# Extract Archive > Extract zip, rar, 7z and tar.gz in your browser — nothing uploaded, passwords decrypt locally, escape paths and zip bombs blocked before they touch disk. - URL: https://bytescope.dev/en/extract-archive/ - Locale: en · Also: [ja](https://bytescope.dev/ja/extract-archive.md) · [zh-Hant](https://bytescope.dev/zh-Hant/extract-archive.md) - Runs: Archives are opened, decrypted and unpacked entirely in this tab — nothing is uploaded, and the password never leaves the page. - Requires: Any modern browser to browse and download the extracted files. Extracting straight into a folder on disk needs Chrome, Edge or Opera on desktop (File System Access API). - Updated: 2026-09-08 ## What it does Drop in a zip, 7z, rar, tar, `tar.gz`, `tar.bz2`, `tar.xz`, `tar.zst` or plain gz file and take the contents out, entirely in your browser. RAR and 7z are handled by libarchive compiled to WebAssembly — the same engine behind desktop extractors, not a half-finished JavaScript port. You get a file tree of everything inside: download one file, tick several and save them as a zip, or extract the lot. On Chromium browsers you can even write straight into a folder you pick, via the File System Access API, so nothing takes a detour through the Downloads folder; other browsers get the same content repacked as a single zip. ### Passwords that never leave your machine For an encrypted archive, type the password and it decrypts locally — there is no server in the path, so there is literally nowhere for the password or the file to go. That is what makes this usable on material you would never upload to a website: a client's deliverable, a password-protected backup, a disclosure package, an archive pulled off a machine that never touches the internet. One honest limit: everything happens in memory, so RAM sets the ceiling — fine for everyday archives, but multi-gigabyte ones will struggle, and there is a hard size cap. ### Checked before it touches your disk An archive is a list of file names that someone else wrote — and nothing stops one of those names from being `../../.ssh/authorized_keys`. Extract that naively and it writes outside the folder you chose; this zip-slip trick has been catching real extractors for twenty years. Here, every entry's path is resolved before a single byte is written, and entries that try to escape are refused and listed by name, not silently dropped onto your disk. The declared uncompressed size is also added up first, so a decompression bomb — a 42 KB zip claiming to expand into petabytes — is caught before your disk is. ## Limits Does not repair damaged archives and does not create archives (use zip-create); password-protected archives are supported. ## FAQ ### Is my archive uploaded anywhere? No. Opening, decrypting and unpacking all happen in WebAssembly code running in your browser; no server ever sees the file. You don't have to take that on faith: open DevTools, switch to the Network tab, and extract an archive — no request carries your file. You can even load the page, go offline, and extraction keeps working. ### How big an archive can it handle, and why is my RAR slow? Everything runs in memory, so the limit is your device's RAM, not your disk — there is a hard size cap, hundreds of megabytes are usually fine on a desktop, and multi-gigabyte archives are where things get tight. Speed is a separate matter: solid RAR archives and some exotic 7z filters compress all files as one continuous stream, so pulling out even a single file forces the engine to decode everything before it. That slowness is a property of the format, not of the tool. ### Can it extract password-protected archives? That is what the password field is for: what you type is handed straight to the libarchive WebAssembly engine, which is the same code that decrypts zip, rar and 7z on the desktop, and it runs on your machine — the password is never transmitted, because there is no server to transmit it to. Being straight with you about how far that has been checked: the mechanism is wired up and a wrong password produces a clear error rather than corrupted files, but it has not yet been verified against a real encrypted archive of each type, and AES-256 zip in particular may not decode at all. The support matrix marks that row untested for exactly this reason. It is still the practical difference from the Archive Inspector next door, which does not attempt decryption at all. ### Why don't I see the option to extract into a folder? Writing directly into a folder you pick uses the File System Access API, which currently exists only in Chromium browsers — Chrome, Edge, Opera. Firefox and Safari don't implement it, so there you get the same result by a slower route: everything is repacked into one zip and downloaded. Same files, one extra unzip step. ### What happens if the archive contains something dangerous? Two specific attacks are checked before anything is written. Entries whose paths climb out of the target folder — the `../../.ssh/authorized_keys` trick — are refused and listed by name, so you can see exactly what the archive attempted. And the total declared uncompressed size is computed first, so a decompression bomb is rejected before it fills your memory. What this is not is malware scanning: an extracted file can still be malicious in its content, so treat the output of an untrusted archive with the same care as any download. ## Related tools - [Create ZIP](https://bytescope.dev/en/zip-create.md) — Zip a folder or dropped files in the browser, streamed to disk on Chromium. - [Archive Inspector](https://bytescope.dev/en/archive-inspector.md) — Look inside a zip, tar, 7z or rar without extracting it.