File types · Explainer

The ZIP file (.zip)

A ZIP file is an archive: many files and folders packed into one, each usually compressed. This guide explains what's inside one, how its central directory works, the security traps worth knowing, and has free sample ZIP files to download for testing.

Sample ZIP filesPut a ZIP file online

At a glance

Full name
ZIP archive (the PKZIP format)
Extensions
.zip
MIME type
application/zip; Windows often labels uploads application/x-zip-compressed
Kind
Binary archive; each file is compressed separately, losslessly
Standard
PKWARE's APPNOTE.TXT (version 6.3.10, 2022); ISO/IEC 21320-1 defines a subset for document containers
First released
1989, by Phil Katz of PKWARE
Compression
Usually Deflate (method 8) or none (stored, method 0); the spec also allows bzip2, LZMA, Zstandard and others
Limits
65,535 entries and 4 GB per file and per archive, unless the archive uses ZIP64
Opens with
Built into Windows File Explorer, macOS Finder, iOS Files and Android file managers; 7-Zip, unzip
Magic number
50 4B 03 04 (PK + 3, 4); an empty archive starts 50 4B 05 06

The basics

What is a ZIP file?

A ZIP file bundles any number of files and folders into a single file, usually making them smaller along the way. It's the standard way to send a folder by email, download a set of files in one go, or deliver software and website templates. Windows, macOS, iOS and Android all open ZIP files without extra software.

Compression in ZIP is lossless: every file comes out exactly as it went in, checked by a CRC-32 checksum. How much smaller it gets depends on the content. Text, code and spreadsheets often shrink to a fraction of their size. Photos, videos, MP3s and other ZIPs are already compressed and barely shrink at all.

Many formats you use every day are ZIP files with a different extension and an agreed layout inside: Word, Excel and PowerPoint files (.docx, .xlsx, .pptx), OpenDocument files, EPUB e-books, Java .jar files and Android .apk apps. Rename a .docx to .zip and you can open it and look at the XML inside.

Anatomy

What's inside a ZIP file

A ZIP file has two halves. First come the files, each behind a local header. At the end comes the central directory, a table of contents with one entry per file pointing back to its local header. Every structure starts with PK, the initials of Phil Katz. Here is the layout of sample-archive.zip with the real bytes; numbers are little-endian.

sample-archive.zip (layout)
offset   bytes                                         part
0        50 4B 03 04 14 00 00 00 08 00 00 60 5B 5D     local header: README.txt
         98 EA 17 D9 01 02 00 00 09 04 00 00 0A 00     CRC-32, sizes 513 / 1,033
30       52 45 41 44 4D 45 2E 74 78 74                 name "README.txt"
40       85 53 4B 6E …                                 513 bytes of Deflate data
553      50 4B 03 04 …                                 local header: docs/
588      50 4B 03 04 …                                 local header: docs/guide.md
846      50 4B 03 04 …                                 data/, data/people.csv, images/
1,162    50 4B 03 04 14 00 00 00 00 00 …               local header: images/logo.png
1,207    89 50 4E 47 0D 0A 1A 0A …                     the PNG, stored as is
4,603    50 4B 03 04 …                                 local header: unicode/
4,641    50 4B 03 04 14 00 00 08 08 00 …               local header, flag 0x0800
4,671    75 6E 69 63 6F 64 65 2F 63 61 66 C3 A9 …      name "unicode/café-日本語.txt"
4,966    50 4B 01 02 14 03 14 00 00 00 08 00 …         central directory: 9 entries
5,485    50 4B 05 06 00 00 00 00 09 00 09 00           end of central directory
         07 02 00 00 66 13 00 00 50 00                 519 bytes at 4,966; comment 80
5,507    46 72 65 65 20 73 61 6D 70 6C 65 …            "Free sample ZIP file from …"
5,587                                                  end of file
  1. 150 4B 03 04

    Local file header signature

    PK\x03\x04. Every file entry starts with it, and so does almost every ZIP file, which makes it the format's signature. DOCX, XLSX, EPUB and JAR files start with it too, because they are ZIP files.

  2. 214 00 · 00 00 · 08 00

    Version, flags, method

    The version needed to extract (0x14 = 2.0), the general purpose flags (none here) and the compression method: 8 means Deflate.

  3. 300 60 5B 5D

    Date and time

    MS-DOS format: 12:00:00 on 27 October 2026. It records local time with no time zone, at 2-second precision, and can't go earlier than 1980.

  4. 498 EA 17 D9 · 01 02 … · 09 04 …

    CRC-32 and sizes

    A checksum of the original data, the compressed size (513 bytes) and the original size (1,033). Extractors recompute the CRC to detect corruption.

  5. 585 53 4B 6E …

    Compressed data

    The Deflate stream for README.txt. Each file is compressed on its own, so one file can be extracted without decompressing the others.

