Safety · before you extract
Check a ZIP before you extract it
Opening an archive is not the same as running what is inside it. This reads the file list, flags the entries worth a second look, and never writes anything to your disk.
Open the archive you are unsure about. Risky entries are badged in the file list as you browse.
Drop a ZIP file here
Supports .zip, .jar, .apk, .epub, .docx, .xlsx and other ZIP containers
Open a ZIP from a URL
Paste a direct link to a .zip file and open it without downloading it first.
You will be asked to sign in to Google. Only the file you pick is shared with this page.
Drop files or folders here
Or choose them from your device. They are zipped in your browser and never uploaded.
Files to include
Encrypted with AES-256. Anyone opening the archive will need this password, and it cannot be recovered if you lose it.
This archive is password-protected.
0
Files
—
Uncompressed
—
Archive size
—
Saved
Select a file to preview it. Images, text, code, PDFs, audio and video open here — and a ZIP inside this ZIP can be opened in place.
What gets flagged
Three patterns earn a badge in the file list. Each one is a property of the archive's structure, visible without extracting or running anything.
| Pattern | What it holds | Reads as |
|---|---|---|
../ inside a path | A “Zip Slip” entry. The stored path points outside the folder you would extract into, and a careless extractor can be tricked into writing it elsewhere on your disk. | flagged |
/etc/... or C:\... | An absolute path. Some extraction tools honour it literally and write to that exact location rather than into the folder you chose. | flagged |
.exe .msi .bat .apk .dmg … | An executable or installer, where extracting is harmless but double-clicking afterwards is the risk. Nineteen extensions are matched. | flagged |
Script files (.js, .sh, .ps1) and library binaries (.dll, .so) are deliberately not flagged. They are the ordinary contents of every source archive and build artifact, and badging them would turn the warning into noise on exactly the archives developers open most — which is how a safety feature gets ignored.
What this page actually checks
It reads the archive's central directory — the index every ZIP carries, listing each entry's name, sizes and timestamps — and examines the stored paths. That is enough to reveal the structural tricks: an entry that escapes its folder, an absolute path, an installer sitting in an archive that was supposed to hold documents.
None of this requires decompressing anything, and the viewer never writes to disk. A Zip Slip entry cannot hurt you here in any case, because there is no extraction step to exploit — but seeing one is a strong signal about the archive's intent, and most desktop tools show you nothing at all.
What it cannot tell you
This is not a virus scanner, and it would be dishonest to let the page imply otherwise. It does not inspect file contents for malware signatures, it does not sandbox or detonate anything, and a clean file list is not a clean bill of health. A perfectly ordinary-looking invoice.pdf.exe gets flagged for being an executable; genuine malware inside a legitimately-named document does not.
For an actual malware verdict, upload the file to a scanning service such as VirusTotal — accepting that doing so means handing your file to a third party, which is the trade this tool otherwise exists to avoid. The honest division of labour: use this page to understand what an archive contains and how it is shaped, and a scanner to judge whether specific contents are malicious.
How to verify nothing is uploaded
Every tool in this category claims it processes files locally. You should not have to take anyone's word for it, including ours — so here is how to check, in about fifteen seconds.
Load this page, then turn off your Wi-Fi or unplug the network. Open an archive. It will work, because the code that reads it is already in your browser and no server is involved. For a stricter check, open your browser's developer tools, switch to the Network tab, and open an archive while watching: you will see no request carrying your file. This is worth doing to any online tool you trust with a private document, not just this one.
One narrow exception, stated plainly because the check above would otherwise catch us in an inconsistency: if you paste a public URL rather than choosing a local file, and the host that serves it blocks direct browser access, those bytes are relayed through a proxy to get around the browser's cross-origin rules. Files you select from your own device never take that path.
Questions about archive safety
Is it safe to open ZIP files online?
It depends entirely on the tool. Most upload your archive to a server, unpack it there, and hand back a link — meaning a stranger's machine held a full copy. This one reads the file inside your own browser tab and transmits nothing, so there is nothing to intercept or retain.
How can I check a ZIP for viruses before extracting?
Not here — this page flags structural risks such as path traversal and executables, but it does not scan file contents for malware. For an actual verdict use a scanning service like VirusTotal, accepting that it means uploading the file. Use this page to see what an archive holds, a scanner to judge it.
How big a ZIP can I open?
There is no fixed limit, but browser memory sets a practical ceiling. Archives up to a few hundred megabytes open without trouble on most devices. Because only the index is read until you preview a specific file, large archives list far faster than they would extract.
How do I know a ZIP tool isn't uploading my files?
Test it. Disconnect from the network and try to open an archive — if it still works, no server is involved. Or open developer tools, watch the Network tab, and confirm no request carries your file. Both checks take seconds and work on any online tool, not just this one.
What is a Zip Slip archive?
One containing an entry whose stored path climbs out of the extraction folder using ../ segments — for example ../../../etc/passwd. Extractors that join paths without validating them can be tricked into overwriting files elsewhere on the system. The pattern is badged in the file list here.