Unzip Files

About Unzip Files Tool

ZIP archives are the universal way to bundle multiple files into one compressed container — created in 1989 by Phil Katz, now standardized as ISO/IEC 21320 and supported natively by every operating system and modern browser. This extractor reads ZIPs entirely in your browser using the JSZip library: it parses the file's central directory, lists each entry's name, size, type, and compressed size, and decompresses on-demand when you click download. You can extract individual files, bulk-select with checkboxes, or download everything as a fresh ZIP archive. Supports the standard DEFLATE algorithm, stored (uncompressed) entries, and ZIP64 extensions for files over 4 GB. Maximum input size 100 MB. Try also our Zip Files and 7Z Extractor.

How do I extract just one file from a large ZIP?

Load the ZIP and click Extract Files, then use the filter box above the file table: type part of the filename (or pick an extension like .log, .csv or .json from the Type dropdown) to narrow hundreds of entries down to the one you want. Click its Download button to save that single file, or tick its checkbox and use Download Selected. You can also click Select All while a filter is active to grab every matching entry at once and download them together as a new ZIP — only the files you choose are decompressed, so pulling one CSV out of a 5 GB archive takes seconds.

Why does this tool refuse password-protected ZIPs while desktop tools open them?

ZIP supports two encryption modes: ZipCrypto (legacy, cryptographically broken since 2003) and AES-128/256 (added by WinZip in 2003, genuinely secure). Decrypting either requires asking the user for the password and running the cipher inside the browser. JSZip, the library that powers this tool, deliberately does not implement password-based decryption to keep the bundle small and the security model simple — there is no way for us to verify the password is correct before attempting to decrypt every entry, and providing one creates a target for brute-force attacks against weak passwords. To open password-protected ZIPs use 7-Zip (Windows/Linux), The Unarchiver (macOS), or the unzip CLI with the -P flag. For automation, qpdf, 7z and Python's zipfile library all support password parameters.

Can I extract specific files from a huge ZIP without decompressing everything?

Yes — that's the brilliant part of ZIP's design. Unlike tar.gz where everything is sequentially compressed (you must decompress the start to read the end), ZIP stores each file independently with its own compression and the central directory at the end of the archive lists every entry with byte offsets. Our extractor reads the central directory first (typically a few KB regardless of archive size) and only decompresses entries you select for download — you can preview a 5 GB ZIP and extract just one 10 KB CSV in seconds without ever decompressing the other entries. Most desktop tools do the same. This is why ZIP is the format of choice for software updates (you extract only the changed files) and JAR/APK packages (the JVM seeks to specific class files on demand).

What happens to file timestamps, permissions, and ownership during extraction?

ZIP stores three timestamps per entry (created, modified, accessed) and Unix file permissions when the archive was created on a Unix system. Browser-based extractors like this one cannot restore Unix permissions because the JavaScript File System Access API does not expose chmod — extracted files get default permissions (typically 644 for files, 755 for directories on Unix-like systems). Modification timestamps are preserved when supported by the browser's save dialog, but ownership (UID/GID) cannot be restored from a non-root browser context. For full fidelity restoration of permissions, ownership, ACLs, and extended attributes, use the unzip CLI on Linux/macOS with the -X flag, or 7-Zip on Windows. This rarely matters for typical document or media ZIPs but is critical for system backups.

How does ZIP compression compare to RAR, 7Z, and tar.gz?

Compression ratio depends on content, but for typical text and code: ZIP achieves about 30-40% of original size using DEFLATE; tar.gz uses the same DEFLATE so ratios match; 7Z with LZMA2 reaches 20-25% (15-20% better than ZIP); RAR with the latest algorithm reaches similar 20-25%; tar.zst with ZSTD at level 19 matches LZMA quality while decompressing 3-5x faster. ZIP's advantage is universal compatibility — every OS extracts ZIPs without extra software — while 7Z and RAR require third-party tools on Windows and macOS by default. For maximum compression, use 7Z or tar.zst; for maximum portability, use ZIP; for cloud storage of many small files (logs, backups), tar.zst beats both because it avoids per-file overhead. Streaming compression on Unix systems prefers tar+gzip because it handles symlinks, hardlinks, and special files that ZIP loses.

What is ZIP64 and why does my browser fail on huge archives?

The original ZIP specification used 32-bit fields throughout, capping individual files at 4 GB, archive count at 65,535 files, and total archive size at 4 GB. These limits were unreachable in 1989 but routinely hit by modern backup, media, and dataset archives. ZIP64 (added in 2001) extends every counter to 64 bits, supporting individual files up to 16 EB and unlimited file counts. Modern tools automatically write ZIP64 when needed, but some legacy extractors (Windows XP's built-in extractor, embedded systems, very old Java versions) reject ZIP64 headers. JSZip supports ZIP64 since version 3.0, so our extractor handles them, but very large archives (>500 MB) often fail in browser memory before unzip logic ever runs — the entire archive must be loaded into a Blob first. For multi-GB archives, use a desktop tool that streams from disk.

Are there security risks when extracting untrusted ZIPs?

Two classes of attack: (1) ZIP slip — a malicious archive contains entries with path-traversal names like '../../../etc/passwd' or 'C:\Windows\System32\evil.exe', which naive extractors blindly write outside the intended folder. Browser extractors are safe from this because the JavaScript File System Access API does not allow writing outside the user-selected directory, and downloads are isolated to the Downloads folder. (2) Zip bomb — a tiny archive (a few KB) that expands to terabytes of data, exhausting disk or memory. The famous 42.zip example unpacks recursively into ~4.5 PB of zeros. Our 100 MB input limit and per-file size display protect against extreme cases, but always inspect file counts and sizes before extracting unknown archives. For batch processing of untrusted user uploads on a server, always sandbox extraction in a container with disk/memory limits.

Why are my extracted filenames showing question marks or wrong characters?

The original ZIP spec from 1989 only defined ASCII filenames, leaving non-Latin filenames (Vietnamese with diacritics, Chinese, Cyrillic, emoji) in an encoding limbo. Archives created on Windows often use the legacy code page (CP1252 for Western Europe, CP936 for Simplified Chinese) without declaring it; readers default to UTF-8 and produce garbled output. In 2008 the ZIP spec added a UTF-8 flag bit (bit 11 of the general purpose bit flag) — modern tools (7-Zip 9.20+, WinRAR 5+, macOS's built-in archive utility, Linux's unzip 6.0+) set this flag and produce correct cross-platform names. If you see mojibake, the archive was created on an older Windows system without the flag; rename the files after extraction, or open the ZIP with 7-Zip which lets you override the encoding.

Can I peek inside a ZIP without downloading it?

Not from a browser unless the server hosting the ZIP supports HTTP Range Requests AND CORS is configured to allow your origin to read those byte ranges. The trick is that the ZIP central directory lives at the end of the file: you can issue a Range request for the last 64 KB, parse the central directory, then issue further Range requests for only the entries you want. Libraries like Zarr (used for cloud-native scientific data) and unzipit.js demonstrate this pattern, and S3 + Cloudflare R2 expose Range support by default. For tools like the present one, files must be loaded entirely into the browser first because the File API gives you the full bytes, but for URL-hosted ZIPs, partial extraction is becoming the modern pattern. This is also how npm pack-and-stream and GitHub's 'code download as ZIP' work efficiently.