  6. 6images/logo.png, method 0

    A stored entry

    Method 0 means no compression: the PNG's bytes follow the header unchanged. PNG data is already compressed, so Deflate would gain almost nothing.

  7. 714 00 00 08 · C3 A9

    A UTF-8 file name

    Flag bit 11 (0x0800) says the name is UTF-8, so é is stored as C3 A9. Without that flag, tools are supposed to read names as the old IBM PC code page 437, which is where garbled names come from.

  8. 850 4B 01 02

    The central directory

    One entry per file with its name, sizes, CRC, permissions and the offset of its local header. This is what extractors read to list the archive, so they can jump straight to any file.

  9. 950 4B 05 06

    End of central directory record

    The last structure: the number of entries (9), the directory's size (519 bytes) and offset (4,966), and the comment length. Readers find the archive by searching backwards from the end of the file for this signature.

  10. 10Free sample ZIP file …

    The archive comment

    Up to 65,535 bytes of free text at the very end. unzip -z prints it.

Under the hood

How a ZIP file works: local headers and the central directory

The important part of a ZIP file is at the end. A reader starts by searching backwards for the end of central directory record, follows it to the central directory, and from there to each file. This design has consequences:

  • Fast listing and random access. An extractor can list a 10,000-file archive or pull out one file without reading the rest.
  • Easy appending. A tool can add files by writing them over the old directory and then writing a new one, without rewriting the existing data.
  • Streaming is awkward. A reader that only sees the start of the file has to trust the local headers, which can disagree with the central directory. When a ZIP is written on the fly, sizes aren't known in advance: flag bit 3 is set, the local header's sizes are zero and the real values follow the data in a data descriptor.
  • A truncated download is unreadable. If the end of the file is missing, so is the directory, and most tools report "unexpected end of archive" even though most of the data is there.
  • Self-extracting archives work. Because readers start from the end, a program can be stuck on the front of a ZIP and the archive still opens.

ZIP vs .tar.gz

A .tar.gz file does the opposite: it joins all files into one stream first, then compresses the whole stream. That often compresses better, because patterns repeat across files, but getting one file out means decompressing everything before it.

Methods

Compression methods and encryption

Compression method codes from the ZIP specification
MethodCodeNotes
Stored0No compression. Used for files that are already compressed.
Deflate8The default almost everywhere, and the only method some tools support.
Deflate649A variant of Deflate with a larger window. Less widely supported.
bzip212Better compression, slower.
LZMA14Better compression; 7-Zip and a few other tools support it.
Zstandard, XZ93, 95Newer additions, with little support in built-in tools.

ZIP files can be password-protected in two common ways, and the difference matters:

EncryptionStrengthCompatibility
ZipCrypto (traditional PKWARE)Weak. Broken by known-plaintext attacks: if an attacker has one of the files unencrypted, the rest can be recovered.Opens almost everywhere, including Windows File Explorer and Info-ZIP's unzip.
AES-256 (WinZip AE-2)Strong, if the password is.Usually needs 7-Zip, WinZip, WinRAR or similar. Info-ZIP's unzip 6.0, common on Linux, skips these files as an unsupported method (99).

File names are not encrypted

In both kinds, only the contents are encrypted. Anyone can list the file names, sizes and dates without the password. To hide the names, put the files in a ZIP, then encrypt that ZIP inside another one.

Limits

ZIP64: archives over 4 GB or 65,535 files

The original format stores sizes and offsets as 32-bit numbers and the number of entries as a 16-bit one. So a classic ZIP can't hold a file over 4 GB, can't be over 4 GB itself, and can't hold more than 65,535 entries. ZIP64, added to the specification in 2001, lifts all three limits with 64-bit fields:

  • A ZIP64 extra field on each large entry holds the real sizes and offsets; the normal fields are set to FFFFFFFF.
  • A ZIP64 end of central directory record (50 4B 06 06) and a locator (50 4B 06 07) sit just before the classic end record, holding the 64-bit counts and offsets.

Current tools write ZIP64 automatically when needed and read it without trouble. Old tools and some embedded ZIP libraries don't, and report a damaged archive. Our sample-zip64.zip is tiny but written in ZIP64 form, so it tests exactly that.

Related formats

ZIP vs 7z, RAR and tar.gz

FormatCompressionOpens without extra softwareNotes
.zipGoodEverywhereThe safe choice for sharing.
.7zBetterRecent Windows 11 only7-Zip's format; AES-256 encryption that can hide file names.
.rarBetterRecent Windows 11 onlyProprietary format from WinRAR; recovery records can repair damage.
.tar.gz, .tgzGood to bettermacOS, Linux, recent Windows 11The norm for source code and Linux software; keeps Unix permissions.

