Hugging Face Hub

Git repositories, which is the fact that matters

The Hub hosts models, datasets and Spaces, at a scale that makes browsing pointless: over two million models and a million and a half datasets.

The property worth building on is quieter. Every repository is git, with versioning, commit history, diffs and branches. A model is not a file you downloaded once; it is a revision you can name.

Models on Hugging Face covers reading a model card once you have found one. This page is the registry underneath it.

Pin the revision

Because repositories are git, you can pin. Most code does not, and that is the reproducibility bug waiting in a lot of ML projects.

Loading a model by name alone gets you whatever the main branch holds today. The author can push new weights, change the tokenizer, or alter the config, and your pipeline changes with no diff in your own repository. The symptom is output that drifts for reasons nobody can trace to a commit.

Pin a revision for anything that has to behave the same next month. It costs one argument, and it converts a silent dependency into a declared one. This is the same argument Anthropic Claude makes about pinned model snapshots, and here you have to opt in.

Three artifact types, and a fourth store

Models carry model cards, metadata for tasks and languages, evaluation results, inference widgets, and a serverless API through Inference Providers.

Datasets come with dataset cards and a browser-based viewer, and the datasets library can stream one too large for your disk.

Spaces are hosted demo apps, built with Gradio or Streamlit, as static HTML, or from a Docker image. ZeroGPU allocates GPU time on demand for demos that need it.

Storage Buckets are the non-git option: S3-like object storage for checkpoints, logs and large artifacts that do not need version history. Reach for these when git semantics are overhead rather than help.

All repositories sit on Xet, a storage backend that chunks large files for faster transfer.

Gated, private, and who can read them

Repositories can be gated, requiring you to accept terms or be approved before downloading. That is how many model licences get enforced, and it means a download that works on your laptop may fail in CI where nobody accepted anything.

Organizations group accounts with role-based access control, so a team can keep private models and datasets alongside public work. For regulated teams, storage regions and SSO exist on the paid plans.

Treat it as a supply chain

This is the framing that prevents the most trouble. You are pulling executable artifacts from a public registry, and the same instincts you apply to npm or PyPI belong here.

The Hub scans for malware and supports GPG-signed commits, and neither removes your responsibility. Three habits:

Know who published it. An organization account with a track record differs from a fresh user, and a fine-tune of a well-known model is not the well-known model.

Pin, as above. An unpinned dependency is one you have not really chosen.

Manage tokens like credentials. User access tokens can write to your repositories. Scope them, and keep them out of notebooks people share.

Finding things at that scale

Filter rather than search. Task, library, language and licence narrow two million models to something readable, and Hugging Face tasks covers why the task facet is more precise than it looks.

Collections are the underused feature: a curated set someone assembled for a purpose, which is usually a better starting shortlist than a sort by downloads. Download counts measure popularity and age, not fitness for your problem.

Further reading

• Hugging Face, Hub documentation: the repository model, artifact types, organizations and security.
• Models on Hugging Face: reading a model card.
• Hugging Face tasks: the filter that does the most work.
• Hugging Face Inference SDK: running what you find.