An archive parser reads the index structures of a zip, tar or 7z file — the central directory, the tar header blocks — to list every entry's name, size, timestamp and compression method without extracting anything to disk.
What is the Tar / Zip / 7z Parser?
The three formats work quite differently. A zip archive has a central directory at the end of the file listing every entry with its offset, sizes and CRC, which is why zip supports random access and why a zip can be read even when appended to another file. Tar is a stream of 512-byte header blocks, each followed by the file data, with no index — you must read it end to end. 7z uses its own container with a compressed header and typically LZMA2 inside.
Reading the index without extracting is the safe way to inspect an untrusted archive. Zip-slip — entries whose names contain ../ to escape the extraction directory — remains a live vulnerability class, and zip bombs advertise modest compressed sizes while expanding to terabytes. Both are visible in the listing before you extract.
The listing also answers everyday questions: whether an archive has a single top-level directory or will scatter files across your working directory, and which compression method was used.
How to use the Tar / Zip / 7z Parser
- Load the archive — it is parsed locally and never uploaded.
- Review the entry list: names, compressed and uncompressed sizes, timestamps.
- Check for ../ in paths and compare compressed to uncompressed ratios before extracting.
When to use it
- Inspecting an untrusted archive for path-traversal entries before extraction.
- Checking what a download actually contains without unpacking it.
- Spotting a zip bomb by its compression ratio.
Tar / Zip / 7z Parser at a glance
| Zip | Central directory at end of file · magic 50 4B |
| Tar | 512-byte header blocks, no index · usually .tar.gz |
| 7z | Own container, LZMA2 by default · magic 37 7A BC AF |
| Safety check | Look for ../ in entry names (zip-slip) |
Frequently asked questions
What is zip-slip?
A vulnerability where an archive entry's name contains ../ sequences so extraction writes outside the intended directory, potentially overwriting system files. Reviewing entry names before extracting is the reliable defence.
Why does tar need gzip?
Tar only concatenates files with headers; it has no compression of its own. That is why archives are almost always .tar.gz or .tar.xz — tar for the bundling, another algorithm for the compression.
Can I tell if an archive is encrypted?
Yes. Zip sets an encryption flag in each entry's header, so the listing shows which entries are protected — though filenames remain readable unless the archive uses header encryption.
Last reviewed · found a mistake? contact@decoder.tools · view as markdown