Archive Inspector
Opens a zip without extracting it and flags path traversal entries, executables, macros and zip bombs.
An unexpected zip is the oldest delivery mechanism there is, and extracting it to see what is inside is exactly the thing you should not do. This reads the central directory and the entry headers without writing a single file to disk, and flags the shapes that are dangerous rather than merely unfamiliar.
Drop an archive here
zip, tar, tar.gz, tgz or gz — including .docx, .xlsx, .jar and .apk, which are zips underneath. It is opened in a worker in this tab and nothing is extracted to disk.
The archive is read in this tab by a worker and never uploaded. Nothing is written to disk unless you press Extract on a specific entry, and no entry is decompressed until you ask for it — the file tree and the whole security report come from the archive’s index, which is what lets a compression bomb be recognised without being set off.
How to use it
Drop the archive in
Nothing is extracted. The tree you see is built from the directory records, so you can look at the contents of an archive you would not open.
Look at the paths
An entry named `../../etc/…` or with an absolute path is a Zip Slip attempt — it escapes the extraction directory in tools that do not check. That is flagged first because it is unambiguous.
Check the compression ratio
An entry that expands by four or five orders of magnitude is a zip bomb. The ratio is computed from the headers, so you learn this without decompressing anything.
Note executables and macro documents
A `.exe`, `.scr`, `.lnk` or `.js` inside an archive that was supposed to be photographs, or a `.docm` where a `.docx` was expected, is worth stopping over. Send the macro documents to the Office macro inspector.
Common questions
Is this antivirus?
No, and it is important that it is not. It reports structure — dangerous paths, absurd ratios, risky extensions. It has no malware signatures and no idea whether a given file is malicious. A clean report means nothing structurally alarming was found, not that the archive is safe.
Is the archive uploaded?
No. It is read in the browser, in a worker. Nothing is written to disk and nothing is sent.
It cannot read an encrypted archive.
File names in a standard encrypted zip are still readable and are shown; the contents are not, so nothing inside can be checked. A password-protected archive sent by a stranger, with the password in the same message, is a well-known way of getting past mail scanners.
Feed it from
File Checksum
Hashes files of any size in a streaming pass and compares the result against a pasted expected value.
Docker Image Explorer
Opens an exported image tarball and shows each layer’s command, size and the files it added or deleted.
Metadata Scrubber
Removes author, device, GPS and revision metadata from documents, images, audio and video in one pass.
Office Macro Inspector
Extracts VBA projects from .docm/.xlsm/.pptm and legacy .doc/.xls, shows each module’s source with auto-run procedures and risky calls highlighted, and lists external links, DDE fields and Excel 4.0 macro sheets.
Next
These accept what this tool produces, so the result can go straight in.
File Checksum
Hashes files of any size in a streaming pass and compares the result against a pasted expected value.
Hex Viewer
Shows any file as an offset/hex/ASCII dump, identifies the magic bytes and highlights a search hit.
Metadata Scrubber
Removes author, device, GPS and revision metadata from documents, images, audio and video in one pass.
Office Macro Inspector
Extracts VBA projects from .docm/.xlsm/.pptm and legacy .doc/.xls, shows each module’s source with auto-run procedures and risky calls highlighted, and lists external links, DDE fields and Excel 4.0 macro sheets.
CORS Tester
Sends the preflight a browser would send from a chosen origin plus a GET with that Origin, and explains by the Fetch standard’s rules exactly which header blocked it.
Currency Converter
Converts between about thirty currencies at the ECB’s daily reference rates, crossed through the euro, or at a rate you type in.