ZIP Files, Explained
What a ZIP file is, how ZIP compression works, why photos and videos barely shrink, how to unzip safely on any device, and how ZIP compares with 7z and RAR.
By Udit Agarwal · Updated October 17, 2026
A ZIP file is a single file that holds other files and folders, usually compressed so the bundle is smaller and travels as one download. Each file inside is compressed on its own, most often with the Deflate method, and a directory at the end of the archive lists every file with its size, date and checksum. You open one by double-clicking it on a computer, tapping it in the Files app on a phone, or loading it into a browser tool that lists the contents and extracts only what you need.
ZIP was created by Phil Katz's company PKWARE in 1989, and PKWARE still maintains its specification, a document called APPNOTE.TXT. An archive has three parts:
This layout explains two everyday things. Because each file is compressed separately and the directory says where it sits, a program can pull out one file without decompressing the rest. And because the directory comes last, a download that stopped early usually cannot be opened at all.
The original format allows up to 65,535 files and 4 GB per file or archive; the ZIP64 extension removes those limits. Many familiar formats are ZIP archives inside: .docx, .xlsx and .pptx files, EPUB e-books, Android apps (.apk), Java archives (.jar) and comic book archives (.cbz).
Each entry records its compression method. Method 0 is stored, kept exactly as it is. Method 8 is Deflate, defined in RFC 1951, which almost every ZIP tool uses by default. Some archivers offer others, such as bzip2, LZMA or Zstandard, which simpler tools cannot open.
Deflate is lossless and works in two steps. It replaces each repeated sequence of bytes with a short reference to an earlier copy, up to 32 KB back, then re-encodes the result with Huffman coding, which gives common symbols shorter codes. Text, code, spreadsheets and logs are full of repeats, so they shrink a lot. In a quick test at Deflate's usual setting, a 338 KB JSON file shrank by 74 percent and a 10.6 KB CSV file by 65 percent.
Very repetitive data can shrink enormously. Deflate's ceiling is about 1,032 to 1, so a 1 GB file of zeros fits in roughly 1 MB, which is the raw material of zip bombs.
Zipping a folder of holiday photos rarely saves much space, because the photos are compressed already. JPEG, PNG, HEIC, MP4 and MP3 files, and Office documents saved by Word or Excel, store their content in compressed form, and well-compressed data looks random: there are almost no repeats left for Deflate to find. In the same test, a 3.8 MB MP4 video shrank by under 5 percent.
So zip photos and videos to keep them together as one file, not to make them smaller. Shrinking them takes their own kind of compression, at some cost in quality: Compress Image to Size does it for photos, and the guide to video compression covers videos. The guide to image formats explains why a PNG of a photo is large and a JPG is not.
ZIP supports two kinds of encryption. The original scheme, often called ZipCrypto, is weak and has been breakable since the 1990s. AES encryption, added later by WinZip and supported by archivers such as 7-Zip, is strong as long as the password is. Either way, a standard encrypted ZIP protects the contents of the files but not their names, so anyone can still list what is inside. 7z and RAR can encrypt the names too.
| Format | Compression | Files compressed separately? | Encryption | Opens without extra software on |
|---|---|---|---|---|
| ZIP | Usually Deflate | Yes | ZipCrypto or AES | Windows, Mac, iPhone, iPad, Chromebook |
| 7z | LZMA or LZMA2 | Usually not (solid) | AES-256, names optional | Recent Windows 11 |
| RAR | RAR's own method | Optional | AES, names optional | Recent Windows 11 |
| tar.gz | gzip over the whole bundle | No | None built in | Mac, Linux, recent Windows 11 |
Solid compression treats all the files as one long stream. It finds repeats across files and usually makes a smaller archive, but getting one file out means decompressing everything stored before it. A tar.gz is always solid: tar bundles the files, then gzip compresses the whole bundle. ZIP trades some compression for quick access to any single file, and practically every device opens it.
Anyone can build an archive, and two classic tricks target programs that unpack carelessly.
Zip slip is the name the security company Snyk gave in 2018 to a flaw it found in many extraction libraries. An entry's name is just text, and it can be ../../startup/run.bat or start with a drive letter. A program that saves entries under their stored names without checking can be tricked into writing outside the folder you chose. Safe tools clean every name first, removing .. steps, leading slashes and drive letters.
