What is the LOCKB file format?
A .lockb file is the binary lockfile created by Bun, the JavaScript and TypeScript package manager and runtime from Oven. It is almost always named bun.lockb and sits at the root of a project. Bun writes it when you run bun install, recording the complete resolved dependency graph: each package, its exact version, its metadata, its sub-dependencies, and integrity hashes. Pinning all of this lets every teammate and CI job install the same tree.
Oven built the format as binary for speed. It stores data in linear arrays, refers to packages by index or by a hash of the package name, and deduplicates long strings. The file opens with the ASCII header bun-lockfile-format-v0. The downside is that a binary lockfile is hard to review and does not show up in Git diffs, which is why Bun v1.1.39 added a text lockfile and Bun v1.2 made bun.lock the default for new projects. Existing bun.lockb files still work.
Security & safety
RISK: LOWA bun.lockb file is generated data, not an executable, so opening or committing it is safe. Bun can 'run' the file only in the sense that bun ./bun.lockb prints its contents; it does not execute arbitrary code from the file. The only real caution is supply-chain trust: the lockfile pins specific package versions and their sources, so review dependency changes as you would any lockfile update. Never edit it by hand, since a corrupted binary lockfile will fail to parse.
Format details
in a nutshellPrograms that open LOCKB files
Windows3 apps
Bun (CLI)
Open-source Run bun bun.lockb in the project directory to print the lockfile as readable yarn.lock-style text, or bun install to use it.
Visual Studio Code with the bun.lockb extension
Free Install Bun, then open the project so the editor can show a readable view of bun.lockb.
@hyrious/bun.lockb parser
Open-source Use this JavaScript library or its web tool to parse bun.lockb and print its contents without installing Bun. 
macOS3 apps
Bun (CLI)
Open-source Run bun bun.lockb to print the lockfile as readable text, or bun install to reinstall from it.
Visual Studio Code with the bun.lockb extension
Free Install Bun, then open the folder to view bun.lockb as text inside the editor.
@hyrious/bun.lockb parser
Open-source Parse and print bun.lockb contents in Node or the browser without Bun installed. 
Linux3 apps
Bun (CLI)
Open-source Run bun bun.lockb for a readable text dump, or bun install to install dependencies from it.
Visual Studio Code with the bun.lockb extension
Free With Bun installed, open the project to inspect bun.lockb as readable text.
Git with textconv
Open-source Configure git config diff.lockb.textconv bun so git diff shows bun.lockb changes as readable text. Technical details
deep spec| Encoding | Binary (serialized struct-of-arrays memory dump) |
| Byte order | Little-endian (native to the machine that wrote it) |
| Container | Flat custom binary format, not a standard container |
| Compression | None; long strings over 88 characters are deduplicated to save space |
| Typical size | A few KB to a few hundred KB depending on dependency count |
| Structure | A header/magic string followed by linear arrays: package list, string buffer, dependency slices, resolutions, and hoisting trees. Packages are referenced by an auto-incrementing index or a hash of the package name rather than by repeated name strings. |
| Integrity | Stores npm-style integrity hashes for each resolved package; the format itself is version-tagged via the header string |
| Platforms | Windows, macOS, Linux |
| Notes | Designed for fast reads and memory mapping. It is not human-readable and does not render in Git or GitHub diffs without a textconv helper. Superseded as the default by the text-based bun.lock (JSONC) in Bun v1.2, but still supported. |
| Human Readable | No |
| Released | 2022 |
| Latest version | bun-lockfile-format-v0 |
| Specification | github.com |
LOCKB conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about LOCKB files.
Frequently asked questions
How do I open a bun.lockb file?
bun bun.lockb. Bun prints the lockfile as readable yarn.lock-style text. You need Bun installed for this.Why is bun.lockb binary instead of text?
Should I commit bun.lockb to Git?
How do I convert bun.lockb to the new bun.lock?
bun install --save-text-lockfile --frozen-lockfile --lockfile-only, then delete the old bun.lockb. Bun v1.2 uses the text-based bun.lock by default for new projects.Can I edit a bun.lockb file by hand?
package.json and run bun install to regenerate the lockfile. Editing the binary directly will corrupt it.