If you're sending files to people whose setup you don't know, ZIP with Deflate is the format they'll all be able to open.

Troubleshooting

Common ZIP problems and quirks

  • Garbled file names (caf‚ for café, or random symbols for Chinese or Japanese): the archive was made without the UTF-8 flag, in a legacy code page, and opened on a system that guessed a different one. 7-Zip, and the -O option of unzip in Debian and Ubuntu, let you choose the encoding when extracting.
  • A __MACOSX folder and ._ files: macOS's Compress command stores Finder metadata and extended attributes in a separate __MACOSX folder. Other systems show it as junk. Delete it, or create the ZIP with zip -r -X archive.zip folder from Terminal.
  • "Unexpected end of archive" or "not a valid ZIP": almost always an incomplete download or upload. Check the size against the original and download again.
  • "Windows cannot complete the extraction" or a password prompt that never works: the archive may use AES encryption or a compression method the built-in tool doesn't support. Try 7-Zip.
  • Wrong dates after extraction: ZIP stores local time without a time zone, so files can appear shifted by the time difference between the two computers. Many tools add an extra field with UTC times to avoid this.
  • Lost permissions or symbolic links: Unix permissions and links are stored in optional fields that not every tool writes or restores. Use .tar.gz when they matter.

Security

Is it safe to open a ZIP file? Zip bombs, Zip Slip and malware

Listing a ZIP file is harmless. The risks come from what's inside and from extracting it carelessly:

  • Malware in disguise. A ZIP is a common way to deliver a malicious program, script or shortcut by email. Password-protected ZIPs are popular with attackers because mail scanners can't look inside; the password is in the email text.
  • Zip bombs. A small archive that expands to an enormous size to fill a disk or exhaust memory. The classic kind nests ZIPs inside ZIPs; David Fifield's non-recursive design (2019) overlaps files so that a 10 MB ZIP expands to 281 TB in a single pass.
  • Path traversal (Zip Slip). An entry named ../../etc/cron.d/job or ..\..\Windows\… is written outside the folder you extract to, overwriting whatever is there. Snyk disclosed it in June 2018 after finding it in many libraries. Mainstream extractors strip or refuse such names; hand-written extraction code often doesn't.
  • Symbolic links. An entry stored as a link can point anywhere on the system, and a later entry written through it lands there.

If you write code that extracts ZIP files

Resolve each entry's destination path and refuse it unless it's inside the target folder; reject absolute paths and links. Cap the total extracted size, the number of entries and the compression ratio. Don't trust the sizes in the headers: count the bytes as you decompress.

How to

How to open and create a ZIP file

  • Windows: double-click to browse it, then Extract all. To create one, select files, right-click and choose Compress to ZIP file (Compress to → ZIP File in newer Windows 11 builds) or, in Windows 10, Send to → Compressed (zipped) folder. 7-Zip adds encryption and other formats.
  • macOS: double-click to extract with Archive Utility. To create one, right-click and choose Compress.
  • Linux: unzip archive.zip to extract, unzip -l archive.zip to list, zip -r archive.zip folder to create.
  • Phone: on iPhone and iPad, tap a ZIP in the Files app to expand it. On Android, Files by Google and most file managers extract ZIPs.
  • Programming: Python's zipfile, Java's java.util.zip, .NET's System.IO.Compression and Node packages such as yauzl all read and write ZIP.
  • In a browser: see what's inside without downloading anything to your computer with our online unzip tool.

Free downloads

Sample ZIP files to download

Free sample ZIP files for testing extractors, upload validation, security checks and parsers. Each archive was tested with python -m zipfile -t and Info-ZIP's unzip -t, and the encrypted ones were opened with their password, 99helpers.

sample-archive.zip · 5.5 KBDownload

Browsers can't show this kind of file in a page. Download it to open it in the app it belongs to.

What's inside sample-archive.zip

A small archive that packs most of the features you'll meet in real ZIP files into 5.6 KB. Its README.txt describes the contents too.

  1. Folders

    docs/, data/, images/ and unicode/ are stored as entries of their own, with names ending in /, so empty folders would survive too.

  2. Deflated text

    README.txt, a Markdown guide and a CSV of fictional people are compressed with Deflate. The README shrinks from 1,033 to 513 bytes.

  3. A stored PNG

    images/logo.png uses method 0, no compression, because PNG data is already compressed. Its compressed and original sizes are the same: 3,396 bytes.

  4. A UTF-8 file name

    unicode/café-日本語.txt has general purpose bit 11 set. If it extracts with a garbled name, the tool ignored the flag.

  5. Fixed timestamps

    Every entry is dated 2026-10-27 12:00:00, so you can see how your tool handles ZIP's time-zone-free dates.

  6. Unix permissions

    Entries carry Unix permission bits (644 for files, 755 for folders) in the external attributes field.

