📦 ZIP files
Test ZIP archives
104,857,792 bytes
application/zip
10,485,950 bytes
application/zip
1,048,764 bytes
application/zip
52,428,990 bytes
application/zip
About ZIP files
Test ZIP archives from 1 MB to 100 MB are available free, for upload testing, extraction verification, and transfer-speed measurement.
A normal ZIP's size depends entirely on what it contains, but the archives here are trimmed to land on the stated size exactly, so they can be used directly for boundary-value testing.
Typical uses
- Testing size limits on ZIP upload
- Confirming that server-side extraction caps the uncompressed size — the defence against zip bombs
- Confirming that entry names containing
../are rejected — the Zip Slip defence - Simulating backup jobs and transfer bandwidth
For why compression ratios differ so much between files, see Why ZIP compression ratios vary so much.
Related reference and articles
📖 Where people get stuck
ZIP archives from 10 KB to 100 MB, for upload limits and for exercising extraction. The contents are ordinary files, not crafted for attack. If you want to try a zip bomb or a path traversal entry, implement the defences below first and build one yourself.
| Case | What happens | What to do |
|---|---|---|
| Nothing checks the expanded size | ZIP compression has no ceiling. A few tens of kilobytes expanding to several gigabytes is easy to construct, and the upload size check waves it through. | Sum the declared sizes in the headers before extracting and compare against a cap. Those values can lie, so also count bytes as you write them out and abort at the limit. |
| Files land outside the target directory | A ZIP entry name can contain a relative path such as ../../etc/cron.d/x verbatim. Join it and write, and the file goes wherever the archive says. |
Normalise the joined path with realpath() and confirm it still starts inside the target directory before writing. Reject symlink entries on the same grounds. |
| Japanese filenames come out garbled | The spec allows CP437 or UTF-8 for entry names, but the Windows built-in writes CP932 without setting the flag. Read as UTF-8, it garbles. | Look at bit 11 of the general purpose flag; if it is not set, decode as CP932. To recover a name you already have, the mojibake fixer is the quicker route. |
Anything over 4 GB, or with more than 65,535 entries, becomes a ZIP64 archive. Older libraries sometimes return quietly wrong results, so confirm ZIP64 support explicitly if large archives are in scope.