What changes between pickle protocol versions, and when would you pin one explicitly?

### What the number means Every pickle stream begins with a `PROTO` opcode carrying a single byte: the protocol version it was written with. That number selects which opcodes the writer is allowed to use, and therefore what the reader must understand. It is a format version, nothing more — it does not change what the stream is permitted to call on load, so it is not a security setting. The versions, and what each one actually bought: * **0** — the original, printable-ASCII format. Human readable, verbose, and the only one you would ever pick for eyeballing a stream by hand. * **1** — the original binary format, from the same era. * **2** — introduced with Python 2.3; efficient pickling of new-style classes. * **3** — introduced with Python 3.0; proper `bytes` support, and deliberately unreadable by Python 2. * **4** — introduced with Python 3.4; framing for faster reads, support for very large objects beyond the 4 GiB limits of earlier versions, and lookup of nested classes by qualified name. * **5** — introduced with Python 3.8 (PEP 574); **out-of-band buffers**, so a producer can hand large binary payloads to the transport directly instead of copying them into the byte stream. Two module constants describe the local interpreter: `pickle.HIGHEST_PROTOCOL`, the newest this build can write, and `pickle.DEFAULT_PROTOCOL`, the one used when you do not pass `protocol=`. On CPython 3.14 both are 5; on 3.13 and earlier the default was 4 while the highest was already 5. That difference is the reason the question comes up in practice: code that never passed `protocol=` explicitly started producing a different stream version when the interpreter was upgraded. ### Compatibility runs one way A newer interpreter reads every older protocol. An older interpreter reads nothing newer than its own highest — it raises rather than guessing. That asymmetry is the whole decision rule: * Reader and writer are the same deployment, upgraded together → take the default and move on. * The artefact outlives the writer, or is read by something that may lag — a cache shared with a service pinned to an older runtime, a file another team consumes, an artefact stored for months → pass `protocol=` explicitly at the lowest version that still supports what you serialize, and treat that number as part of the interface. Pinning also protects you from the silent change above: an explicit `protocol=4` produces the same bytes before and after an interpreter upgrade, which matters if anything downstream hashes or diffs the output. ### Out-of-band buffers, briefly Protocol 5's headline feature is worth understanding even if you rarely reach for it. Normally every byte of a large binary object is copied into the pickle stream. With protocol 5, a type whose reduction wraps its memory in a `pickle.PickleBuffer` can have that memory handed to a `buffer_callback` you supply, staying outside the stream; the loader passes the buffers back through the `buffers=` argument. Nothing is copied into or out of the serialized bytes. This is what makes pickle viable as a transport for large binary payloads between processes on one host, and it is the reason libraries that own big contiguous buffers implement `__reduce_ex__` with a protocol check. ### What the protocol number does not do It does not make loading safer. Every protocol from 0 to 5 carries the reduce machinery — the opcodes that import a name and call it — so choosing protocol 2 for "compatibility with an old reader" changes nothing about who may execute what. Untrusted input remains untrusted at every version. It also does not change what is picklable. A lambda is unpicklable at protocol 5 for the same reason it is unpicklable at protocol 0: functions travel by qualified name. Protocol 4's nested-class support is the one narrow exception worth remembering — a class defined inside another class became reachable, because qualified names carry the outer name; a class defined inside a *function* is still out of reach at every protocol. The habit to build is simple: pass `protocol=` deliberately whenever the bytes leave the process that wrote them, and inspect an unknown stream's header with `pickletools.dis` rather than assuming.