A friend forwarded a résumé to me last week zipped inside a .zip inside a .rar inside another .zip. The email subject was "pls review urgent". I did not, in fact, review, because that is exactly what malware looks like — and it's the reason I finally sat down to write this post.
ZIP files are 36 years old (Phil Katz, 1989). They're also the format everyone still uses for "send me a folder", the format most CMS themes and WordPress plugins ship as, and the format a large chunk of email-borne malware hides inside. Understanding what's really in a ZIP — and how to peek inside without unzipping — makes you meaningfully safer online.
What a ZIP file actually is
A ZIP is a small directory ("central directory") plus a list of compressed file entries. Each entry has a filename, a compression method, a timestamp, and a CRC checksum. The central directory sits at the end of the file — which is why the first thing any ZIP tool does is jump to the last few bytes to read the table of contents.
That end-first layout is also why a truncated ZIP is unrecoverable. If a download stops halfway, the actual bytes of your files might be intact, but the table of contents is gone and no tool will read them without heroic effort.
The three risks people ignore
1. Filename tricks. A file can be named "invoice.pdf.exe" and, on Windows with default settings, show up as "invoice.pdf". Some attacks use Right-to-Left Override Unicode characters to make "invoice[RLO]fdp.exe" render as "invoiceexe.pdf". Always check the actual file extension, not what the icon suggests.
2. ZIP bombs. A 42 KB ZIP called 42.zip decompresses to 4.5 petabytes. It's harmless if you never extract it, disastrous if you do. Modern extractors have safety limits; older ones don't. Any tool that starts "warming up" for minutes on a small ZIP is a red flag.
3. Path traversal. A ZIP can contain filenames like "../../../etc/passwd". A poorly written extractor will helpfully overwrite files outside the extraction folder. This is still a real bug class in 2026 — patch your unzip tool.
Encrypted ZIPs and the ZipCrypto trap
The password-protection built into the ZIP format has two versions. ZipCrypto (the default in Windows Explorer's "compress with password") is broken — a laptop can crack a ZipCrypto password in seconds if it can guess even 12 bytes of any file in the archive (a known-plaintext attack). This has been known since 1994.
AES-256 encryption (used by 7-Zip and WinRAR when you explicitly pick it) is currently unbroken. If you're sending a ZIP with real secrets, pick AES-256 and share the password over a different channel — text if the file was sent by email, and never in the same email as the file.
The safer way: peek before you extract
The single best security habit with ZIPs is to look inside without extracting. Every good tool lets you list the file table before you commit. Names look weird? Total decompressed size 400× the ZIP size? Filenames with .exe, .bat, .scr, .js, .vbs? Don't extract. Delete.
Bluebird's ZIP Extractor runs entirely in your browser, shows you the full file list before you extract anything, and won't overwrite files outside the target folder. Because nothing uploads, you can safely inspect a suspicious ZIP without ever letting it touch your operating system's real filesystem — the browser sandbox is doing the work.
When ZIP isn't the right answer
Sharing a folder to one person, over a modern chat app: use their built-in folder share (Signal, iMessage, WhatsApp Web all handle folders now). Zero benefit from zipping.
Backing up your own files long-term: use tar.gz or 7z, which have better error resilience and compression respectively. ZIP is a compatibility format, not a good archive format.
Sharing photos: don't zip. JPGs are already compressed; you'll save 0.5% and lose thumbnails in every gallery app. Send them as a folder or a shared album.
The one case where ZIP is still the right answer: sending a folder of arbitrary files to someone whose device or OS you don't know. It's the only format guaranteed to open everywhere.
