Archive Risk Checker

Archive Risk Checker is for the moment before you double-click an unfamiliar ZIP. It inspects the archive's file list and metadata for patterns that commonly accompany malicious archives, so you can decide whether extraction is worth the risk. It fits a ZIP arriving from an unknown sender, a download you want to vet before opening, or an email attachment you would rather not extract directly onto a work machine.

It also suits people who receive archives as part of their job. Support and operations staff auditing a client-submitted ZIP, admins screening user uploads, and anyone preparing files for sharing can use the report to spot a disguised executable or a path-traversal entry before it reaches a colleague's desktop. Because the findings name specific files and explain each pattern in plain language, it doubles as a teaching aid for showing teammates what a suspicious archive actually looks like.

It is deliberately not a general document or conversion tool. There is no editing, no extraction, and no repackaging here — the only output is a read-only risk report. If you need the contents, pair it with a separate extract or inspect tool after you have judged the archive.

The flow is a single step: select or drop a ZIP file and the tool parses it in your browser using JSZip. Everything runs locally — nothing is uploaded to a server, and nothing persists once the tab closes. It reads the central directory and file entries rather than decompressing payloads, so the check stays fast even on large archives.

It scans for a defined set of patterns and assigns each a weight: executable and script extensions (.exe, .msi, .bat, .cmd, .com, .scr, .pif, .vbs, .js and similar), double-extension filenames like invoice.pdf.exe, macro-enabled Office files (.docm, .xlsm, .pptm and the rest), hidden dot-files, suspicious compression ratios above roughly 50-to-1 that suggest an archive bomb, absolute or ../ traversal paths, encrypted entries, and unusually high file counts. The weighted total becomes a 0-100 score mapped to Low, Medium, or High, with each finding listing example file paths and why it matters.

What it does not do: it does not open or decompress files, does not run antivirus signature matching, does not look inside documents for embedded macros or scripts, and cannot read the contents of password-protected entries. It flags that an archive is encrypted; it cannot tell you what those encrypted files are.

The most important limitation is the one the tool states plainly: this is a structural inspection, not antivirus. It reasons from file names, extensions, paths, and compression metadata — not from the actual bytes of each file. A genuinely malicious payload with an innocent name and a normal extension can pass with a Low score, and a Low result never means an archive is safe.

Conversely, expect false alarms. A legitimate software bundle full of .exe installers, a developer ZIP containing build scripts, or a spreadsheet workbook with .xlsm macros will all raise the score even when entirely benign. The score is a prompt to think, not a verdict. Reading the per-finding explanation matters more than the number itself.

Common mistakes include feeding it the wrong format — it expects a ZIP, not RAR, 7z, or TAR — and assuming a clean report covers encrypted contents it could not actually read. Treat the report as one input among several, not the final word.

Start with the level and score, then read every finding rather than stopping at the headline. Check the named files: are the flagged executables or macro documents ones you expected from this sender, or surprises? Look closely at any double-extension entry — that pattern is rarely innocent. If a high compression ratio is flagged, treat the archive as a possible bomb and do not extract it onto a low-space disk. If traversal or absolute paths appear, avoid extracting with any tool that honors stored paths.

Cross-check the result against context: who sent the archive, were you expecting it, and does the file count and contents match what was described? An encrypted-files notice means part of the archive was invisible to the check, so weigh that gap before deciding. A Low score on an archive from an untrusted source still warrants caution.

For anything official, financial, or legal — or any file from a source you cannot verify — do not rely on this report alone. Run the archive through up-to-date antivirus software, and when the stakes are high, confirm with the sender through a separate channel before extracting.