bitpeek
  1. Bitpeek
  2. File formats
  3. ZIP file format

ZIP File Header and Magic Bytes

A typical ZIP archive begins with a local file header and ends with a central directory plus an end record. Multi-byte numeric fields use little-endian byte order.

Inspect a ZIP file Local processing notes

ZIP local file header signature

50 4B 03 04

These are the on-disk bytes for the 32-bit value 0x04034B50. Most archives begin with this local header, although prefixed or self-extracting archives can place other data before it.

Local file header fields

OffsetLengthField
0x004Local header signature
0x042Version needed to extract
0x062General-purpose bit flags
0x082Compression method
0x0A2Last modification time
0x0C2Last modification date
0x0E4CRC-32
0x124Compressed size
0x164Uncompressed size
0x1A2File name length
0x1C2Extra field length
0x1EVariableFile name, extra field, then file data

Central directory and end records

Central-directory file headers use 50 4B 01 02. The classic End of Central Directory record uses 50 4B 05 06 and stores the entry count, central-directory size and offset, plus an optional archive comment.

ZIP64 archives add ZIP64 end records and locators when classic 16- or 32-bit fields cannot represent the actual values. Do not assume a zero or maximum placeholder is the final size without checking ZIP64 metadata.

Practical ZIP inspection checks

  • Interpret fixed numeric fields as little-endian.
  • Calculate the payload start as 30 + file-name length + extra-field length from the local header start.
  • Check general-purpose bit 3 before relying on CRC and sizes in the local header; a trailing data descriptor may carry them.
  • Remember that JAR, APK, DOCX, XLSX, PPTX, EPUB, and other formats can use ZIP as a container.
  • Use a hardened archive library before extracting untrusted names or payloads.

Local processing and privacy

The ZIP file format workflow opens the same Bitpeek browser workspace. Selected file bytes, file names, pasted input, searches, edits, hashes, and comparison data are processed in local browser memory and are not sent to a Bitpeek server.

The static guide itself can be read without opening a file or creating an account.

Technical reference: PKWARE .ZIP Application Note.

Frequently asked questions

Is every file starting with PK a ZIP archive?

No. The bytes are a format clue. Confirm the complete record structure and central directory before treating the file as a valid archive.

Why can local-header sizes be zero?

When general-purpose bit 3 is set, CRC and size values can follow the compressed data in a data descriptor instead of being known when the local header is written.

Does ZIP always start at offset 0?

Typical archives do, but self-extracting and deliberately prefixed files can place other bytes before the first ZIP record.