Extract a ZIP file

How to Extract Files

1. 1

   Drop the ZIP file

   The archive index is read first, so you see what is inside before anything is extracted.

2. 2

   Enter the password if the archive needs one

   ZipCrypto and AES-128/192/256 are both supported, and a wrong password is reported as such rather than producing garbage.

3. 3

   Extract and download

   The extracted files come back with their folder structure intact, or a single file on its own if that is all there was.

Two kinds of ZIP encryption, both handled

The password option in Windows Explorer and older archivers produces ZipCrypto, a stream cipher from the original PKZIP whose password check is a single byte, which means roughly one wrong password in 256 passes it. That is why the checksum of every extracted entry is verified as well, so a password that slips past the byte check is still caught before you download nonsense. Modern archivers instead produce WinZip AES, which derives the key with PBKDF2 and encrypts in counter mode; that is read here too, including its two-byte verification value, so a wrong password is identified immediately without decrypting the whole entry.

Paths that try to escape the archive

A ZIP entry can be named ../../etc/passwd or C:\Windows\system32\x.dll. Nothing in the format forbids it, and an extractor that writes such a path faithfully overwrites files outside the folder the user chose, the vulnerability class known as zip slip. Every path here is checked before use: parent-directory segments, absolute paths and drive letters are stripped back to the plain filename, and the number of entries that needed cleaning is reported so a deliberately malicious archive does not pass unnoticed. Ordinary nested paths are untouched, and a dot inside a filename is not treated as suspicious.

One bad entry does not stop the rest

Archives get damaged in transit, and old ones sometimes use compression methods that were never widely adopted. Rather than refusing the whole file, each entry is handled on its own: one whose checksum does not match is skipped and named, and one compressed with a method other than store or deflate is skipped and named too. Everything else is extracted normally, and the counts appear in the result, because the useful outcome is nineteen recovered files plus a list naming the one that was lost, not a single error message about the archive as a whole.

Frequently asked questions