Archive Risk Checker

Archive Risk Checker is for the moment before you double-click an unfamiliar ZIP. It inspects the archive's file list and metadata for patterns that commonly accompany malicious archives, so you can decide whether extraction is worth the risk. It fits a ZIP arriving from an unknown sender, a download you want to vet before opening, or an email attachment you would rather not extract directly onto a work machine.

It also suits people who receive archives for work: support staff auditing a client ZIP, admins screening uploads, or anyone showing teammates what a suspicious archive looks like, since each finding names the files and explains the pattern.

It does not edit, extract or repackage anything; the only output is a read-only report.

Select or drop a ZIP and it is parsed in your browser; nothing is uploaded. It reads the file list and metadata rather than decompressing contents, so it stays fast on large archives.

It looks for a defined set of patterns and weights each one. High-risk findings: programs, installers, scripts, shortcuts and disk images (.exe, .msi, .dll, .bat, .cmd, .ps1, .vbs, .js, .hta, .lnk, .iso, .dmg, .pkg, .jar and similar); an executable named with a document-like extension first, such as invoice.pdf.exe; a hidden text-direction character that makes a name display backwards; a path that would write outside the extraction folder (../, an absolute path or a drive letter), judged on the name exactly as stored in the archive; and a file that expands past 100 MB at more than 200 times its compressed size. Medium: macro-enabled Office files, an archive that expands past 1 GB in total, or more than 5,000 files. Web pages, hidden files and archives nested inside are listed as notes that do not raise the level. The result is a 0-100 score mapped to Low, Medium, or High, with each finding listing example file paths and why it matters.

What it does not do: it does not open or decompress files, does not run antivirus signature matching, and does not look inside documents for embedded macros or scripts. A password-protected ZIP cannot be checked at all; the tool says it is encrypted, which for an unexpected attachment is itself a warning sign, because encryption also hides files from email scanners.

The most important limitation is the one the tool states plainly: this is a structural inspection, not antivirus. It reasons from file names, extensions, paths, and compression metadata: not from the actual bytes of each file. A genuinely malicious payload with an innocent name and a normal extension can pass with a Low score, and a Low result never means an archive is safe.

Expect false alarms too: installers, build scripts or macro workbooks raise the score even when benign. Read each finding's explanation rather than the number.

It expects a ZIP (not RAR, 7z or TAR), and archives nested inside are not opened, so check an inner ZIP after extracting it.

Start with the level and score, then read every finding rather than stopping at the headline. Check the named files: are the flagged executables or macro documents ones you expected from this sender, or surprises? Look closely at any double-extension or reversed-text entry: those patterns are rarely innocent. If an archive-bomb pattern is flagged, do not extract it onto a low-space disk. If unsafe paths appear, avoid extracting with any tool that honors stored paths.

Weigh the result against context: who sent it, whether you expected it, and whether the contents match the description. A Low score from an untrusted source still warrants caution.

For anything you cannot verify, also scan the archive with up-to-date antivirus and confirm with the sender through a separate channel.