Online ZIP & tar.gz Viewer and Extractor

List, extract and create ZIP, tar, tar.gz (.tgz) and .gz archives over HTTP, with zip-bomb and path-traversal protection.

Result

Press “Run” to see the result.

action=list (default for an uploaded file) returns every entry with name, size, compressed size, date, CRC-32, compression method and flags for directories, encrypted entries and unsafe names (absolute paths or ..). ZIP names without the UTF-8 flag are decoded as UTF-8 when valid, else CP437 (set name_encoding, e.g. windows-1258, for archives made by older Windows tools). ZIP64, tar (ustar, pax and GNU long names), tar.gz and single-file .gz are supported.

action=extract with entry returns one file as base64 (plus text for small UTF-8 files) or as the raw file with output=raw. action=extract_all returns all files as base64 JSON (up to 20 MB) or re-packed as a ZIP with output=zip; unsafe and encrypted entries are skipped and listed.

action=create builds a format zip (default), tar, tar.gz or gz from multipart files (file1, file2…) or files: [{"name": "a.txt", "content_base64": "…"}] (or content text), with compression level 0-9. Zip-bomb guards: total uncompressed size (200 MB on Pro), 1000:1 ratio, 10,000 entries; output sizes are checked while inflating. Password-protected (encrypted) ZIPs, 7z, RAR, bzip2 and xz are not supported.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/archive" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "file=@./my-file"

const form = new FormData();
form.append('file', fileInput.files[0]);

const res = await fetch('https://apibox.io.vn/v1/archive', {
  method: 'POST',
  headers: { Authorization: 'Bearer YOUR_API_KEY' },
  body: form,
});
console.log(await res.json());

import requests

res = requests.post(
    "https://apibox.io.vn/v1/archive",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    files={"file": open("my-file", "rb")},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/archive');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
    CURLOPT_POSTFIELDS => ['file' => new CURLFile('my-file')],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Can it open password-protected ZIP files?

No. Encrypted entries are listed with encrypted: true but cannot be extracted; ZIP encryption (ZipCrypto or AES) is not supported.

How are zip bombs handled?

Archives that claim more than the total limit or a compression ratio above 1000:1 are refused, and every entry is decompressed with a hard output cap, so lying size fields do not help.

File names show wrong Vietnamese characters, what can I do?

Archives from old Windows tools store names in a local code page without the UTF-8 flag. Try name_encoding=windows-1258 or cp437 to decode them.