A ZIP archive (and a .jar, which is the same container) keeps a plain-text index of everything inside it, and that index is never compressed. So the names, sizes, folder structure and timestamps of every file are readable without extracting - or even decrypting - a single byte. That same central directory records which operating system built the archive and, on Unix, the exact account that created it.
Scan a ZIP fileThe headline is the file listing. File X-Ray walks the ZIP central directory and shows every entry's name and folder path, the number of entries and the total uncompressed size. Because the listing is stored uncompressed, it is readable even when the entries themselves are password protected - encryption hides the contents of a file, not its name. Folder names such as "2024 payroll" or "client contracts" describe what is inside without anyone opening it, and any name that looks sensitive on its own is flagged.
Two fields point back at the machine that made the archive. "Built On" reads the version-made-by byte on each entry to name the host operating system (MS-DOS/Windows FAT, Unix, macOS, Windows NTFS). On Unix-built archives, an Info-ZIP extra field can also carry the real numeric user and group id of the account that created it - uid 1000 is the primary user on a personal Linux box, and on a server these values identify a specific account. A __MACOSX folder, added by the macOS Finder's Compress command, confirms the archive was made on a Mac.
ZIP timestamps are unusually revealing about time zone. The standard modification date is stored in MS-DOS format, which has no time zone at all, so the value is the creator's local wall clock rather than UTC and hints at where they work. When present, the NTFS (0x000A) or extended-timestamp (0x5455) extra fields add high-precision creation and last-access times in UTC, dating when each file first existed and when it was last opened.
On the security side, File X-Ray reports whether any entries are encrypted and which scheme they use - strong WinZip AES versus the legacy ZipCrypto, which is weak and crackable. It also flags "unsafe paths": entries using absolute paths or ../ parent references. That is the Zip Slip pattern, which can write files outside the folder you extract into, and it can also leak the original absolute location the files came from.
This is a selection. The full field manual documents the fields read from each format.
The central directory holds the name, size and folder path of every entry, its modification timestamp, and the operating system that wrote it. Depending on how it was made it can also carry Unix user and group IDs, high-precision NTFS creation and access times, and the encryption scheme used - all readable without extracting anything.
Yes. The listing lives in the central directory, which is stored uncompressed and unencrypted. A ZIP password encrypts the contents of each file, not its name, size or timestamp, so the full listing is visible even for a locked archive. File X-Ray reads it entirely in your browser.
It can. Every entry records the host operating system, a __MACOSX folder shows it was zipped on a Mac in the Finder, and Unix-built archives may embed the creator's numeric user and group ID. The MS-DOS timestamps are also the creator's local clock, hinting at their time zone.
An entry whose name is an absolute path or uses ../ to point outside the extraction folder. When such an archive is unpacked carelessly it can overwrite files elsewhere on disk, which is the basis of directory-traversal attacks; the path can also leak the original absolute location of the files.
File X-Ray inspects a ZIP's metadata but does not strip it. Because filenames are inherent to a usable archive, the listing itself cannot be hidden in a plain ZIP (ZIP encrypts contents, not names). To reduce leakage, rename sensitive files before zipping, re-create the archive with a tool that omits extra fields (for example zip -X, which drops uid/gid and some timestamps), and avoid the Finder's Compress if you don't want the __MACOSX marker.
File X-Ray reads ZIP files entirely in your browser - the file never leaves your device. This format is inspected, not modified. Scan a file now.