Know the
boundaries.
What gets checked
This tool reads a standard single-disk ZIP directory without extracting every file. It compares local and central names, flags, methods, sizes and checksums; validates structural bounds and data descriptors; refuses unsafe or ambiguous paths, duplicate or Unicode-normalized duplicate names, symlinks and special files. It rejects overlapping, prefixed and unaccounted file records. Entry contents are decompressed only on request, in a worker.
Before a file is downloaded, its actual length and CRC32 must match the ZIP directory. The inflate component throws if output would exceed the declared buffer. These checks catch certain malformed, inconsistent or damaged archives. They do not prove a ZIP or its files are harmless. CRC32 is not cryptographic authentication, a signature or a malware scan. There is no active-content preview, automatic open, folder write or recursive extraction. Treat unfamiliar downloads with care.
Supported subset
Standard ZIP, stored (method 0) and deflate (method 8) entries, single disk. Maximum ZIP 32 MiB, 1,000 entries, 16 MiB declared output per entry, 64 MiB total declared output. A 15-second operation timeout closes the archive. Only one requested file is extracted at a time. These bounds reduce resource use but do not promise a particular speed or memory footprint on every device.
Names must be ASCII or use the ZIP UTF-8 flag. Legacy non-ASCII names, Unicode-path override fields, encryption/passwords, ZIP64, split archives, other compression methods, self-extracting ZIP prefixes, digital signature records and extra data outside the supported layout are refused. Some valid ZIP files are therefore unsupported. This is not a universal archive repair tool. ZIPs with a directory entry containing compressed empty data are accepted, but directories cannot be downloaded.
Path checks reject absolute paths, backslashes, drive/device colons, dot segments, repeated separators, control characters, trailing spaces/dots and Windows reserved component names. Filenames are displayed as text, never HTML. Downloads use the base filename only, not folder paths. Browser name-collision rules apply. A passed index is not a content-integrity check: CRC and actual output are checked only when that entry is extracted.
Privacy
This build has no upload feature, analytics, tracking cookie, persistent archive storage or external runtime requests. Archive bytes remain in the page's worker while open. Clear/close terminates that worker and removes the list. Browser downloads are not removed. Hosting infrastructure serves the app files; no claim is made about access logs. Browser extensions and other software are outside this app's control.
Open-source attribution
The inflate-only component adapts fflate src/index.ts at revision dcb3714a6c25db3a2748641019c5277413d09714, copyright (c) 2026 Arjun Barrett, MIT licensed. Full licence and component notice. Changes: fixed-output buffer overflow now throws, asynchronous fflate worker APIs excluded, tree-shaken to inflateSync. The bounded ZIP inspector, checksum verification and UI are new MIT code. No other runtime dependencies, fonts or network services are included.
Download source. Revised November 13, 2026. Contact: contact@chawso.com.