How local ZIP extraction works
The browser reads the ZIP or ZIP64 central directory to list file names, sizes, compression methods, and offsets. Stored and DEFLATE entries use browser-native processing. Encrypted entries are decrypted by a locally hosted, fixed version of zip.js. Gypes does not intentionally upload the archive, password, or extracted bytes.
Encrypted ZIP files
PKWare ZipCrypto and WinZIP AES encrypted entries are supported. Entering a password does not prove it is correct: the password is tested only when an encrypted file is extracted. A wrong password, authentication failure, directory mismatch, or invalid signature stops the download. The password field is not stored and is cleared when the form is reset or the page is closed.
Integrity is checked before download
Unencrypted files are checked against the CRC-32 value recorded in the central directory. Encrypted files use zip.js password, signature, and local-header ambiguity checks; AES files also have an authentication code. These checks detect corruption or a wrong password, but they are not malware scans and do not establish who created the archive.
Limits reduce archive-bomb risk
The tool rejects archives larger than 100 MB, more than 500 entries, more than 250 MB of declared expanded data, or a per-file compression ratio above 200 to 1. ZIP64 values are accepted only within the browser’s safe integer range. Multi-disk archives are rejected. These limits reduce risk but cannot make untrusted content safe.
Folders and unsafe paths
Folder entries are shown but cannot be downloaded. Regular files are downloaded individually rather than written automatically to recorded directories. Names are reduced to a safe final component so paths such as ../../file cannot cause directory traversal. Duplicate names may require manual renaming.
Supported and unsupported formats
This version supports standard ZIP, single-disk ZIP64, stored files, DEFLATE, PKWare ZipCrypto, and WinZIP AES. It does not yet support RAR, 7z, TAR, split archives, or every less common ZIP compression method. Non-ZIP formats require a separate WebAssembly engine and will be added only with accurate compatibility and safety limits.
Treat extracted files as untrusted. This tool does not scan for viruses, malicious documents, scripts, executables, deceptive file names, or unsafe content. Only open files when you trust their source and expected type.