public
- core-gated
- ungated
LICENSE body is verbatim Apache License 2.0; full Rust/Python source public. The repository is public and unarchived, and the README describes the whole library with no paid, enterprise or hosted tier beside it, so source is public and the core ungated.
- https://github.com/huggingface/safetensors/blob/main/LICENSE recorded 2026-08-13
LICENSE file is the verbatim Apache License Version 2.0 text
- https://api.github.com/repos/huggingface/safetensors recorded 2026-08-13
Repo metadata - license spdx_id Apache-2.0, private false, archived false, default branch main - for huggingface/safetensors.
- https://raw.githubusercontent.com/huggingface/safetensors/main/README.md recorded 2026-08-13
README describes the format and both the Rust crate and the Python package as published. No paid tier or feature-gated build appears.
Adoption
5 high confidence111,835,984 PyPI downloads of `safetensors` in the trailing 30 days, which falls in the top band of the software usage scale, over 10M a month, level 5.
- https://pypistats.org/api/packages/safetensors/recent recorded 2026-08-13
last_month downloads = 111,835,984 for safetensors
Capability
4 high confidenceNarrow scope (storage format) but central as the default Hub weight format.
- https://github.com/huggingface/safetensors recorded 2026-08-13
README still describes a safe, zero-copy tensor format with both Rust and Python implementations
Verified 2026-08-13