Archive Inspector & Extractor Studio

No. Absolutely nothing is uploaded. All archive inspection, decompression, preview generation, repacking, and reporting happen 100% locally inside your browser memory using JavaScript and WebAssembly. You can monitor your browser's network tab to verify zero network transmission.

No. Solasu strictly avoids localStorage, sessionStorage, IndexedDB, OPFS, CacheStorage, and cookies for archive data. When you close the tab or reset the studio, all archive content, decrypted bytes, and session passwords are permanently erased from memory.

No. This tool is a structural forensic inspector, not an antivirus scanner. It observes metadata, binary signatures, path traversal indicators, and zip bomb ratios. It does not scan virus signature databases or execute binaries, and it does not certify any archive or file as malware-free.

Solasu supports standard ZIP (.zip), ZIP64 (archives over 4GB or with more than 65,535 files), TAR (.tar, supporting POSIX ustar, PAX extended headers, and GNU long names), GZIP (.gz), and combined TAR.GZ (.tar.gz / .tgz).

Solasu identifies 7z and RAR magic header signatures, but intentionally does not support extracting them. To maintain strict integrity and avoid vulnerabilities in unofficial JavaScript parsers, Solasu honestly explains the format detection and recommends using trusted native utilities.

A Path Traversal attack occurs when an archive includes relative directory escape sequences such as '../../' in filenames. When extracted by vulnerable software, files are written outside the intended target directory, potentially overwriting critical system files. Solasu flags these as high-severity observations and neutralizes them during extraction.

On Windows operating systems, names like CON, PRN, AUX, NUL, COM1-COM9, and LPT1-LPT9 represent physical hardware devices rather than normal files. Creating files with these names can cause system hangs or fatal file-system errors. Solasu detects reserved names and safely sanitizes or excludes them.

A Zip Bomb is an archive with an astronomical expansion ratio—for example, a 50 KB archive that decompresses into hundreds of gigabytes or terabytes of zeroes, crashing disk space and RAM. Solasu compares uncompressed and compressed size headers before extraction and warns you if the ratio exceeds safe thresholds (e.g. 100x).

Yes. Solasu supports decrypting password-protected entries for in-browser preview and selective extraction. When you open an encrypted entry, a secure password modal appears. Passwords remain exclusively in temporary browser memory for the current session.

ZipCrypto is the traditional encryption method defined in original PKWARE specifications. It is cryptographically weak and easily broken with modern known-plaintext attack tools. WinZip AES uses AES-128/192/256-bit encryption with PBKDF2 key derivation and HMAC-SHA1 authentication. Solasu highlights this difference and warns when ZipCrypto is detected.

For WinZip AES, the authentication code (MAC) is verified prior to releasing data. For ZipCrypto, the full decompression and CRC32 checksum are verified. If the password is wrong or authentication fails, Solasu immediately aborts and displays an error without exposing corrupted or arbitrary plaintext.

A Clean ZIP is a sanitized archive generated by Solasu that excludes risky entries such as path traversal sequences, absolute root paths, Windows reserved device names, and NULL bytes. Solasu produces a detailed audit log showing every excluded entry and the exact security reason for exclusion.

The Repack feature allows you to bundle selected or sanitized files into a new ZIP archive directly in your browser. You can optionally apply modern WinZip AES-256 password protection. Solasu displays a transparency notice outlining that POSIX file permissions and extended filesystem attributes are normalized during repacking.

Yes. HTML and JavaScript files are rendered purely as plain text in an isolated container without executing scripts. SVG images have scripts, event handlers, and javascript: links stripped before display. Previews are capped at 1MB to prevent browser DOM hanging.

Shannon entropy measures data randomness on a scale from 0 to 8 bits per byte. Plain uncompressed text generally scores between 3 and 5 bits, while uniformly compressed or encrypted payloads score close to 7.8 to 8.0 bits. It provides an objective heuristic regarding whether file contents are compressed, encrypted, or obfuscated.

Solasu compares file byte checksums (CRC32 and SHA-256) across all entries in the archive. If two or more entries have identical hashes, they are grouped as duplicate files, allowing you to identify wasted storage space regardless of different file names or folder paths.

Different operating systems handle filenames differently: macOS uses Unicode NFD, while Linux and Windows use NFC. Furthermore, Windows and macOS filesystems are case-insensitive ('Report.txt' and 'report.txt' collide). Solasu detects these collisions in advance and appends safe numeric suffixes (-2, -3) during extraction to prevent accidental overwriting.

Solasu enforces strict client-side safety limits: maximum archive input size is 500 MB, maximum total uncompressed expanded size is 2 GB, and maximum entry count is 100,000 files. These limits protect your browser tab and device memory from crashing.

You can export audit reports in machine-readable JSON (with prototype pollution guards), spreadsheet CSV (with formula injection escaping), Markdown (for CI/CD logs and pull request documentation), and formal A4 PDF.

To ensure that exported PDF reports are structurally valid and render correctly on any device, Solasu immediately loads the generated PDF binary into an embedded instance of the open-source Mozilla PDF.js engine to verify page count, text layers, and title elements before offering the download.

Yes. It is completely free with no registration, no account creation, and no subscription fees. It can be used freely for both commercial and personal forensic inspection tasks.