Extract Files From a ZIP, TAR, 7z or RAR Archive

No, and the reason is worth knowing because it is stronger than a promise. This page runs a WebAssembly build of libarchive that contains sixteen archive_read_support_format_* entry points — ZIP, TAR, 7-Zip, RAR, RAR5, CPIO, AR, CAB, LHA, ISO9660, XAR, WARC, mtree and the rest — and zero archive_write_set_format_* ones. There is no writer in the binary to call, so no future change to this page could quietly start creating archives. Packing files into a ZIP is what Create ZIP does, on a different library entirely.

Then it was a single compressed file rather than a compressed archive, and the page said which it found. A .tar.gz is a tar — a real archive with many members — wrapped in gzip, and libarchive reads it. A bare .gz, like access.log.gz, holds one file and nothing else; libarchive is not built with its raw reader, so it cannot open that at all. The browser's own gzip decoder does it instead, which is why the list has exactly one row and the size shown is the one the file records in its last four bytes. There is no browser-native xz or bzip2 decoder, so a bare .xz or .bz2 — as opposed to a .tar.xz or .tar.bz2 — is refused with that explanation rather than opened wrongly.

It stored a path that points outside the folder you would unpack into — something beginning with ../, an absolute path like /etc/passwd, or a Windows drive or network path. That is the zip-slip pattern, and an archive built by an ordinary tool does not contain one. Nothing here could write to those locations even if it tried: a browser download goes to your downloads folder and nowhere else. The reason it is shown rather than quietly cleaned up is that the same archive unpacked by tar or unzip on a shell CAN write there, and you should know the file tried before you take it anywhere else. Refused entries are listed with their real stored path and cannot be ticked.

Use Unzip Files for an ordinary .zip. It runs on JSZip, which is already part of this site's JavaScript, so it fetches no engine and starts instantly. Come here when the file is not a plain ZIP — a .tar, .7z, .rar, or a tar.gz, tar.xz or tar.bz2 — or when the ZIP's entries are password-protected, which JSZip cannot decrypt at all. The cost of that reach is one 599 KB WebAssembly download the first time something on this page needs the engine, cached by your browser afterwards — a bare .gz never does, because the browser's own gzip decoder reads that one and the engine is not fetched at all. Both read the archive in your tab and neither uploads anything.

Often, yes. Type the password into ARCHIVE PASSWORD in the rail before extracting; it is handed to the engine running beside this page and is not stored, remembered or sent anywhere. libarchive opens ZipCrypto and AES-encrypted ZIP entries given the right password, and it reports a wrong one as a wrong password rather than handing back garbage. What it will not do is decrypt RAR: this build says so itself, and rather than guess, the page shows you the engine's own refusal for any member it cannot read, naming the entry. Some archives also encrypt their file list, in which case nothing appears until you supply the password and press "Read this archive again".

No. Transmute processes everything locally in your browser using JavaScript and WebAssembly. Your files never leave your device — there is no server, no upload, no cloud processing.