Is my archive uploaded?

No. The archive is read and checked in your browser. Nothing is sent to a server, and nothing is written to your disk.

A small archive built to unpack into an enormous amount of data, from gigabytes to petabytes, so that it fills the disk or crashes the program extracting it. The best known, 42.zip, is 42 KB and unpacks to 4.5 petabytes.

Is it safe to open a zip bomb in this tool?

Yes. The checker reads the archive's own size records and only decompresses data in a measured way, stopping as soon as an archive is clearly a bomb. Nothing is extracted to disk.

Can it check the files for viruses?

Yes, in two ways, both without uploading. Every file is scanned in your browser with about 5,900 open YARA malware rules from ReversingLabs, Malpedia, Signature Base and other sources, which recognise known malware families. Every file also gets a SHA-256 fingerprint with a one-click VirusTotal lookup against about 70 antivirus engines; only the fingerprint is sent, and only when you click. New or custom malware can still slip through, so keep your own antivirus running too.

Which formats can it check?

ZIP and ZIP-based files such as .jar, .apk and .docx get the deepest check. 7z, RAR, TAR, tar.gz, tar.xz, tar.bz2, tar.zst, gzip, xz, bzip2, zstd, ISO, CAB and other formats readable by 7-Zip are listed and checked too.

Zip Bomb Checker — Is This ZIP Safe to Open? Free Archive Inspector

Check a ZIP, RAR, 7z or tar.gz before you extract it. Finds zip bombs, files that would land outside the folder, programs disguised as documents and other tricks, scans every file for known malware, and lets you look up any file on VirusTotal by its fingerprint. Nothing is extracted and nothing is uploaded.

How to check an archive before opening it

Drop the ZIP, RAR, 7z or other archive onto the box above.
The checker reads the archive's index and headers, compares them with each other, and decompresses the data in a measured way to confirm the real sizes. Nested archives are opened and checked too.
Read the verdict. Every problem comes with a plain explanation and the affected files. Use the VirusTotal links to check programs and scripts against antivirus engines.

What it detects

Zip bombs

High compression ratios. A bomb such as a 10 MB file that unpacks to 10 GB. The checker reports the total unpacked size and how many times larger it is than the archive.
Recursive bombs like 42.zip: archives inside archives, each layer multiplying the output. The checker opens nested ZIP, TAR and gzip archives and adds up the total.
Overlapping files. Non-recursive bombs point thousands of files at the same compressed data. Normal ZIPs never do this.
Fake sizes. Archives that declare small sizes to get past upload limits and then keep producing data. Files are decompressed only up to their declared size, so a lie is caught without unpacking the bomb.

Files that land in the wrong place

Path traversal (Zip Slip): names with ../ or absolute paths that a careless extractor writes outside the folder you chose.
Links that escape: symbolic and hard links pointing to /etc, your home folder or ../...
Duplicates and case clashes: two files with the same name, or names that differ only in upper and lower case, so one silently overwrites the other.
Names Windows cannot create, such as CON, NUL or names ending in a dot.

Disguised and risky files

Double extensions like invoice.pdf.exe and hidden right-to-left characters that flip how a name is displayed.
Programs and scripts (.exe, .js, .vbs, .bat, .lnk, .hta, .ps1…), macro-enabled Office files, and disk images (.iso, .img, .vhd) that can remove the Windows download warning.
Password-protected files, which antivirus cannot look into until they are extracted.
Setuid files that run with root rights on Linux and macOS.

Tampered ZIP structure

A file whose name in the index differs from the name in its own header, so different programs extract different files.
Data before the archive (a self-extracting program, or a PDF or image that is also a ZIP), data after it, and data between files that the index does not list.

Checking the files for viruses

Malware rules. Programs, scripts, documents and other files inside the archive are scanned in your browser by YARA-X, the engine VirusTotal uses, with about 5,900 openly licensed detection rules from ReversingLabs, Malpedia, Florian Roth's Signature Base, SEKOIA, ditekSHen and more, collected by YARA Forge. A match names the malware family and the rule's author. Riskier files are scanned first; images and videos are skipped, and in very large archives only the first few hundred plain text files are checked. The rules download once, about 4 MB.

VirusTotal lookups. Every file inside the archive, including files in nested archives and, if you enter the password, encrypted ones, gets a SHA-256 fingerprint computed in your browser. Programs, scripts, macro documents and nested archives are listed with a VirusTotal link, and every file has one in the table. VirusTotal checks the fingerprint against about 70 antivirus engines. Clicking a link sends only that fingerprint, never the file. If VirusTotal has never seen a file, it says so; uploading it there is then your choice.

What it does not do

Rules and fingerprints recognise malware that is already known. A clean result means the archive is not booby-trapped and nothing in it matches a known malware family, not that every file is safe: brand-new or custom-built malware has no rule or reputation yet. Keep your antivirus running when you extract. ZIP gets the deepest check because it is the format most of these tricks rely on; for 7z, RAR and other formats the checker uses the sizes and names the archive records.

Safe to use on a real bomb: nothing is unpacked to disk, data is only decompressed in counted chunks, and measuring stops early once an archive is clearly a bomb.

Is this archive safe to open?