TAR Inspector
Reads the 512-byte headers inside a tar archive and shows you the whole manifest before you unpack anything: the path of every entry, whether it is a file, directory, symlink or hard link, the Unix permission bits in both rwx and octal form, the owner and group as names and numbers, the size, the modification time and, for links, where they point. It handles the formats tar actually writes rather than only the simplest one — plain v7, POSIX ustar with its 155-byte prefix field, GNU long-name headers, and PAX extended headers, which override the fixed-width fields with UTF-8 values and are how a path longer than 255 bytes or a fractional timestamp survives at all. The header checksum in each block is verified, so a corrupted or non-tar file is rejected instead of producing a plausible-looking list of nonsense, and an archive that was cut short mid-header is reported rather than silently listed as short. The reason to look before extracting is that tar entries can name paths outside the directory you are standing in. An entry with a leading slash, a path containing .., or a symlink pointing at an absolute path can drop files somewhere you did not intend; GNU tar strips the first two and warns, but plenty of extraction code in other languages does not. Those are flagged, as is the archive that unpacks into more than one top-level entry and scatters its contents over your working directory. Everything runs in your browser — the archive is never uploaded.
How to use
- Drop a .tar, .tar.gz or .tgz file onto the box, or click it to pick one. Gzipped archives are decompressed in the browser first.
- Read the format line to see which flavour of tar wrote it — v7, ustar, gnu or pax — since that determines which fields are trustworthy.
- Scan the table for the entry you care about: permissions and owner are shown exactly as tar -tv would print them.
- Check anything highlighted in amber before extracting; those entries can write outside the directory you unpack into.
- If the file is rejected, the header checksum failed — the archive is corrupt, truncated, or not a tar at all.
Frequently asked questions
- Why does a tar file need a checksum if it is not compressed?
- Every 512-byte header carries a simple sum of its own bytes, computed with the checksum field itself treated as spaces. It is not a strong integrity check and it covers only the header, not the file contents, but it is enough to tell a real header from random data. That is what lets a reader walk an archive at all: there is no central index in a tar, so the only way to find the next entry is to trust the size in the current header and jump. If the checksum fails, this tool stops rather than jumping to an arbitrary offset and inventing entries out of whatever bytes it lands on.
- What is the difference between v7, ustar, gnu and pax?
- They are four generations of the same 512-byte header. v7 is the original and has room for a 100-character name and nothing else — no owner names, no long paths. ustar (POSIX.1-1988) added the magic string, user and group names, and a 155-byte prefix field, so a path can reach 255 characters if it happens to split at a slash in the right place. GNU tar solved long names differently, by writing an extra header whose contents are the real name. pax (POSIX.1-2001) generalised that into key=value records that can carry any field in UTF-8, including paths of any length, sub-second timestamps and large uids. Modern GNU tar defaults to pax when a value does not fit.
- What is a tarbomb, and why is it flagged?
- A tarbomb is an archive whose entries are not under a single top-level directory, so extracting it in your current folder scatters loose files across it instead of creating one tidy directory you can delete. It is usually carelessness rather than malice, but the cleanup is genuinely annoying: you have to read the manifest to know which of the files now in your directory came from the archive. Since this tool has the manifest anyway, it says so up front. The fix at extraction time is tar -xf archive.tar -C some-new-dir, which confines it whatever the archive contains.
- Can a tar file overwrite files outside the folder I extract into?
- It can try, in three ways, and this tool flags all three. An entry whose name begins with a slash is an absolute path. An entry whose name contains .. climbs out of the extraction directory. A symlink or hard link whose target is absolute or contains .. lets a later entry in the same archive write through it to somewhere else. GNU tar defends against these by default — it strips leading slashes and refuses to extract through paths containing .. — but archive-handling libraries in other languages frequently do not, and this has been the root of a long line of path-traversal vulnerabilities. Looking at the manifest first costs nothing.
- Is my archive uploaded anywhere?
- No. The file is read with the browser's own FileReader, parsed in JavaScript on this page, and never sent anywhere; gzip decompression also happens locally. You can verify it the direct way: load the page, disconnect from the network, and drop a file in — it still works. Nothing about the archive, including its name, leaves your machine.
- Why can I not see or download the file contents?
- This tool reads the manifest, not the payload — it deliberately walks header to header rather than holding entry contents, which is what keeps a multi-gigabyte archive from having to fit in a browser tab to be listed. If you want the contents of one entry, tar -xf archive.tar path/inside/archive extracts just that path, and tar -Oxf archive.tar path prints it to stdout without writing a file.
Related tools
NumPy .npy / .npz Inspector
Read a .npy or .npz header in the browser: dtype, shape, byte order, field layout and a value preview, with no NumPy and no upload.
xz (.xz) Stream Inspector
Read an .xz container: stream header, every block header and filter chain, the index and the footer — with the true uncompressed size, unpacking nothing.
ZIP Inspector
Drop a ZIP and see every file inside — sizes, contents, and per-file download — without unpacking it locally.
CSV Viewer & Sorter
View CSV / TSV data as a sortable, searchable table — open a file or paste rows, no spreadsheet required.
Plist Viewer (binary & XML)
Open an Apple property list — binary or XML — and read it as a tree, or convert it to JSON or XML plist.
gzip (.gz) Inspector
Read a .gz header field by field, walk every member, and verify the trailer by recomputing CRC32 and the real size in your browser.