Online Unzip

Features

• Lists first: names, uncompressed sizes and which members are encrypted
• Extracted entirely in the browser — the page contains no upload code
• Tick the files you want, or select all / none
• “Download selected” repacks one zip (a single download, so nothing gets blocked)
• ⚠️ Encrypted members are marked in the listing instead of producing garbage
• ⚠️ Filenames are sanitised against path traversal (`../../etc/passwd` becomes `passwd`)
• ⚠️ Extracted contents are only downloaded, never rendered — a zip containing a `<script>` is a common attack surface
• Handles zip64 and older archives with GBK filenames

How to use

1. Drop a zip into the box above (or click to choose one)
2. Read the listing: which files, how big, anything encrypted
3. Untick what you do not want and press Download selected
4. The browser downloads a zip containing exactly those files

FAQ

Are my files uploaded to a server?

No. This page contains no upload code — the archive is read into memory through the browser’s file API, extracted with the browser’s own `DecompressionStream`, repacked and downloaded locally. You can even disconnect from the network and use it again: it behaves identically (there is no network code to disconnect). Archives are often backups, contracts or keys, and those are exactly the files that should not pass through someone else’s server.

Why does “Download selected” give me one zip instead of several files?

Because triggering download after download gets blocked: most browsers allow only the first download inside a user gesture, then ask about “multiple files” — and when it is blocked you cannot tell which file you lost. So this repacks a single zip. The new archive uses no compression, because the members are already decompressed on your machine and compressing again costs time for little gain (images, PDFs and video will not shrink anyway). Any tool can open it normally.

Can it open encrypted archives? Why can I see the filenames?

It cannot open them, but the names are visible. A zip is “directory plus data”: the filenames and sizes live in the directory, in the clear (zip encryption covers only the member data, unlike 7z which can encrypt the directory too), so the listing works. The data itself stays shut without the password — so those entries are marked “encrypted, cannot open” and cannot be ticked, rather than producing garbage. Use a local tool that supports passwords for encrypted archives.

Does it support rar / 7z / tar.gz?

No — and not because it is unfinished, but because it is a different job. rar and 7z are independent formats with their own compression algorithms and structures (rar’s algorithm also has patent history and no complete open implementation), while tar.gz is two layers: gzip over a tar. Each needs its own decoder; they are not variants of zip. This tool handles zip, including zip64 and older archives with GBK filenames.