A RAR archive keeps an index of everything inside it, and that index is separate from the compressed data. File X-Ray reads the index directly in your browser, so you can see what an archive contains, who packed it and when, without extracting a single file and without the archive leaving your device.
Scan a RAR archive fileThe most useful thing to understand about RAR is what a password does and does not hide. Encrypting the contents protects the file data, but unless the person who made the archive also switched on header encryption, the index stays in clear text. A password-protected RAR therefore usually still announces every filename, every file size and every modification date it contains. File X-Ray reports whether the headers themselves are encrypted, so you can tell which of the two situations you are looking at.
The archive records the host operating system for each entry, and RAR built on Linux, macOS or BSD can carry a Unix ownership record: the owner name, the group name, and the numeric uid and gid. An owner name is an account name on the machine that created the archive, which is one of the more direct identity leaks in any container format.
Timestamps come with a subtlety worth knowing. RAR 5.0 stores modification times in UTC, but RAR 4.x stores them against the local clock of the machine that did the packing. File X-Ray reports which generation the archive is, so a 4.x timestamp can be read for what it is: evidence of the packer's local time zone as much as of the moment itself.
The scan also reports structural facts that matter when you are handed an archive: whether it is one part of a multi-volume set, whether it is solid (which means entries are compressed as a continuous stream and cannot be extracted independently), how many directories it declares, and whether the index walk stopped early because the file is truncated.
This is a selection. The full field manual documents the fields read from each format.
Yes. The index that lists names, sizes and dates is stored separately from the compressed data, so it can be read directly. File X-Ray does exactly that, in your browser.
Usually not. Encrypting the contents protects the file data but leaves the index readable, so the archive still lists what is inside it. Only if the person who created it also enabled header encryption are the names hidden too. The scan tells you which case you have.
The clearest is the Unix owner and group recorded by archives packed on Linux, macOS or BSD, because the owner name is an account name on that machine. Filenames themselves are often revealing, and RAR 4.x timestamps additionally indicate the packer's local time zone.
No, and the reason is worth stating plainly. The headers are documented well enough to edit, and this tool already reads them, but RAR compression is proprietary, so there is no way to open a rewritten copy and confirm it still extracts. Handing back an archive that might not open is worse than declining. RAR files are inspected here, not modified.
No. The index is parsed entirely in your browser and the file never leaves your device.
File X-Ray reads RAR archive files entirely in your browser - the file never leaves your device. This format is inspected, not modified. Scan a file now.