Read a ZIP central directory locally and flag traversal paths, encryption, duplicate names, and risky ratios.
- Runs locally
- Category Developer & DevOps
- Best for Checking file type, size, metadata, and obvious mismatch signals before sharing.
What this tool does
ZIP Manifest Inspector opens a ZIP file in the browser and reads the central directory without extracting anything. It exports a CSV with each entry name, compressed size, uncompressed size, compression method, encryption flag, CRC32, and risk notes. The scanner flags path traversal entries, absolute paths, backslash paths, duplicate names, encrypted entries, and suspiciously high expansion ratios that deserve extra review before extraction. It is useful for vendor deliveries, support attachments, release bundles, CMS imports, training datasets, and any archive you want to inspect before unpacking on a real machine. The tool is read-only and does not execute, extract, or upload archive contents.
Tool details
- Input
- Files + Text + Numbers
- The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
- Output
- Live result + Copy + Download
- The result area focuses on usable output, with copy, download, or preview actions when supported.
- Privacy
- Browser-side processing
- The main tool logic does not call an external API, so inputs normally stay in the current tab.
- Save / share
- No account required
- Open the page and use it; whether results survive refresh depends on the tool.
- Performance budget
- Initial JS <= 78 KB
- No WASM budget is declared, keeping the tool quick to open on mobile.
- Best fit
- Developer & DevOps · Developer
- Category and role tags drive related tools, internal links, and quick fit checks.
How to use
-
1. Input
Paste or drop your content into the tool panel.
-
2. Process
Click the button. All processing is local in your browser.
-
3. Copy / Download
Copy the result or download to disk in one click.
How ZIP Manifest Inspector fits into your work
Use it before upload, handoff, archive, support review, or any moment where a file needs one local check before it leaves your machine.
File jobs
- Checking file type, size, metadata, and obvious mismatch signals before sharing.
- Preparing mixed folders for upload, archive, intake, or review.
- Keeping sensitive files in the browser instead of sending them to an account-based service.
File checks
- Do not treat the extension alone as proof of the real file type.
- Review metadata before a file goes to customers, vendors, or a public page.
- Keep the original file until the copied, converted, or exported result is verified.
Good next steps
These links move the current task into a more complete workflow.
- 1 Office Document Inspector Inspect DOCX, XLSX, and PPTX package structure for macros, media, embedded objects, custom XML, and size hotspots. Open
- 2 Duplicate File Finder Upload a batch and find exact duplicate files by SHA hash locally, with a Markdown cleanup report. Open
- 3 File Hash Calculator Compute SHA-1, SHA-256, SHA-384, or SHA-512 hashes for uploaded files entirely in the browser. Open
Real-world use cases
Review vendor archives
List archive contents and risk signals before extracting a supplier ZIP onto a work machine.
Inspect release bundles
Export filenames, sizes, and CRCs for release notes or internal verification.
Common pitfalls
Double-clicking unknown archives before checking paths and uncompressed sizes.
Trusting visible folder previews that hide duplicate names or unusual path separators.
Privacy
ZIP structure is read locally. The CSV may reveal private filenames, so share it carefully.
FAQ
Tool combos
Folks in your role tend to reach for these alongside this tool.
- 555 Timer Calculator Astable f = 1.44/((R1+2R2)C) + monostable t = 1.1RC — pick R1, R2, C in Ω/kΩ and µF/nF, read frequency, duty cycle and pulse width — browser-only
- Add Line Numbers Number every line of pasted text — set start, step and separator, zero-pad to align, skip blanks, or strip numbers back off — browser-only
- AES Text Encryptor Encrypt & decrypt text with a password — AES-256-GCM + PBKDF2 via WebCrypto — 100% in your browser, nothing uploaded
- Affine Cipher Encoder & Decoder Encrypt and decrypt the ax+b affine cipher with live modular-inverse check, browser-only