What This Tool Does
This tool evaluates a ZIP for decompression-bomb risk. It compares the total stored size of the archive with the total uncompressed size its entries declare, and computes an expansion ratio with the platform's safety ceiling as context.
The tool never decompresses the archive to make this judgment, which keeps the scan itself safe even against malicious inputs.
What the Report Shows
- Declared stored and uncompressed sizes.
- The computed expansion ratio with the platform ceiling for reference.
- A verdict with clearly stated meaning, not a scare label.
Step by Step
- 1
Upload the ZIP.
- 2
Click Detect Risk.
- 3
Read the ratio and verdict.
How Detection Works
Entry-level size metadata is totalled in both directions. The ratio of declared uncompressed to stored bytes is the classic bomb signal, and it is evaluated against the platform decompression ceiling so the verdict carries real context.
Troubleshooting
- Non-ZIP inputs are rejected before any analysis.
- The scan reads metadata only, so it is safe by construction.
- Legitimate high-compression archives may flag high ratios; use the ratio with judgment.
Frequently Asked Questions
What is a ZIP bomb?
A tiny archive that declares enormous uncompressed content, intended to exhaust disk or memory when expanded.
How can you detect it without opening it?
The declared uncompressed sizes live in the archive directory, so they can be read safely without decompression.
Is the scan dangerous?
No, it reads metadata only and avoids decompressing anything.
What ratio is dangerous?
The report compares your ratio against the platform ceiling and explains what the number implies in context.
Does this replace antivirus?
No, this targets the decompression-bomb pattern. Keep regular scans as well.