A method is safe if it never changes state on the server. A method is idempotent if sending the exact same request multiple times leaves the server in the same state as sending it once. Every safe method is idempotent, but not every idempotent method is safe.

GET just reads, so it's safe. PUT changes state, so it isn't safe — yet replacing a resource with the same representation twice leaves it exactly as replacing it once did, so it's idempotent. PATCH is the one method without a fixed answer, because whether repeating a partial update is safe depends on what the update actually says.