A vulnerability where an archive entry's name contains ../ sequences so extraction writes outside the intended directory, potentially overwriting system files. Reviewing entry names before extracting is the reliable defence.

Why does tar need gzip?

Tar only concatenates files with headers; it has no compression of its own. That is why archives are almost always .tar.gz or .tar.xz — tar for the bundling, another algorithm for the compression.

Can I tell if an archive is encrypted?

Yes. Zip sets an encryption flag in each entry's header, so the listing shows which entries are protected — though filenames remain readable unless the archive uses header encryption.

Tar / Zip / 7z Parser

List entries, sizes and headers inside archive files without extracting them.

on the roadmapFile Format & Archivesfree · no sign-up

This bench is being wired up

The archive-parser decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the Tar / Zip / 7z Parser?

An archive parser reads the index structures of a zip, tar or 7z file — the central directory, the tar header blocks — to list every entry's name, size, timestamp and compression method without extracting anything to disk.

The three formats work quite differently. A zip archive has a central directory at the end of the file listing every entry with its offset, sizes and CRC, which is why zip supports random access and why a zip can be read even when appended to another file. Tar is a stream of 512-byte header blocks, each followed by the file data, with no index — you must read it end to end. 7z uses its own container with a compressed header and typically LZMA2 inside.

Reading the index without extracting is the safe way to inspect an untrusted archive. Zip-slip — entries whose names contain ../ to escape the extraction directory — remains a live vulnerability class, and zip bombs advertise modest compressed sizes while expanding to terabytes. Both are visible in the listing before you extract.

The listing also answers everyday questions: whether an archive has a single top-level directory or will scatter files across your working directory, and which compression method was used.

Tar / Zip / 7z Parser at a glance

Zip: Central directory at end of file · magic 50 4B
Tar: 512-byte header blocks, no index · usually .tar.gz
7z: Own container, LZMA2 by default · magic 37 7A BC AF
Safety check: Look for ../ in entry names (zip-slip)

How to use the Tar / Zip / 7z Parser

1Load the archive — it is parsed locally and never uploaded.
2Review the entry list: names, compressed and uncompressed sizes, timestamps.
3Check for ../ in paths and compare compressed to uncompressed ratios before extracting.

When you would reach for it

Inspecting an untrusted archive for path-traversal entries before extraction.
Checking what a download actually contains without unpacking it.
Spotting a zip bomb by its compression ratio.

Tar / Zip / 7z Parser — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools