ZIP and tar Archive Inspector
List the files inside a ZIP, tar or tar.gz archive (names, sizes, compression and dates) without extracting it, and spot path traversal entries.
Free · No sign-up · Your inputs stay in your browser
Input
List the contents of a ZIP or tar archive
Output
Choose an archive
Read in the browser without extracting anything: a ZIP's central directory at the end of the file, or a tar's 512-byte headers. Entries with absolute paths or .. in them are flagged, because extracting them can write outside the target directory (zip slip). A ZIP whose unpacked size is thousands of times its packed size is a decompression bomb.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Zip slip
An archive entry named ../../etc/cron.d/job extracts outside the target directory with a naive extractor, which has been a real vulnerability in many libraries and applications. Checking names before extracting, or extracting with a library that rejects them, prevents it. Snyk's research named it zip slip in 2018.
Decompression bombs
A small archive whose unpacked size is enormous can fill a disk or exhaust memory. Comparing the total unpacked size with the archive size before extracting user uploads is a cheap defence.