ZIP Format: The Complete Guide to ZIP Archives and Compression

What Is ZIP?

ZIP is the world's most ubiquitous archive format, created by Phil Katz and Gary Conway in 1989 and published in the PKZIP Application Note — one of the most referenced format specifications in computing history. ZIP archives can contain one or more files and directories, each independently compressed, along with a central directory at the end of the file that enables random access to individual members without decompressing the entire archive.

The format is maintained by PKWARE, Inc. and documented in the Application Note (APPNOTE.TXT), which is freely available and has been updated dozens of times since 1989, adding features like ZIP64 (files over 4 GB), AES encryption, and streaming support.

Binary Structure

A ZIP file has three main sections:

[Local file header 1] [File data 1]
[Local file header 2] [File data 2]
...
[Local file header N] [File data N]
[Data descriptor (optional, for streaming)]
[Central directory]
[End of central directory record]

Local File Header (30 bytes + variable)

Each compressed member begins with a local file header:

Offset  Length  Description
0       4       Signature: 0x04034b50 ("PK\x03\x04")
4       2       Version needed to extract (minimum)
6       2       General purpose bit flag
8       2       Compression method (0=store, 8=deflate)
10      4       Last modification time (MS-DOS format)
14      4       Last modification date (MS-DOS format)
18      4       CRC-32 of uncompressed data
22      4       Compressed size
26      4       Uncompressed size
30      2       File name length
32      2       Extra field length
34      variable  File name (UTF-8 if bit 11 of flags is set)
        variable  Extra field (extensible area for ZIP64, Unicode, timestamps)
        variable  File data (compressed)

The magic bytes PK at offset 0 are the initials of Phil Katz, the format's inventor.

Central Directory

The central directory at the end of the file contains one record per archive member, mirroring the local header information plus additional metadata:

Offset  Length  Description
0       4       Signature: 0x02014b50 ("PK\x01\x02")
4       2       Version made by
6       2       Version needed to extract
...
42      2       File comment length
44      variable  File name
        variable  Extra field
        variable  File comment

The central directory enables efficient random access: to extract only config.json from a 10 GB archive, the application reads only the central directory (typically a few KB at the end), locates the offset of config.json's local header, seeks to that position, and decompresses only that member.

End of Central Directory Record

The final 22 bytes (minimum) of a ZIP file:

Signature:          0x06054b50 ("PK\x05\x06")
Disk number:        (for multi-disk archives)
Start disk:         disk where central directory begins
Entries on disk:    count of central directory entries on this disk
Total entries:      total central directory entries
Size of CD:         size of central directory in bytes
Offset of CD:       offset of central directory from start of disk
Comment length:     (variable comment follows)

Compression Methods

ZIP supports multiple compression methods, identified by a 2-byte code in each local header:

Deflate (method 8) is by far the most widely supported and used method. It uses LZ77 for duplicate string elimination followed by Huffman coding for entropy compression, providing a good balance of speed and compression ratio.

ZIP64

The original ZIP specification used 32-bit integers for file sizes and offsets, limiting:

• Individual file size to 4,294,967,295 bytes (≈ 4 GB)
• Archive total size to 4 GB
• Number of entries to 65,535

ZIP64 extensions (introduced in PKZIP 4.5, 2001) use 64-bit integers stored in extra field records, removing all three limits. Modern archives containing files over 4 GB automatically use ZIP64 extensions. The ZIP64 End of Central Directory record has its own signature (0x06064b50).

Encryption

ZIP supports two encryption schemes:

Legacy ZipCrypto (also called "traditional" or "PKWARE" encryption):

• Available since 1989
• Uses a stream cipher with a 96-bit key derived from the password
• Cryptographically weak: vulnerable to known-plaintext attacks; do not use for sensitive data
• Still widely supported by all ZIP tools

AES Encryption (WinZip/PKWARE AES extension, Compression Method 99):

• Uses AES-128 or AES-256 in Counter (CTR) mode
• Password-derived key via PBKDF2 with 1000 iterations of HMAC-SHA1
• Authentication via HMAC-SHA1 of compressed data
• Not supported by all tools (notably, Windows built-in ZIP does not support AES; it uses ZipCrypto)
• Strongly recommended over ZipCrypto for any sensitive content

Important limitation: Even with encryption, file names and archive structure are visible without the password in standard ZIP. Only the file data is encrypted. 7-Zip's 7Z format can encrypt headers (file names) — ZIP cannot.

ZIP vs. Other Archive Formats

Self-Extracting Archives (SFX)

A self-extracting ZIP is an executable file (.exe on Windows, .sh on Unix) with a ZIP archive appended to the executable stub. The stub extracts the archive when run. ZIP's central directory approach (locating the archive structure from the end of the file) makes this work seamlessly — the stub code is simply ignored during normal ZIP parsing.

Streaming and Data Descriptors

When writing a ZIP to a streaming destination (network socket, tape drive), the sizes and CRC-32 of a file may not be known until after compression. In this case:

• Sizes and CRC-32 in the local header are set to zero
• A data descriptor record follows the compressed data, containing the actual CRC-32 and sizes
• Bit 3 of the general purpose bit flag signals this streaming mode

ZIP in Modern Usage

ZIP remains the foundation of many "container" formats:

• DOCX, XLSX, PPTX — Office Open XML (OOXML)
• ODT, ODS, ODP — OpenDocument Format (ODF)
• EPUB — Electronic publication e-books
• JAR — Java archives
• APK — Android application packages
• AAR — Android library archives
• XPI — Firefox browser extensions
• VSIX — Visual Studio extensions
• CBZ — Comic book archives

This widespread adoption means ZIP support is baked into virtually every operating system and programming language ecosystem.

Converting and Working with ZIP

Creating ZIP archives:

• Windows: Right-click → Send to → Compressed (zipped) folder
• macOS: Right-click → Compress
• Linux: zip -r archive.zip directory/
• Python: zipfile module (standard library)
• Node.js: archiver, jszip packages

Extracting:

• Windows/macOS/Linux: Built-in extraction or 7-Zip, WinRAR, The Unarchiver
• Command line: unzip archive.zip
• Python: zipfile.ZipFile('archive.zip').extractall()

ZIP → 7Z: 7-Zip can recompress ZIP to 7Z with significantly better ratios, especially for multi-file archives. The trade-off is reduced compatibility (7Z is not natively supported on all platforms).

ZIP → TAR.GZ: Useful when deploying to Linux servers. TAR preserves Unix file permissions and symlinks that ZIP may not handle correctly.

Security Considerations

• Zip slip attack: Malicious archives containing paths like ../../etc/passwd can overwrite files outside the intended extraction directory. Always use extraction libraries that validate paths.
• Password security: ZipCrypto passwords provide very weak protection and should never be used for sensitive data. Use AES-256 encryption if the tool supports it.
• Archive bombs: Deeply nested or highly repetitive content can expand to enormous sizes (e.g., a 42 KB "42.zip" that expands to 4.5 PB). Check compression ratios before extracting untrusted archives.

Summary

ZIP is 35+ years old and still the world's default archive format, embedded in operating systems and serving as the container layer for the most important document formats in use today. Its central directory design enables efficient random access, its open specification ensures universal implementation, and its balance of compression and speed makes it practical for everyday use. For maximum compression, 7Z or Brotli are superior; for maximum compatibility, nothing beats ZIP.

Related conversions

Archive format conversions used most often:

• RAR to ZIP
• 7Z to ZIP
• TAR to ZIP
• GZ to ZIP
• ZIP to RAR
• ISO to ZIP