Look inside a ZIP before you extract it
ZipPeek opens an archive the way a file manager does: a folder tree, a sortable list of every entry with its real and packed size, and a preview pane. It reads the central directory straight from the file on your disk, so a 2 GB archive opens as fast as a 2 KB one — and nothing is ever uploaded.
- Nothing is uploaded
- Works offline
- Also reads .apk, .docx, .epub
Open a ZIP and look inside
Drop an archive in. ZipPeek reads its central directory, builds the folder tree and shows you every entry with its real and packed size — without unpacking anything.
The archive stays in this tab. ZipPeek reads only the bytes it needs, straight from the file on your disk — nothing is uploaded, and nothing is written back until you press a download button.
Drop a ZIP archive here
Also reads .jar, .war, .apk, .ipa, .docx, .xlsx, .pptx, .epub, .odt, .xpi, .vsix, .whl, .nupkg and .crx — they are all ZIP containers underneath.
The sample is generated here in your browser and deliberately contains a path-traversal entry, a symlink, a double extension and a wildly compressible file, so you can see what the warnings look like.
or paste one from the clipboard
What you get before you unpack anything
The whole listing, not just names
Every entry with its real size, packed size, compression saving, method, timestamp, CRC and encryption flag. Sort by any column, filter with a substring or a glob like *.js, and switch between the folder tree and a flat list of everything.
Previews for what is inside
Text and code with highlighting, pretty-printed JSON, rendered Markdown, images, SVG shown as a plain image so nothing can run, font specimens, audio and video. Anything else gets a hex dump with its file signature named.
Unsafe entries flagged first
ZipPeek checks every name for `..` traversal, absolute paths, drive letters, backslashes, symlinks, duplicates, encryption, nested archives, very deep paths and compression ratios over 100×, then lists what it found above the file list.
Take one file, not the whole archive
Download any single entry, or tick a few and get them back as a new ZIP. Paths are normalised on the way out, so a `../` entry lands inside the folder you chose instead of somewhere else on the disk.
A ZIP viewer that runs in the browser, not on a server
A ZIP file keeps an index of itself. At the very end sits the end-of-central-directory record, which points at a list describing every entry: its name, uncompressed size, compressed size, compression method, timestamp, CRC and a set of flags. ZipPeek reads that index and nothing else, so opening an archive online means reading a few kilobytes from the end of the file rather than decompressing gigabytes. That is why the listing appears immediately, and why the same page handles a build artifact, a 4 GB backup and a 12 KB .docx the same way.
Because the index is read, not trusted, ZipPeek can also tell you what is wrong with it. Entry names are supposed to be relative and to use forward slashes; when one contains `..`, starts with a slash or carries a Windows drive letter, that entry is asking the extractor to write somewhere you did not choose. The same listing exposes symbolic links, duplicate paths, entries marked encrypted and files whose uncompressed size is more than a hundred times the packed size. All of it shows up before you commit to unpacking.
The same container format is used far beyond files that end in .zip. A .docx is a ZIP of XML parts, an .apk is a ZIP with AndroidManifest.xml and a classes.dex, an .epub is a ZIP with a mimetype entry, and .jar, .ipa, .xpi, .vsix, .whl and .nupkg are all ZIPs with conventions layered on top. ZipPeek recognises those conventions and labels the archive accordingly, so you can look at the XML inside a Word document or check what a Chrome extension actually ships without installing anything.
Everything happens in the tab. The file is read through the browser's own File API, decompression uses the built-in deflate decoder, and the only thing that ever leaves the page is a file you explicitly download. There is no account, no queue, no upload limit and no copy of your archive on someone else's disk — which matters most for exactly the archives you would rather not send anywhere: a client's deliverable, an evidence bundle, a backup, or something a stranger emailed you.
Guides & articles
How the format works, how archives get weaponised, and what to check before you unpack one.
How ZIP compression works: DEFLATE explained
What is actually inside a .zip, how DEFLATE finds repetition, why a folder of JPEGs barely shrinks, and what ZIP64 and the encryption schemes change.
6 min read
Zip Slip, zip bombs and malicious archives
An archive entry is not a file — it is an instruction a program chooses to follow. How that gets abused, from path traversal to 42.zip, and the defences.
6 min read
Inspect an archive before you extract it
Seven things to check between receiving a .zip and double-clicking it: who sent it, what the listing says, and when to open it somewhere disposable.
5 min read
Frequently asked questions
What people ask before trusting a browser with an archive.
Is my archive uploaded anywhere?
No. ZipPeek reads the file through the browser's File API and does all the parsing and decompression in the page itself. There is no server to upload to: the site is a set of static files, and it keeps working after you go offline. The only bytes that leave the page are the ones you download yourself.
How large an archive can I open?
Browsing is not limited by the archive's size, because only the central directory is read — a few kilobytes at the end of the file. Multi-gigabyte archives list instantly. The limit applies to individual entries: previewing or extracting a file holds its decompressed bytes in memory, so a single 3 GB entry will fail on most machines. Repacking a selection is capped at 1.5 GB uncompressed.
Can it open password-protected ZIP files?
It lists them but cannot open them. ZipPeek reads the general-purpose bit flag in each header and marks encrypted entries with a lock, and the file names, sizes and timestamps of an encrypted archive are still readable — that metadata is never encrypted. Decrypting the content needs the password plus a ZipCrypto or AES implementation, which ZipPeek does not include.
Does it handle RAR, 7z or tar.gz?
No — ZipPeek is a ZIP reader only. RAR, 7z, tar and gzip are different formats with different indexes, and supporting them would mean shipping several more decoders to every visitor. If a file opens here at all, it is a ZIP underneath, whatever its extension says.
Which files can it preview?
Plain text and about thirty code languages with light highlighting, JSON pretty-printed, Markdown rendered, PNG/JPEG/GIF/WebP/AVIF/BMP/ICO images, SVG rendered as a plain image so any script inside it cannot run, TTF/OTF/WOFF/WOFF2 font specimens, and audio and video through the browser's own players. Everything else gets a hex dump of the first 4 KB with its file signature named. PDF pages are not rendered — that would mean shipping a PDF engine.
Is it safe to extract a file ZipPeek has flagged?
Downloading an entry from here writes exactly one file into your downloads folder under its own last path segment, so a `../` entry cannot escape anywhere. When you repack a selection, ZipPeek strips `..` segments, leading slashes and drive letters from the stored paths and tells you how many entries it had to fix. What the file does once you open it is still your call — a flagged executable is flagged for a reason.
Why does my .docx open as an archive?
Because it is one. Office Open XML files are ZIP containers holding XML parts, images and relationship files; the same is true of .xlsx, .pptx, .epub, .odt, .jar, .apk, .ipa, .xpi, .vsix, .whl and .nupkg. ZipPeek detects those layouts and labels the archive, so you can read word/document.xml or check which fonts and images a document carries.
Can I look inside a ZIP that is inside another ZIP?
Yes. Select a nested archive and press “Open this archive”: ZipPeek decompresses that one entry in memory and reads its central directory as if it were the file you dropped. The title bar keeps the path back to the outer archive so you can step out again. Nested archives are also flagged in the warnings, because layering them is a common way to get past mail scanners.
Some file names come out as gibberish. Can I fix that?
Yes — use the “Names” selector in the toolbar. Modern archivers set a flag saying the names are UTF-8, but older Windows tools stored them in the local OEM code page with no flag at all. ZipPeek guesses (valid UTF-8 first, then CP866, the DOS Cyrillic page) and you can override it with CP866, Windows-1251 or Windows-1252. Text file contents have their own encoding switch in the preview pane.