Novus Convert
Convert files
Data format

SAFETENSORS converter

A .safetensors file stores machine-learning model weights: a JSON header naming each tensor with its dtype, shape and byte range, then the tensor data laid end to end. Its defining property is negative — loading one cannot execute code, which is precisely what loading a PyTorch .bin or .pt checkpoint can do.

Private for supported formats — processed in your browser

Convert supported files

Runs on your device

Drop SAFETENSORS files here

Batch files can each use a different output. Nothing uploads for local conversions.

Working inputs include camera RAW, browser-local audio/video, PDF, CBZ/CBR comics, office documents, ebooks, markup, 3D models, structured text, images, and archives.

Where SAFETENSORS comes from

Hugging Face released safetensors in 2022 after the risk in PyTorch checkpoints became impossible to ignore: those files are Python pickles, and unpickling is arbitrary code execution, so downloading a model from a public hub meant running a stranger's code. safetensors gave the ecosystem a format with the same speed and no execution path. Hugging Face made it the default on the Hub, and PyTorch, Diffusers and llama.cpp tooling followed.

How SAFETENSORS works

  • The file opens with a little-endian uint64 giving the length of the JSON header.
  • The header maps each tensor name to its dtype, shape and data_offsets — a start and end pair measured from the end of the header, not from the start of the file.
  • A reserved __metadata__ key holds arbitrary string key-value pairs, which is where model cards and format hints usually live.
  • Tensor data is contiguous and unpadded, so an individual tensor can be read by seeking to its offset without touching the rest of the file.
  • There is no code, no pickle and no executable content anywhere in the specification — reading a file can only ever produce tensors.

When to use SAFETENSORS

  • Distributing model weights where users must not have to trust the publisher
  • Loading a large model quickly through memory mapping and lazy tensor access
  • Auditing what a checkpoint actually contains before loading it
  • Exporting individual tensors for analysis outside the training framework

Strengths and limitations

Strengths

  • Loading cannot execute code, which pickle-based checkpoints cannot promise
  • Zero-copy and lazy loading make very large models fast to open
  • Simple enough that a correct reader is a short piece of code in any language

Limitations

  • Stores tensors only — no optimizer state, no model architecture, no training code
  • Uncompressed, so file size tracks parameter count directly
  • Tensor names are a convention of the producing framework, not part of the format

Compatibility

The Rust and Python implementations are the reference, and PyTorch, Transformers, Diffusers, ComfyUI and most inference servers read it directly. Novus Convert inspects .safetensors metadata safely in the browser and exports either the header as JSON or the tensors as a ZIP of independently reopenable .npy files, so each tensor can be checked with an ordinary NumPy reader rather than taken on trust.

Tensor names, dtypes, shapes and the __metadata__ string map are all read and preserved into the JSON export and into the exported NumPy filenames.

Convert SAFETENSORS to another format