About this tool
Review an untrusted ZIP archive before opening members, then extract only the files you select after structural and integrity checks pass in your browser.
ZIP Inspector & Verified Extractor reconciles ZIP end records and critical local entry fields, verifies payload and descriptor boundaries, classifies unsafe paths and entry types, and verifies selected output bytes before enabling individual downloads.
- Preflights a central directory up to 16 MB and 10,000 entries, reconciles classic and ZIP64 end records plus critical local and central header fields, then verifies every payload and data descriptor ends before the directory without overlapping another entry.
- Separates clear, manual-review, and blocked entries, with explicit declared sizes, compression ratios, findings, search, filters, and a versioned JSON inspection report.
- Extracts up to 200 selected files within a 200 MB runtime budget and enables individual downloads only after CRC, actual byte length, and SHA-256 processing all succeed.
How to use ZIP Inspector
Choose one ZIP, inspect its bounded structure, search and filter every clear, review, or blocked entry, select only intended files, then extract and download them after the complete selection passes CRC, actual-size, and SHA-256 processing.
When this tool is useful
- Before opening an archive received through email, upload, or file transfer.
- When only a few members of a large archive are needed.
- When archive paths, entry types, declared sizes, CRC values, and selected output hashes must be recorded.
Practical tips
- Treat Review entries as a manual decision; nested archives and executable-looking names are never selected automatically.
- Keep the source ZIP until each downloaded file is checked in its destination workflow.
- Use a maintained malware scanner and target-format parser separately before opening untrusted extracted content.
- Compare the extraction evidence SHA-256 with a trusted digest when provenance matters.
Examples you can test
Load an example, compare the result with the expected output, then replace it with your own input.
Review a vendor handoff
Example input
One ZIP containing documents, a nested package, and a traversal-style entry
Expected output
Explicit clear, review, and blocked rows plus verified downloads for selected documents.
The structural verdict does not establish that document content is harmless.
Validation checklist
- Review every blocked path, collision, type, encryption, compression, and size finding.
- Review executable-looking and nested-archive entries individually.
- Confirm the completed batch reports CRC, actual size, and SHA-256 for every selected file.
- Scan and parse untrusted downloads with appropriate maintained tools before opening them.