Zip bombs expand to an absurd size to exhaust memory or disk space. Deflate alone allows about 1,000 to 1, and nesting archives inside archives multiplies it: the well-known 42.zip is 42 kilobytes and unpacks, layer by layer, to about 4.5 petabytes. Safe tools check the sizes the archive declares, stop decompressing when the output exceeds them, do not unpack nested archives automatically, and treat a huge expansion ratio as a warning sign.
The commonest danger is plainer: a program, script or macro-laden document inside a ZIP. Do not run anything from an archive you were not expecting. A checksum such as SHA-256 confirms that a file arrived intact, as the hash generator guide explains, but it says nothing about whether the file is safe.
| Device | How to unzip |
|---|---|
| Windows | Double-click to browse it like a folder, or right-click and choose Extract All |
| Mac | Double-click it; Archive Utility unpacks it into a folder beside the archive |
| iPhone and iPad | Tap it in the Files app; the contents appear in a new folder next to it |
| Android | Open it in Files by Google or your phone's file manager and tap Extract |
| Chromebook | Open it in the Files app, which shows the contents like a drive |
| Any browser | Load it into an online unzip tool to preview and pick files |
On a phone, a browser tool is often the quickest way to get one document out of a large archive, since you save just that file instead of unpacking everything.
Unzip Files Online opens ZIP archives, and ZIP-based files such as DOCX, XLSX, EPUB, APK, JAR and CBZ, in your browser. You can drop several at once and switch between them. Opening an archive reads its directory without decompressing anything; a file is decompressed only when you preview or download it.
Each archive shows its number of files and folders, the unpacked and archive sizes, the share saved by compression, and its comment if it has one. Browse the folder tree or a flat list, search by any part of a name, and sort by name, size, date or how much each file was compressed. Every row shows the file's size, the percentage saved and the modified date.
The eye button previews a file without extracting the rest: text and code up to 20 MB (the first 200,000 characters are shown), JSON up to 5 MB, indented when shown in full, images including PNG, JPEG, GIF, WebP, AVIF, BMP, ICO and SVG up to 40 MB, and audio and video your browser can play, up to 100 MB and 200 MB. The download button saves a single file. Tick files or whole folders and choose Download selected as ZIP, or use Download all as ZIP; either way the files come back as a new, uncompressed ZIP, and a batch over 1.5 GB is refused, so take bigger sets a few at a time.
The safety checks above are built in. Names with .., a leading slash or a drive letter are made safe, characters Windows forbids are replaced, and two files with the same name are kept apart as name (2). Every file is checked against its stored CRC-32 and size, and decompression stops the moment the output passes the declared size. Contents that unpack to over 1 GB and more than 200 times their compressed size bring a zip bomb warning, and an archive over 500 MB brings a memory warning, since the whole file is read into memory on your device.
The limits: only stored and Deflate entries can be extracted, password-protected files are listed and labelled but cannot be opened, and ZIP64 archives (over 65,535 files or 4 GB) and split archives are refused with an explanation. RAR, 7z and tar.gz files are not ZIP archives, so they are rejected. Everything happens in your browser, and the archive is not uploaded.
How do I open a ZIP file without installing anything? Your system can already do it: double-click it on Windows or a Mac, tap it in the Files app on an iPhone or iPad, or open it in Files by Google on Android. A browser tool such as ArrayKit's Unzip Files Online works on any device and lets you preview files before saving them.
Why won't my ZIP file open? The usual reasons are a download that stopped early, which leaves the directory at the end missing, and a file that is not really a ZIP, such as a RAR or 7z with the wrong name. ZIP64 archives, split archives and unusual compression methods defeat simpler tools too. Try downloading it again first.
Can I extract just one file from a ZIP? Yes. ZIP compresses each file separately, so a tool that lists the contents can pull out one file without unpacking the others. In ArrayKit's tool, find it in the tree or with the search box and press its download button.
Why didn't zipping make my files smaller? They were already compressed. Photos, videos, music and Office documents leave Deflate little to remove; plain text is what shrinks a lot.
Can ArrayKit open a password-protected ZIP? No. Encrypted files are listed by name and labelled, but they cannot be extracted and no password is asked for. Unencrypted files in the same archive extract normally.
Is it safe to open a ZIP file from the internet? Listing and previewing the contents is low risk; the danger is running what is inside. Be wary of programs, scripts and documents that ask you to enable macros, especially in archives you were not expecting.
All Encode / Decode tools · All guides