Unzip a file
Open a ZIP and see what is inside before anything is unpacked: in the example, the archive holds hola.txt at 10 bytes and b.csv at 7 bytes. List names, sizes and dates, or extract everything with its folders intact. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Runs in your browser. Free, unlimited — your data never leaves this page.
Send a ZIP archive and get back a structured listing of every file and folder inside it, or the extracted contents themselves, without ever unzipping anything on your own servers. It's built for pipelines that receive archives from users, partners or storage buckets and need to know what's inside before deciding what to do with it.
A ZIP file is a closed box until you open it
Archives arrive from users, partners and storage folders, and nobody can tell what they contain just by looking at the name. Opening an untrusted archive directly on the machine that runs your application is how zip bombs and files with paths that escape their folder end up in an incident report. Here the archive is inspected in an isolated place. You can ask only for the list, with each file's name, size, compression ratio and date, and decide afterwards: a plugin marketplace, for instance, can reject an upload that contains executable files or paths outside the expected folder before a single file is unpacked.
An old format that hides everywhere
The ZIP format dates back to 1989 and PKWARE's PKZIP, designed to squeeze files into the limited space of floppy disks. It became a de facto standard because its specification was open and any tool could implement it, which is why it now turns up in places people do not expect: office documents are ZIP archives inside, and so are Android apps, Java packages and game mods. When you extract, you can take everything or only selected paths, and the folder layout and dates come out as they were. Typical uses are pulling hundreds of product images out of one supplier archive, or unpacking a site export so a migration can read the individual files.
Why archives are a liability, not a convenience
A ZIP file is a black box until you open it, and opening untrusted archives on production infrastructure is how zip bombs and path-traversal exploits ('zip slip') end up on the front page of an incident report. Teams that accept user uploads — CMS media libraries, plugin marketplaces, bulk import tools — need a way to inspect and extract archive contents in an isolated environment, so a malformed or malicious file never touches the machine running your application code.
What you can do with it
Plugin and theme marketplaces
Inspect the file list of an uploaded plugin ZIP before extraction to reject anything with executable files or suspicious paths outside the expected folder.
Bulk media imports
Extract hundreds of product images from a single vendor-supplied archive and route each one straight into a resize or watermark task.
Backup and migration tooling
Unpack a site or database export archive server-side so a migration script can read individual files without ever writing the raw ZIP to disk.
FAQ
Can I just list the contents without extracting?
Yes, set the operation to list to get file names, sizes and timestamps without unpacking anything, which is useful for validating an archive before committing to full extraction.
What happens if the ZIP is corrupted or password-protected?
The task fails cleanly with a descriptive error after a limited number of retries, and a failed task is never charged.
Is my uploaded archive kept after processing?
No, archives and their extracted contents are deleted after the retention window and are never used for training.
Why should I look inside a ZIP before extracting it?
Because an archive from a stranger can hide a zip bomb or files whose paths try to escape their folder. The listing shows every name, size and compression ratio first, so you can refuse executable files or suspicious paths before anything is unpacked.
Is the folder structure kept when the files are extracted?
Yes. Folders, the original timestamps and the permission details are preserved, so whatever reads the files next can rebuild the archive's layout exactly instead of receiving a flat pile of files.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/data/unzip \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"zip":"https://ejemplo.com/archivo.zip"}'const res = await fetch("https://api.kit.forhosting.com/data/unzip", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"zip": "https://ejemplo.com/archivo.zip"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/data/unzip",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"zip": "https://ejemplo.com/archivo.zip"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/data/unzip", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"zip":"https://ejemplo.com/archivo.zip"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"zip":"https://ejemplo.com/archivo.zip"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/data/unzip", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"zip": "https://ejemplo.com/archivo.zip"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "data.unzip",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_mb | 25 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
What the endpoint actually does
POST /data/unzip accepts an archive by upload or by URL and an operation flag: list to return file names, sizes, compression ratios and timestamps without extracting anything, or extract to unpack selected paths (or everything) and return the results as individual files behind signed links, or bundled into a fresh archive. The call returns a task_id immediately; the real work happens asynchronously.
A short history of a very old format
The ZIP format dates back to 1989 and PKWARE's PKZIP, designed to squeeze floppy-disk-era files into less space. It became a de facto standard because it's an open specification that any tool could implement, which is exactly why it now shows up everywhere from Office documents (which are ZIPs internally) to Android APKs, Java JARs and game mod packages — our unzip endpoint handles the same DEFLATE-based entries those formats rely on.
What to expect from the response
Directory structure, file permissions metadata and original timestamps are preserved in the response so downstream code can rebuild the archive's layout exactly. Listing a 500-entry archive and extracting three specific files from it typically finishes in well under a second of actual processing time once the task starts; delivery timing depends on whether you're polling, waiting on a webhook, or fetching the signed result link, which stays valid for 24 hours.
Where it fits in a bigger workflow
This is one step, not a whole pipeline: pair it with our conversion and file-processing endpoints to, say, unzip a theme package, validate each file's type, then hand images to a resize task and stylesheets to a minifier — all triggered off the same webhook chain.
Integration use cases
User-submitted data sets
List the contents of a ZIP submitted through a public form to confirm it contains only the expected CSV or JSON files before further processing.
Technical questions
How do I extract a ZIP file using the API?
Send a POST request to /data/unzip with the archive as an upload or a URL and set the operation to extract; you'll get a task_id and the extracted files arrive via webhook or a signed link.
Is there a free tier for the unzip API?
The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.
How much does the unzip endpoint cost?
It's $0.002 per request regardless of how many files the archive contains, so listing or extracting a 2-file or 2,000-file archive costs the same.
Does it support nested ZIPs, like an archive inside an archive?
The endpoint extracts the top-level archive; if an entry is itself a ZIP, you can pass it back through the same endpoint as a second call.
How long are extracted files available for download?
Signed result links are valid for 24 hours, and we recommend a webhook for anything you need to process immediately or store permanently.