Back to Gap Map Infrastructure / Core ML frameworks & libraries

Safetensors

open source / Overall score: 4.6(leading)

Safetensors is a file format and library for storing and loading tensors safely, designed as an alternative to Python pickle that avoids arbitrary code execution and supports fast zero-copy loading. It is implemented in Rust with Python bindings and provides loaders for PyTorch, TensorFlow, Flax, NumPy and PaddlePaddle. Hugging Face maintains it.

Openness

5 high confidence

5.0

license: Apache-2.0(OSI)
source: public
core features withheld: no

Both the Rust crate and the Python package are released under Apache-2.0, and the README gives build-from-source steps for the whole library. It mentions no paid, enterprise or hosted tier, so nothing is withheld from the public source.

https://cdn.jsdelivr.net/gh/huggingface/safetensors@main/LICENSE recorded 2026-09-29
LICENSE file is the Apache License Version 2.0 text, headed "TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION".
https://cdn.jsdelivr.net/gh/huggingface/safetensors@main/README.md recorded 2026-09-29
README ends with "License: Apache-2.0" and gives build-from-source steps ("For the sources, you need Rust"). Searched the body for enterprise, paid, pricing, license key and hosted: none.
https://crates.io/api/v1/crates/safetensors recorded 2026-09-29
crates.io metadata lists the crate under "license":"Apache-2.0" with "repository":"https://github.com/huggingface/safetensors".
https://github.com/huggingface/safetensors/blob/main/LICENSE recorded 2026-08-13
LICENSE file is the verbatim Apache License Version 2.0 text

Adoption

5 high confidence

5.0

Adoption is measured as PyPI downloads of the safetensors Python package in the trailing 30 days; the separate Rust crate is not counted in that figure.

https://pypistats.org/api/packages/safetensors/recent recorded 2026-08-13
last_month downloads = 111,835,984 for safetensors

Capability

4 high confidence

4.0

Safetensors is a storage format rather than a training or inference framework, so its scope is narrow. Within that scope it offers safe loading, zero-copy reads, lazy loading of individual tensors and bfloat16/fp8 support, with loaders for five frameworks.

https://cdn.jsdelivr.net/gh/huggingface/safetensors@main/README.md recorded 2026-09-29
README describes the format as one "for storing tensors safely (as opposed to pickle)", with a comparison table covering safety, zero-copy, lazy loading, layout control and bfloat16/fp8 support.
https://github.com/huggingface/safetensors recorded 2026-08-13
README still describes a safe, zero-copy tensor format with both Rust and Python implementations
https://huggingface.co/docs/safetensors/main/en/index recorded 2026-09-29
Documentation states "Safetensors is a new simple format for storing tensors safely (as opposed to pickle) and that is still fast (zero-copy)" and has separate API pages for Torch, Tensorflow, PaddlePaddle, Flax and Numpy.

Verified 2026-09-24