ZIP Bomb Risk Checker.
Assess an archive before extraction while keeping its bytes and filenames inside your browser. Inspect ZIP central-directory metadata locally for dangerous expansion ratios, entry counts, paths and nesting without inflating payloads.
- ✓Runs in your browser
- ✓No account required
- ✓Verified output
Use ZIP Bomb Risk Checker
Private in this browser. The ZIP and every discovered path stay in this browser; archive bytes and reports are not sent to a server.
No file selected.
Verified result
Download resultHow it works
- 01
Choose one ZIP archive up to 50 MB.
- 02
Run the bounded central-directory inspection; entry payloads are never inflated.
- 03
Review paths, sizes, ratios, nesting and header-integrity signals, then download the independently verified report.
Frequently asked questions
Does the checker extract archive files?
No. It reads container metadata and local headers without inflating entry payloads.
What makes an archive suspicious?
Configured expansion size or ratio limits, deep or unsafe paths, nested archives, encrypted entries, and mismatched local headers produce review signals.
Does ZIP Bomb Risk Checker upload my data?
ZIP Bomb Risk Checker runs locally in your browser. The ZIP and every discovered path stay in this browser; archive bytes and reports are not sent to a server.