What is pickling and what are its risks?

Q: What is pickling and what are its risks?

**Target Audience:** Python developers who know the basics and want to understand serialisation and its security model **Difficulty:** Medium **Python version:** Behaviour checked on CPython 3.11, 3.12 and 3.13 (and in the page's Pyodide 3.11 runtime) > **How to read this doc:** Each idea is explained in plain language first, then tagged with `📌 Interview term:` so you also learn the exact words an interviewer expects. Every output block in the **Verified** section was copied from a real run of the examples on this page. ## 1. Why This Even Matters — A Story First JSON is like a parts list: it describes data with a handful of plain words. **Pickle** is more like a set of assembly instructions for a robot: "fetch the class `Account` from module `__main__`, create one, fill in these fields, now fetch the function `date` and call it with 2024, 1, 31". That is far more powerful, because it can rebuild nearly any Python object exactly. It is also far more dangerous, because the robot fo

The problem

Question presented to candidate: "What does pickle do in Python, when would you use it, and why do people say you should never unpickle data you did not create yourself?"

What a strong answer should cover:

pickle.dumps/pickle.loads (and dump/load with binary files) turn almost any Python object graph into bytes and back, keeping types, shared references and cycles
Classes and functions are stored by reference (module and name), not by code, so the same class must be importable when loading; lambdas and local functions cannot be pickled
The risk: unpickling runs the REDUCE instruction, which calls whatever callable the stream names (via __reduce__), so pickle.loads on untrusted bytes is arbitrary code execution
Mitigations: do not unpickle untrusted data; sign with HMAC to detect tampering; a restricted Unpickler.find_class allowlist; prefer JSON or another data-only format across trust boundaries
Other limits: Python-only, not human-readable, fragile across code and version changes; protocols (default 4 on Python 3.8 to 3.13, 5 from 3.14)
Where it is used: multiprocessing, caching, copy-like deep clones, saving ML models (which is why loading a downloaded model file is a security decision)

Clarifying questions expected:

Where does the pickled data come from, and who could have modified it?
Does another language or a future version of the code need to read it?

Code / implementation expected: Optional — a round trip, and ideally a harmless __reduce__ demo of code running on load.

serialization
pickle

Try it yourself

Sketch your approach before you read the solution. That is what the interview tests.

Stuck? Get a hint.

A short nudge toward the approach. It will not give the answer away.

Solution

Target Audience: Python developers who know the basics and want to understand serialisation and its security model Difficulty: Medium Python version: Behaviour checked on CPython 3.11, 3.12 and 3.13 (and in the page's Pyodide 3.11 runtime)

How to read this doc: Each idea is explained in plain language first, then tagged with 📌 Interview term: so you also learn the exact words an interviewer expects. Every output block in the Verified section was copied from a real run of the examples on this page.

1. Why This Even Matters — A Story First

JSON is like a parts list: it describes data with a handful of plain words. Pickle is more like a set of assembly instructions for a robot: "fetch the class Account from module __main__, create one, fill in these fields, now fetch the function date and call it with 2024, 1, 31". That is far more powerful, because

The solution is hidden so you can try first

14 min read · 12 sections

Run the code

Edit the code and run it here. Each console line with an expected value becomes a test.

PythonWhat pickle preserves (types, shared references, cycles), protocols, and what it cannot pickle

Practice

PythonThe risk: a __reduce__ payload runs during loads; a restricted Unpickler and HMAC signing