To make a ZIP, add the files or a folder, choose whether to compress, and download the archive; to open one, load it, read the list of what is inside, and take out single files. A browser-based tool does both on your device: the files are read from your disk by the page, the archive is built or read there, and nothing is uploaded. This article explains how a ZIP file is laid out, using a real 122-byte example, why compression sometimes does nothing, why you should be careful with archives from strangers (zip slip and zip bombs), and which archives this kind of tool cannot open.
What is inside a ZIP
A ZIP archive is simple. It is a series of entries, one per file, followed by a table of contents at the end. Each part starts with a four-byte signature that begins with PK, the initials of Phil Katz, who designed the format.
| Part | Signature | What it holds |
|---|---|---|
| Local file header | PK 03 04 | File name, method, checksum and sizes, then the file's data |
| Central directory header | PK 01 02 | One per file: the same details plus where its local header is |
| End of central directory | PK 05 06 | How many entries there are and where the central directory starts |
Here is the smallest real example, made with Python's zipfile module: one file called hello.txt that contains hello and a line break, six bytes, stored without compression. The whole archive is 122 bytes:
| Bytes | Content |
|---|---|
| 0 to 38 | Local file header, 30 bytes plus the 9-byte name hello.txt |
| 39 to 44 | The data: hello and a line break |
| 45 to 99 | Central directory header, 46 bytes plus the 9-byte name |
| 100 to 121 | End of central directory record, 22 bytes |
The headers store the checksum of the file, a CRC-32. For hello and a line break it is 363A3020. The end record says: one entry, a central directory of 55 bytes, starting at offset 45. A program that opens the archive reads the last bytes first, finds that record, jumps to the central directory and has the whole file list without touching the data. That is why a good tool can open a big ZIP immediately: it only reads the list. Archives made by other programs are a little larger, because they add extra fields such as timestamps: the same file zipped with the zip command on macOS came to 174 bytes.
This layout has consequences. Each file is compressed on its own, so you can extract one file without reading the others; the price is that the compressor cannot find repetition across files, which is why a .tar.gz of many similar files is often smaller. New files can be appended without rewriting the old ones. And the central directory is what counts: an archive can even hold two entries with the same name.
Stored or deflate
Each entry has a method number. Stored (0) keeps the bytes as they are. Deflate (8) compresses them with the algorithm from RFC 1951, which combines back-references to repeated text with Huffman coding. Text, spreadsheets, source code and logs shrink well, often to a fraction of their size.
Files that are already compressed gain nothing: JPEG and PNG pictures, MP4 video, PDF files with compressed pages and other ZIPs. A test with 5,000 random bytes, which behave like an encrypted file, gave an archive of 5,108 bytes stored and 5,113 bytes deflated, five bytes larger. A good tool notices when compression does not help and stores the file instead, so no file ever grows. That is the behaviour of this one. If your files are mostly photos, shrink them first with the image toolkit; the article on compressing images without losing quality explains how.
Creating a ZIP
- Open the ZIP tool and stay on the Create ZIP tab. Drop files on the box or choose them. To keep a folder structure, press "Add a folder" and pick the folder; the paths inside it are kept. A folder dropped as a whole cannot be read by browsers, which is why the button exists.
- Choose the Compression: "Compress (smaller)" or "None (fastest)". Use None for photos and videos.
- Name the archive, check the totals, and press "Create and download ZIP".
File names are written as UTF-8, with the flag in the header that says so, so names with Vietnamese or other accents survive. Dates in a ZIP use the old DOS format, which counts in two-second steps and starts in 1980. The tool never creates password-protected archives.
Opening a ZIP
- Switch to Open ZIP and drop or choose a
.zipfile. Only the list is read first. - Each row shows the stored name, the size once unpacked and the date. A summary line shows the entry count and the total unpacked size, which is worth a glance before you unpack anything.
- Press Download on a row for one file, or tick up to 20 files and press "Download selected". Your browser may ask once to allow several downloads; say yes.
Before a file is saved, its CRC-32 is compared with the checksum in the archive. If they differ, the file is damaged and the tool refuses to save it. The checksum catches accidents, such as an interrupted download. It does not catch tampering, because anyone who edits a file can store a fresh checksum with it. To check that a ZIP is the one the publisher released, compare its SHA-256 as described in how to verify a download.
Be careful with archives from strangers
Every name in a ZIP was written by whoever made it, and so was every size.
Zip slip. A malicious archive can contain an entry named ../../etc/passwd or an absolute path, hoping that an extractor joins it onto the target folder and writes outside it. A careful extractor strips or rejects such names. The Info-ZIP unzip that ships with macOS, for example, prints "skipped "../" path component(s)" and keeps the file inside the folder. Not every program is careful. This tool only ever shows a name as text, and the name your browser saves under is the last part of the path, cleaned: ../../etc/passwd is saved as passwd, C:\Windows\x.dll as x.dll, and the reserved Windows name con.txt as _con.txt.
Zip bombs. A tiny archive can be built to inflate into gigabytes, by repeating one pattern. Even a modest laptop could run out of memory. The tool refuses a file that unpacks to more than 500 MB, stops the moment the data passes the size the archive declared, and stops data that expands more than any valid compressed stream can.
Good habits:
- Look at the entry list and the unpacked total first.
- Never run an executable, script or macro that came out of an archive you did not expect.
- Do not rely on a password: an encrypted archive can hide malware too.
- Extract into a new, empty folder.
What the tool cannot open, and its limits
- Password-protected entries are listed with a lock and marked as not supported. The tool never asks for a password.
- ZIP64, archives or files over 4 GB, are not supported. Nor are archives split into several parts.
- Compression methods other than stored and deflate, such as BZip2, LZMA or Zstandard, are marked as not supported; the rest of the archive still works.
- 7z, RAR and tar files are not read.
- Creating: up to 500 files and 1 GB in total.
- Opening: archives up to 2 GB with up to 10,000 entries, and up to 500 MB for any one file once unpacked.
- Old browsers that cannot compress store files as they are, and ones that cannot inflate can list compressed entries but not unpack them.
Everything runs in your browser. If your archive needs one of the unsupported features, a desktop program is the right tool.
Command-line equivalents
zip -r photos.zip photos/ # create, with the folder structure
unzip -l photos.zip # list the contents
unzip -t photos.zip # test the checksums
unzip photos.zip -d out # extract into the folder "out"In PowerShell, Compress-Archive -Path photos -DestinationPath photos.zip and Expand-Archive photos.zip -DestinationPath out do the same.
A short checklist
Use "None" for photos and other compressed files and "Compress" for text and documents. Add a folder with the folder button, not by dropping it. Check the entry count and unpacked size before you open an archive from someone you do not know, extract into an empty folder, and compare a SHA-256 when the publisher gives one. Remember that a ZIP's checksum protects against damage, not against tampering.