Free while we’re in preview

Get ZipDock

Look inside an archive someone sent you before you unpack it.

The Mac button is for Apple Silicon. On an older Intel Mac, get this one instead.

One file, both ways. Double-click it for the window. Run the same file from a command prompt with arguments and it behaves as the command-line tool, because the engine is inside it. Nothing else to download and nothing to keep beside it.

Early preview. The window has been built and run, but not yet on a real Windows PC or Mac, so expect rough edges. The engine underneath it is fully tested.

One file — no installer
Runs on your machine, offline
Source code published below

Free while in preview. It isn’t signed yet, so Windows or macOS will ask you to confirm the first time you open it. At launch, ZipDock is included in every plan along with the rest of the range.

Somebody sent you an archive

Before you unzip it into your home directory or onto a build server, you’d like to know what’s in there and whether unpacking will hurt. zipdock scan incoming.zip answers that without unpacking anything.

Five named checks, each PASS, WARN or FAIL. Zip bomb: any entry, or the archive as a whole, past --max-ratio (default 100) or --max-total (default 1 GiB). Path traversal: .. segments, absolute paths, Windows drive letters, the zip slip class of bug. Symlink members whose target resolves outside the archive. Name collisions, including two entries differing only in letter case, which collide on Windows and macOS. Suspicious names, from control characters to reserved device names like CON and NUL. Exit 2 on any FAIL, so zipdock scan x.zip && unzip x.zip becomes a usable habit.

Verifying without writing

zipdock verify streams each zip entry through a CRC32 and discards the bytes, comparing against the CRC in the central directory and naming any entry that disagrees. Format detection is by magic bytes, never extension, so a zip renamed .tar is still read as a zip.

The obvious limit

There is no extract command and no flag that turns one on. No 7z, rar or xz, no encrypted-zip handling, and no recursion into a zip inside a zip.

Reading on the job itself

How to password-protect a folder of files Make sure it is AES-256 and not the legacy ZipCrypto, use a long passphrase rather than a clever short one,...

The rest of Archive Vault

Archives, and knowing what is in one before you open it. Look inside safely, lock one with a password, split a big one, put a folder into storage.

VaultZip

Simple Ready

Turns a folder into one password-locked file, with a fingerprint for every file inside.

ArchiveGuard

Pro Ready

Shreds your originals only after proving the encrypted copy reads back byte for byte.

PackSafe

Team Ready

Split a big archive into volumes, then prove later which piece went bad.

Advanced & technical details Command-line builds, source code, checksums and a recorded session — for developers and IT teams

A working CLI prototype of the archive inspector: auto-detects zip/tar/gz/bz2 from magic bytes, lists entries without extracting, verifies every stored CRC32 by streaming decompression, and scans for the things that make opening a stranger's archive dangerous — zip bombs, path-traversal (“zip slip”) entries, escaping symlinks and name collisions. Verified against a real 1030:1 bomb and a single flipped byte, both corroborated by Info-ZIP. Extraction and 7z/rar are on the roadmap.

Recorded session

Recorded terminal session showing ZipDock running — A real recorded session — ZipDock’s actual output, captured by running the shipped binary.

Naming status

Working name only — brand verdict **RENAME** (Medium-High). Collision: ZipDock. Rename before investing heavily.

What it draws on

Existing paid software whose best ideas shaped this program: WinRAR, WinZip, Folder Lock, O&O SafeErase.

Command line

There is nothing extra to install. The program you download is the command-line tool as well: give it arguments instead of double-clicking it and it runs as one, with its output on your terminal. The standalone builds below are the same engine on its own, for machines where you would rather not ship a window at all.

zipdock - read-only archive inspector and safety scanner (Techlosoft Archive Vault)

USAGE
  zipdock <command> <archive> [options]

COMMANDS
  info    <archive> [--json]
          Auto-detect the format from magic bytes and summarise the archive:
          format, entry count, total compressed and uncompressed size, ratio.

  list    <archive> [--json]
          List every entry: path, compressed and uncompressed size, per-entry
          ratio, modified time and directory flag. For zip, also the stored
          CRC32 and the compression method name.

  scan    <archive> [--max-ratio N] [--max-total SIZE] [--json]
          Safety report. Each check reports PASS, WARN or FAIL:
            ZIP BOMB         entry or archive ratio over --max-ratio, or total
                             uncompressed size over --max-total
            PATH TRAVERSAL   ".." segments, absolute paths, drive letters
            SYMLINK ENTRIES  tar symlinks/hardlinks, especially escaping ones
            NAME COLLISIONS  duplicate paths, including case-insensitive ones
            SUSPICIOUS NAMES control characters, trailing dot/space, reserved
                             Windows device names
          Exits 2 if any check FAILs.

  verify  <archive> [--json]
          zip:  decompress every entry to a hash and compare the actual CRC32
                against the value in the central directory.
          gzip: validate the trailing CRC32 and ISIZE.
          tar:  validate structure and declared sizes (tar has no content
                checksum), plus the container CRC for .tar.gz / .tar.bz2.
          Nothing is ever written to disk. Exits 2 on any mismatch.

OPTIONS
  --json               machine-readable output
  --max-ratio N        maximum uncompressed:compressed ratio (default 100)
  --max-total SIZE     maximum total uncompressed size (default 1GiB);
                       accepts 500, 500B, 64K, 10MB, 2GiB
  -h, --help, help     this text
...

Recorded from the shipped binary, not written by hand.

Windows (amd64) macOS (Apple Silicon) macOS (Intel) Linux (amd64)

Source

Every file the program is built from:

console.go · console_test.go · guided.go · main.go

SHA-256 checksums · build instructions & scope notes · full build plan

ZipDock

Preview