  7. Archive comment

    An 80-byte comment at the very end, after the end of central directory record. unzip -z sample-archive.zip shows it.

All sample ZIP files

  • Sample archive with folders

    sample-archive.zip · 5.5 KB (5,587 bytes)

    9 entries: folders, deflated text files, a stored PNG, a UTF-8 file name and an archive comment.

    • Testing extraction, listing and previews
    • Checking UTF-8 file name handling
    Download

  • ZIP64 archive

    sample-zip64.zip · 4.8 KB (4,875 bytes)

    Two text files written with zip -fz: ZIP64 extra fields on each entry, a ZIP64 end of central directory record and locator, and FFFFFFFF in the classic record's directory offset.

    • Checking a library or tool supports ZIP64
    • Parsers that read the end of central directory
    Download

  • Password-protected ZIP (ZipCrypto)

    sample-encrypted-zipcrypto.zip · 404 bytes

    One text file with traditional ZipCrypto encryption. Password: 99helpers. Its flags also have bit 3 set: the sizes follow the data in a data descriptor.

    • Testing password prompts and wrong-password handling
    • Upload filters that should flag encrypted archives
    Download

  • Password-protected ZIP (AES-256)

    sample-encrypted-aes256.zip · 454 bytes

    One text file with WinZip AES-256 encryption (method 99, extra field 0x9901). Password: 99helpers. Some built-in tools can't open it.

    • Testing AES support in extractors and libraries
    • Checking the error shown for unsupported encryption
    Download

  • 1 MB ZIP file

    sample-1mb.zip · 1 MB (1,048,576 bytes)

    A README and a stored file of pseudo-random data, sized so the archive is exactly 1,048,576 bytes (1 MiB). Random data doesn't compress.

    • Upload and size-limit tests
    • Download and progress-bar tests
    Download

Ways to test with them

  • Extraction and names: extract sample-archive.zip and check you get four folders and café-日本語.txt with its name intact.
  • Encryption support: open both encrypted samples with password 99helpers. If the AES one fails while ZipCrypto works, your tool doesn't support AES.
  • ZIP64: a reader that fails on sample-zip64.zip but opens the others doesn't support ZIP64, and will fail on real archives over 4 GB.
  • Upload limits: sample-1mb.zip is exactly 1 MiB, so you can test a limit at the boundary.

Free to use for testing, teaching and demos, commercially or not, with no attribution needed. A link back to this page is always appreciated.

Put it online

Have a ZIP file? Give it a link.

Drop a ZIP on 99helpers and it gets its own download link, so you can send a whole folder without email attachment limits. Anyone with the link downloads the archive and opens it on their own device.

Put a ZIP file onlineSee inside a ZIP online

Questions

ZIP files, frequently asked

What is a ZIP file used for?

Packing many files and folders into one file, usually smaller, so they're easier to send, download or store. It's also the container inside DOCX, XLSX, EPUB, JAR and APK files.

How do I open a ZIP file?

Double-click it. Windows, macOS, iOS and Android all open ZIP files without extra software. On Linux, use unzip archive.zip. For encrypted or unusual archives, 7-Zip is a free option on Windows.

Does zipping a file reduce its quality?

No. ZIP compression is lossless: every file comes out byte for byte identical, which the CRC-32 checksum confirms.

Why didn't my ZIP file get smaller?

The files were already compressed. JPEG photos, MP4 videos, MP3s, PDFs with images and Office files gain little or nothing from zipping again.

Is a password-protected ZIP secure?

Only with AES-256 encryption and a strong password. The older ZipCrypto method can be broken. Either way, the file names inside remain visible without the password.

What is the maximum size of a ZIP file?

4 GB and 65,535 files for a classic ZIP. With ZIP64, which modern tools use automatically, the limits are far beyond any real use.

Can a ZIP file contain a virus?

It can contain any file, including malware, and ZIPs are often used to slip malware past email filters. Opening the archive to look is safe; be careful running anything inside, especially from an unexpected email.

What is a zip bomb?

A small archive built to expand into an enormous amount of data, to crash a program or fill a disk. Well-written extractors and scanners limit how much they will decompress.

What's the difference between ZIP and RAR?

Both are archive formats. ZIP is an open specification that every system opens natively. RAR is proprietary and often compresses better, but needs WinRAR, 7-Zip or a recent version of Windows 11 to open.

Related formats

Other file types explained

DOCX fileAll file types

Keep going

Related

Host a ZIP file

Give an archive its own download link.

Share a ZIP file

Send a folder as one link instead of many attachments.

Unzip files online

See and extract what's inside a ZIP in your browser, free.

Host a website

Put a zipped folder of pages, styles and images online.

Sources

Last reviewed 27 October 2026.