Is it safe to open this archive? A practical checklist
Haven Zip team · · 2 min read
Attachments arrive as archives for two honest reasons and one dishonest one. Honest: to bundle several files, or to get past a size limit. Dishonest: to get past a mail scanner. An archive is opaque to most filters, and a password makes it fully opaque. The good news is that looking inside an archive is not the same as running what is inside it, and looking is enough to catch nearly everything.
Look before you extract
Open the archive in a viewer that lists the contents without writing anything to disk. Haven Zip does this in the browser: the file tree is built in memory and nothing is extracted until you ask. Read the names and sizes. What you are looking for:
- Double extensions such as invoice.pdf.exe, photo.jpg.scr or document.docx.js. The last extension is the real one.
- Executables where documents were promised: .exe, .scr, .bat, .cmd, .js, .vbs, .hta, .lnk, .msi, .jar.
- A single tiny file with a huge uncompressed size. A 40 KB archive that claims to hold 4 GB is a zip bomb designed to fill your disk or crash a scanner.
- Archives inside archives, especially several levels deep. Legitimate senders rarely nest; malware does it to exhaust scanners.
- Paths that climb out of the folder, like ../../Windows/Start Menu. Modern extractors block these; the presence of one tells you the intent.
Password-protected attachments
A password in the same email as the archive protects nothing against you and everything against your mail provider's scanner. This exact pattern, an encrypted ZIP with the password in the message body, has been the delivery method for banking trojans for years. If you did not arrange the password with the sender in advance, treat the attachment as hostile.
Preview instead of extracting
Text, images, PDFs and code can be previewed inside the archive viewer without being written to disk or opened by the application that normally handles them. That removes the risk of a document that exploits its own reader. Only extract files you have identified, and only the ones you need.
Because Haven Zip runs entirely in the browser, extracting to your Downloads folder also does not execute anything; a file becomes dangerous only when you run it. For anything executable that you did not expect, the answer is to delete it and ask the sender through a channel you trust.