Sample ZIP file: free download
What is a ZIP file?
A ZIP file is an archive of individually compressed files, specified in PKWARE's APPNOTE. Each entry has a local header beginning PK (50 4B 03 04), and a central directory at the end lists every entry. DOCX, XLSX, EPUB and JAR files are ZIP archives inside.
ZIP archives for extraction, upload and security testing. They cover clean archives plus the classic attacks: path traversal (Zip Slip), absolute paths, deep nesting and a safe, small zip bomb.
Need a specific size?
Opens the generator with the size filled in. Click Generate and the file is built in your browser: nothing is uploaded, and no sign-up.
17 ready-made ZIP test files
| File | Size | What it catches | Download |
|---|---|---|---|
| empty.zip | 22 bytes | Import flows that assume at least one entry and throw on an empty iterator, or report success having processed nothing. | download |
| absolute-path.zip | 161 bytes | The less-tested cousin of Zip Slip. Extractors must strip leading slashes and drive letters rather than honouring an absolute destination. | download |
| corrupt-central-directory.zip | 219 bytes | Readers that trust the central directory blindly and crash, versus tolerant ones that can recover entries by scanning local headers. | download |
| zip-slip-traversal.zip | 357 bytes | Extractors that join the entry name to the destination without normalising and re-checking containment (Zip Slip, CVE-2018-1002200 and dozens of siblings). A correct extractor rejects this entry; a vulnerable one writes outside the target directory. | download |
| valid-flat.zip | 376 bytes | Baseline extraction check. | download |
| valid-nested-dirs.zip | 390 bytes | Extractors that fail to create intermediate directories, and Windows targets where the expanded path exceeds MAX_PATH (260 chars). | download |
| empty-directory.zip | 395 bytes | Round-tripping. Extract this and re-zip it and most tools lose "empty-on-purpose" entirely, because they rebuild the archive from the files they found and an empty directory contains none. It is the standard way a backup or a sync client quietly drops a directory the application depended on existing. | download |
| case-collision-dirs.zip | 486 bytes | Case sensitivity, at the directory level rather than the file level. On Linux you get two directories and two files. On Windows and default macOS the two merge into one directory holding both files, so a build that works on a developer laptop and fails in CI (or the reverse) has usually hit exactly this. | download |
| unicode-entry-names.zip | 563 bytes | Extractors that ignore the UTF-8 flag and fall back to CP437, producing mojibake filenames - still common on Windows. | download |
| separator-confusion.zip | 662 bytes | Separator handling. The ZIP spec makes "/" the only separator, so the backslash entry is one file whose name contains a backslash. Many extractors, including Python zipfile, treat it as a separator and hand you a directory instead. The doubled slash and the "." segment are the ones that let a path-traversal check be bypassed by normalising after validating rather than before. | download |
| explicit-dir-entries.zip | 868 bytes | Extractors that build directories only from file paths and ignore directory records, and any code that counts "files in the archive" without filtering out the directory entries. The entry count here is 7 but only 3 are files, so a naive count is wrong by more than double. | download |
| nested-10-deep.zip | 1.2 KB | Recursive scanners (antivirus, content indexers, import jobs) with no depth limit. A bounded extractor should stop at a configured depth and report it, not recurse forever. | download |
| reserved-and-awkward-dirs.zip | 1.3 KB | Reserved names used as DIRECTORIES rather than files, which is the case most sanitisers forget, and the two do not even fail the same way. On Windows, creating a directory called CON fails outright with error 267. Creating one called NUL reports SUCCESS and creates nothing at all, so an extractor that only checks the return value believes it worked. Trailing dots and spaces are a third case: the call succeeds and Windows hands back the trimmed name, so "trailing-dot." and "trailing-dot" become one directory. | download |
| unicode-dir-names.zip | 1.6 KB | Multibyte path handling. Each Japanese character is three bytes in UTF-8 and each emoji is four, so these names are far longer in bytes than in characters, which is what a 255-byte limit actually measures. The two cafe directories are byte-different and look identical: on macOS they may collide into one, on Linux they stay separate, and a path comparison between them fails on every platform unless you normalise first. | download |
| deep-path-over-260.zip | 11.1 KB | The Windows path limit, which is lower for directories than for files. Without long-path support a process can create a file at a 259-character path but a directory only at 247, because MAX_PATH reserves twelve characters for an 8.3 name inside it. Extraction therefore fails while creating a folder rather than while writing a file, and leaves a half-extracted tree. Linux (4096 bytes) and macOS (1024 bytes) take this without complaint, so it only reproduces on Windows. | download |
| modest-zip-bomb.zip | 996 KB | Extraction with no output-size cap or compression-ratio check. Your extractor should abort once the decompressed total crosses a threshold, rather than filling the disk. Expansion ratio ~1000:1. | download |
| mixed-content-50mb.zip | 40.0 MB | Progress reporting that extrapolates from compressed bytes, and memory use in extractors that buffer whole entries instead of streaming. | download |
Every file is generated from source (no third-party copyright) and each has its own page with a published SHA-256 you can verify after download.
Questions
What is Zip Slip?
A path-traversal attack where an archive entry is named ../../etc/passwd, so a naive extractor writes outside the target directory. The Zip Slip file below contains such an entry so you can prove your extractor rejects it.
Is the zip bomb safe to download?
Yes. It is a deliberately modest one: it expands enough to prove your limits work without being able to fill a disk.
Why do DOCX and XLSX look like ZIP files?
Because they are. Every OOXML and OpenDocument file is a ZIP of XML parts, so they all begin with the same PK signature. See the file signatures reference for how to tell them apart.