How to zip and unzip files

Bundle several files into one, or open an archive on a machine where you cannot install anything.

A ZIP holds several files as one, usually compressed. Useful for sending a folder as a single attachment, and for opening archives on a locked-down computer.

Step-by-step

1. To zip: add your files, choose a compression level, download.
2. To unzip: add the archive, see the contents listed, extract what you need.

What compresses and what does not

Compression finds repetition. Text, spreadsheets and uncompressed images have plenty and shrink dramatically — often to a quarter of their size or less.

JPEGs, PNGs, MP4s, MP3s and PDFs are already compressed. Zipping them saves almost nothing, and occasionally adds a few bytes. If you are zipping a folder of photographs to make it smaller, it will not work — zip them for convenience, by all means, but expect the size to stay roughly the same.

Compression level

Higher levels are slower for a modest gain. The default is a sensible balance; maximum compression is worth it only for large text-heavy archives you will send repeatedly.

Encrypted ZIPs

Legacy ZIP password protection is broken and has been for decades — it is trivially removed with widely available tools. If you need a bundle to be genuinely private, zip it and then encrypt the archive, which uses AES-256-GCM with a properly derived key.

A ZIP does not hide what is inside it

Worth knowing before relying on one for anything sensitive: standard ZIP encryption protects the contents of the files and not the listing. The central directory — every file name, every uncompressed size, every timestamp — stays readable without the password.

So an encrypted archive of resignation-letter.docx and job-offer-northwind.pdf reveals a great deal to anyone who receives it, password or not. If the names themselves are the sensitive part, the fix is to put the archive inside another encrypted container, or to encrypt the file rather than the folder. Renaming the contents to something meaningless before zipping also works and is often simpler.

Paths travel with the files

An archive stores each entry's path, not just its name, which is what lets a folder structure survive the round trip. It also means the paths are attacker-controlled data in any archive you did not create yourself, and extraction tools have historically been willing to follow them out of the destination folder — entries beginning with a slash, or containing ../ repeated enough times to climb out and overwrite something else.

Modern extractors defend against this, but it is the reason to be wary of extracting an untrusted archive into a directory that matters rather than into an empty one you can inspect. The related, much more common annoyance is character encoding: file names were historically stored without recording which encoding they used, which is why an archive made on one system can extract elsewhere with accented characters mangled. Sticking to plain ASCII names for anything crossing platforms avoids it entirely.

Frequently asked questions

Are my files uploaded?

No. Archives are created and extracted in your browser.

Why did my photo folder barely compress?

JPEG and PNG are already compressed formats. ZIP finds little further repetition, so the archive is about the same size as the originals.

Can it open password-protected archives?

Standard archives are supported. For genuine confidentiality, encrypt the archive with the file encryption tool rather than relying on ZIP's own password feature, which is not secure.