ZIP file creation/unzipping tool (password encryption supported) | ZeroTools

This tool bundles multiple files into a single ZIP archive using JSZip (version 3.10.1) running in your browser. Selecting the "Create ZIP (Compress)" tab on the "Archive Control Panel" at the top of the interface displays the creation controls.

To add files, drag and drop them into the dashed upload area, or click the area to open your operating system file selection dialog.

Selected files are immediately loaded as JavaScript File objects and temporarily held in browser memory.

Strict limits are enforced on input files to maintain operational stability. A single creation session accepts up to 500 files, with a cumulative file size limit of 50 MiB (52,428,800 bytes).

Each time files are added, an internal validation function (validateZipInputs) runs; if selected files exceed these limits, a red error notice appears at the bottom of the screen and the addition is cancelled.

Successfully added files are listed in the "Compression List", showing an index number on the left and the file name and size (formatted in Bytes, KB, MB, etc.) in the center.

Files in the list can be individually removed by clicking the trash icon on the right. You can customize the output ZIP file name via the input field, though characters other than alphanumeric characters, hyphens, and underscores are stripped automatically.

When creating ZIP archives, this tool defaults to the "STORE" method (no compression) rather than "DEFLATE", which reduces file size.

The current implementation designates JSZip's uncompressed mode. STORE still requires memory for reading inputs and generating output, and does not guarantee stability or immunity from memory exhaustion.

Consequently, ZIP archives created by this tool will have a file size equal to or slightly larger than the total size of the original files.

Additionally, this tool does not support building directory structures (adding folders); all added files are placed directly in the root directory of the JSZip instance.

Because of this, files with identical names would overwrite one another. To prevent this, duplicate name checks run during addition, returning an error stating "Files with identical names cannot be added as they would be overwritten" and rejecting the addition for safety.

All of these transformations execute within browser memory on the user device. Input files and generated ZIP archives are never automatically sent to external servers provided by this tool.

However, loading website scripts, styles, and images is separate from ZIP processing, so the site itself is not entirely without network requests.

Local processing does not guarantee the overall security of the device or the entire website. Follow organizational rules when handling confidential files.

Switching to the "Extract ZIP (Decompress)" tab displays the interface for loading and inspecting existing ZIP archives. Extraction also uses JSZip, asynchronously parsing uploaded ZIP binary data (ArrayBuffer).

The size of readable ZIP files is restricted to a maximum of 50 MiB, matching the input threshold. Specifying a ZIP file exceeding this size halts processing immediately with an error.

Once loading starts, entries in the central directory are traversed sequentially to dynamically extract each file's name, declared uncompressed size, and directory flag.

During parsing, strict checks (validateZipEntries) are enforced as partial defenses against resource exhaustion and malicious ZIP files.

Specifically, the archive must contain no more than 500 total entries, individual uncompressed file size must not exceed 100 MiB (104,857,600 bytes), and declared total uncompressed size must not exceed 200 MiB.

Furthermore, if a file path contains backslashes, null characters, absolute paths (starting with / or drive letters), or parent directory traversals (..), parsing is rejected as a "dangerous file path format".

However, these checks rely on sizes declared in metadata, offering no guarantee of complete protection against malicious structures like ZIP bombs that manipulate compression ratios.

Therefore, never load suspicious ZIP files from untrusted sources. Once parsed, a list of file names and sizes is displayed, with directory entries distinguished by an orange icon.

After successfully parsing the ZIP file and displaying its listing, you can proceed to save contained files to your device's download destination.

This tool does not download directories as folders; it extracts and saves individual file data contained within directories.

Clicking the download icon to the right of an item triggers asynchronous extraction for that selected entry only. Extracted data is converted into a Blob object in the browser, and a temporary download link is generated via URL.createObjectURL.

During this step, the file name is flattened to its base name (image.png) extracted from its path (folder/image.png), so original folder structures are not restored.

If actual extracted data size differs from declared metadata or exceeds the single-file limit (100 MiB), an inconsistency error is displayed and saving is aborted.

Using the "Extract All Files" button at the top of the list issues sequential extraction and save requests for all non-directory files.

To avoid excessive browser load or instability, a 300 ms delay is inserted after each file. Actual download intervals may be longer depending on extraction time and browser control.

If identical base names exist in different folders, saved file names may collide, so verify the saved outputs. Because this bulk operation triggers consecutive download events, many browsers prompt for permission to download multiple files.

You must grant permission in the browser to use this feature.

Because this tool relies on standard JSZip APIs, it does not support creating or extracting password-protected encrypted ZIP files.

Loading an encrypted ZIP file in the extraction tab displays an error such as "Unsupported or invalid format" due to stream reading failure, without prompting for a password or detecting encryption flags.

Use native OS utilities or dedicated software to securely exchange password-protected files.

Furthermore, this tool only supports standard ZIP archives and cannot read other container formats such as 7z, RAR, or TAR. Uploading these formats will fail during parsing and result in an error.

Regarding capacity, because all conversion runs in browser RAM, this tool is not suited for handling massive archives. The limits of 50 MiB input and 100 MiB per-file / 200 MiB total uncompressed metadata are operational ceilings for this page, not guarantees of stability across all browsers.

For massive enterprise archives or logs containing thousands of files, native OS archivers are strongly recommended. Data processed in this tool is held only temporarily in the browser tab; closing the tab, reloading, or switching between "Create" and "Extract" tabs resets selected files.

While switching to another tab does not immediately erase data, tabs may be discarded by the OS to save memory, so state persistence cannot be guaranteed.

After compression or extraction save requests finish, always inspect your filesystem (typically the "Downloads" folder) to verify that files were output properly.

A "success" notice on the tool merely indicates that a save command was issued to the browser; it cannot detect disk space exhaustion or OS permission failures.

Temporarily generated object URLs are revoked (revokeObjectURL) after download triggering to release the URL reference.

If unexpected errors occur during processing (such as file corruption, unsupported formats, or exceeded limits), an error message appears against a red background at the bottom of the screen.

Switching tabs triggers component initialization hooks that reset selected file lists, upload states, and error notifications.

This tool processes files locally on your device and never transmits input data to external servers for ZIP processing. However, network requests required for web application functionality—such as loading JavaScript, rendering UI assets, and site analytics—must be distinguished from ZIP processing.

HTTP requests may send cookies, so this is not a claim that the entire website is communication-free. In environments handling sensitive data, network risks cannot be entirely eliminated while browser traffic exists; users must select appropriate environments and files at their own discretion based on local processing facts.