Block Zip Slip, symlink escapes, and hidden executables before a single byte hits your disk. Strip macOS metadata before sending to Windows. Repair garbled CJK filenames in one click. All offline, all on your Mac.
project-handoff.zip
9 entries · 24.6 MB · SHA-256 a7c2f0…
Before / After
Every archive is scanned for path traversal, symlinks pointing outside the destination, and bundled executables. Risky entries are shown to you before extraction — no silent surprises.
Why
Three things every Mac archive tool should do, and one of them does. SafeZip is built around the safety boundaries other tools assume you'll catch yourself.
Every archive is scanned for Zip Slip traversal, symlink escapes, and bundled .app / .command / .sh executables before extraction. Risky entries are shown to you, never silently extracted.
Strip .DS_Store, __MACOSX, and AppleDouble ._* files automatically when packing a ZIP for Windows or Linux. Your colleagues see ten fewer junk files per archive.
SafeZip declares network.client: false in its sandbox entitlements. It physically cannot phone home. Your archives stay on your Mac.
Workflow
ZIP, 7Z, RAR, TAR family, ISO, CPIO, PAX, XAR, single-file streams — SafeZip routes each format to the right engine automatically.
Risk badges flag Zip Slip, symlink escapes, executables, and CJK mojibake. Pick which entries to extract — or extract all, knowing nothing dangerous landed on disk.
Safe extraction with conflict policy (skip / replace / keep both / merge). Or pack a clean ZIP that strips macOS metadata for Windows-friendly send.
Real cases
Windows-created archives often arrive with mojibake — Shift-JIS read as UTF-8, GBK as Windows-1252. SafeZip detects the encoding mismatch, previews the repair, and applies it with a single click.
報告書.txt → 报告书.txt社内写真.jpg → 社内写真.jpgŠÉ¬¶Šé[†.pdf → ハンコ届.pdf
A normal Finder zip includes .DS_Store and __MACOSX. SafeZip strips them before packaging — your Windows recipient sees only real files.
- .DS_Store (4 KB)- __MACOSX/ (42 files)- ._presentation.key (4 KB)+ presentation.key (12 MB)+ notes.md (8 KB)
A malicious archive with ../../../etc/passwd entries is caught at scan time, before extraction. The risky entry is highlighted and you can choose what to extract.
✗ build/../../etc/passwd [Zip Slip — blocked]✗ install.command [executable — blocked]✗ link → /Users/you/.ssh [symlink escape — blocked]✓ README.md (extract OK)✓ src/main.swift (extract OK)
ZIP, 7Z, RAR, TAR family, ISO, CPIO, PAX, XAR, single-file streams — handled by a routing engine that picks the right backend per format.
.zip .7z .rar .tar.gz .tar.bz2.tar.xz .tar.zst .iso .cpio.pax .xar .gz .bz2 .xz .zst
Use Cases
If you regularly receive archives from Windows colleagues, scrape datasets, work on cross-platform teams, or deal with files in Chinese / Japanese / Korean — SafeZip handles the painful parts other tools leave to you.
GBK and Shift-JIS filenames stay readable; .DS_Store and __MACOSX never sneak into your replies.
Clean ZIP mode removes every macOS-specific file before packing. The recipient never sees ten junk files per real file.
Zip Slip, symlinks, executables, encrypted-header archives — all flagged at scan time. Safe-by-default extraction policy applies even to encrypted ZIPs.
FAQ
No. The app declares network.client: false in its sandbox entitlements and ships without any analytics SDK. Audit the binary yourself with `strings` — there's nothing there.
RAR creation requires a license from RARLAB and we don't ship one. SafeZip can read and extract RAR4 and RAR5 just fine; for outbound archives we recommend 7Z or ZIP-AES which have stronger encryption anyway.
No. SafeZip detects encoding mismatches (e.g. Shift-JIS read as UTF-8), proposes the repair, and shows a before/after preview. You confirm before any rename is applied.
Yes. SafeZip is a Universal 2 native binary that runs on both Apple Silicon and Intel Macs, macOS 12 or later.
Same code, signed two different ways. The MAS version goes through Apple's sandbox review and auto-updates. The DMG version is signed with Developer ID + notarized — same security guarantees, but you control when to update.
The core archive engine and security layer are MIT-licensed. The packaged Mac app bundles a Developer ID signed 7zz helper (LGPL, see in-app About).
Get SafeZip
Runs on Apple Silicon and Intel Macs. Sandbox entitlements explicitly deny network access.
Requires macOS 12 (Monterey) or later