What is the PKL file format?
A .pkl file contains a Python object serialized using the pickle module from the Python standard library. Pickling converts nearly any Python data structure - dictionaries, lists, class instances, NumPy arrays, trained machine learning models - into a byte stream that can be saved to disk and later restored with pickle.load().
The format uses a stack-based Pickle Virtual Machine (PVM): a stream of single-byte opcodes that, when executed, reconstruct the original object. Protocol versions range from Protocol 0 (text-based opcodes, Python 1.2) through Protocol 5 (Python 3.8+, PEP 574, supporting out-of-band buffers for large NumPy arrays). Protocol 4 (magic bytes 80 04 95) is the default in Python 3.8-3.11. There is no fixed schema; the byte stream structure is entirely determined by the object being serialized.
The dominant modern use is saving trained ML models from scikit-learn, PyTorch (torch.save wraps pickle internally), and XGBoost, and caching expensive computed results. The joblib library (which also uses pickle) is preferred for large NumPy arrays due to memory-mapping support.
Security warning: loading a .pkl file from an untrusted source can execute arbitrary Python code. Safer alternatives include .json for simple data, HDF5 or Parquet for tabular data, and ONNX or safetensors for ML models. The .pkl and .pickle extensions are fully interchangeable.
Security & safety
RISK: HIGHPython Pickle can execute arbitrary code during loading (via __reduce__ / REDUCE opcode). A malicious .pkl file is a code execution attack vector - treat like an executable. Only load .pkl files from sources you trust completely. For ML model sharing, prefer safetensors (HuggingFace) or ONNX format which cannot execute code on load. The pickle docs explicitly warn: "The pickle module is not secure."
Format details
in a nutshellFULL NAMEPython Pickle Serialized Objectaka Pickle file, .pkl file
DEVELOPERPython Software Foundation (Guido van Rossum, original pickle module)since 1995 (Python 1.2, original pickle module)
CATEGORYData Files
MIME TYPEapplication/octet-stream
TYPEbinary serialized Python object stream
This extension is also used by…
- Microsoft Exchange Migration Wizard Packing List - Legacy Microsoft Exchange migration tool used .pkl for packing lists; completely unrelated to Python pickle.
MAGIC BYTES · FILE SIGNATURE
OFFSET
000102
HEX
800495
ASCII
···
Protocol 4: 0x80 0x04 0x95 (most common, Python 3.4+). Protocol 3: 0x80 0x03 (Python 3.0-3.3). Protocol 2: 0x80 0x02 (Python 2.3+). Protocol 0/1: no magic header (text/binary opcodes, '\x80' absent). Protocol 5: 0x80 0x05 (Python 3.8+).
Programs that open PKL files
Windows3 apps
Python (pickle module)
Open-source import pickle; obj = pickle.load(open('file.pkl', 'rb')) - then inspect obj.
Visual Studio Code (with Python extension)
Free Open a Jupyter notebook or Python terminal in VS Code; use pickle.load() to inspect contents. 
macOS1 app
Linux1 app
Technical details
deep spec| Encoding | Binary opcode stream for the Pickle Virtual Machine (PVM) |
| Protocol 4 magic bytes | 80 04 95 at offset 0 (Python 3.4+; default in Python 3.8-3.11) |
| Protocol 5 magic bytes | 80 05 at offset 0 (Python 3.8+, PEP 574, out-of-band buffer support for NumPy) |
| Protocol 2 magic bytes | 80 02 at offset 0 (Python 2.3+, new-style class support, PEP 307) |
| Protocol range | Protocol 0 (text opcodes, 1995) through Protocol 5 (Python 3.8+, 2019) |
| Data structure | Flat opcode stream with operand stack and memo table; STOP opcode (0x2E) marks end of stream |
| Schema | No fixed schema; structure is determined entirely by the Python object being serialized |
| MIME type | application/octet-stream (no registered MIME type) |
| Typical file size | 1 KB - several GB (small dicts to large ML model weight tensors) |
| Security risk | Arbitrary Python code execution possible on pickle.load() from untrusted sources |
| Cross-language portability | Python-only; no other language can natively read or write this format |
| Primary modern use | Saving scikit-learn models, PyTorch weights (torch.save), XGBoost models, cached computations |
| Interchangeable extension | .pickle is identical in format and fully interchangeable with .pkl |
| Related library | joblib wraps pickle with memory-mapping optimizations suited for large NumPy arrays |
| Released | 1995 (Python 1.2, original pickle module) |
| Latest version | Protocol 5 (Python 3.8+, PEP 574, 2019) |
| Specification | docs.python.org |
Community Q&A
asked by users
A
Frequently asked questions
How do I open a .pkl file?
Use Python: import pickle; obj = pickle.load(open('file.pkl', 'rb')). Only load pkl files you trust - they can execute code on load.
Is a .pkl file safe to open?
Only if you trust the source. Pickle can execute arbitrary Python code during loading. Never open .pkl files from unknown sources.
What program created my .pkl file?
Almost certainly Python - either directly via pickle/joblib, or a framework like scikit-learn (model.fit then joblib.dump) or PyTorch (torch.save).
Can I open a .pkl file without Python?
Not meaningfully. Pickle is Python-specific. You need Python and ideally the same library that created the file (scikit-learn, PyTorch, etc.).
How do I convert .pkl to JSON or CSV?
Load with Python pickle first, then serialize: json.dump(obj, open('out.json','w')) for JSON-serializable data, or pd.DataFrame(obj).to_csv() for tabular data.
What is the difference between .pkl and .pickle?
They are identical - both use Python's pickle format. The extension choice is a convention; .pkl is more common in ML contexts.
References
1Python Docs - pickle moduledocs.python.org
2PEP 307 - Protocol 2 (Python 2.3)peps.python.org
