.ZIP File Format – Central directory

ZIP archive

The central directory is the archive’s index: one header per member, one after the other, near the end of the file. It says what is in the archive, whatever else the file contains. A member is in the archive if the central directory lists it, and a local header not listed here is just bytes in the file.

File header fields

The first 46 bytes are fixed. The name, extra field and comment follow, with their lengths at offsets 28, 30 and 32. The fields shared with the local header have the same meaning.

OffsetSizeNameDescription
04Signature50 4B 01 02, the value 0x02014B50.
42Version made byThe low byte is the ZIP version of the writer times ten; the high byte is the host system, which says how to read the external attributes.
62Version neededThe lowest ZIP version that can extract this member.
82FlagsThe general purpose bit flag.
102MethodThe compression method.
122TimeModification time in MS-DOS format.
142DateModification date in MS-DOS format.
164CRC-32The CRC-32 of the uncompressed data. Holds the correct value even when bit 3 is set. Zero for AE-2.
204Compressed sizeThe size of the stored data, including any encryption header. 0xFFFFFFFF if the real value is in a ZIP64 extra field.
244Uncompressed sizeThe size after decompression. 0xFFFFFFFF if in the ZIP64 extra field.
282Name lengthThe length of the name.
302Extra field lengthThe length of the extra field.
322Comment lengthThe length of this member’s comment.
342Disk numberThe disk the member starts on. 0xFFFF if the real value is in the ZIP64 extra field.
362Internal attributesSee internal attributes.
384External attributesThe file’s attributes on the host system: see external attributes.
424Local header offsetThe offset of the local header from the start of the first disk the member appears on. 0xFFFFFFFF if in the ZIP64 extra field. May need shifting.
46name lengthNameThe file name.
46 + nameextra lengthExtra fieldExtra field blocks.
46 + name + extracomment lengthCommentThe member’s comment.

APPNOTE says the combined length of the name, extra field and comment should not generally exceed 65,535 bytes.

Headers need not appear in the order of the data, and their order is the listing order of the archive. The total size of the central directory and its offset are in the end record, and if an archive extra data record is present its size counts in the central directory size. With central directory encryption, the directory may be compressed and encrypted as a whole.

Using the directory

  • Read it as one block of the stated size at the stated offset, and walk it record by record using the three lengths. Stop at the entry count or the end of the block, and reject any record that runs past the end.
  • Each header’s 0xFFFFFFFF or 0xFFFF field means the real value is in the record’s ZIP64 extra block, which holds only the fields that are all ones.
  • The header’s method, flags and sizes apply to the data at its local header. The name in the header is the one to use, not the local copy.
  • A member can be deleted from an archive by rewriting only the directory, and the data stays in the file. Conversely, entries that overlap or repeat are possible: see zip bombs and overlapping entries.

The header for hello.txt in the sample archive begins at 0x33. Its version made by is 1E 03: ZIP 3.0, on Unix. Its external attributes are 00 00 A4 81, which is 0x81A40000: the top 16 bits hold the Unix mode 0100644, a regular file with read and write for the owner.

Digital signature

An optional record after the last central header, in PKWARE’s strong encryption system. It is neither compressed nor encrypted.

OffsetSizeNameDescription
04Signature50 4B 05 05, the value 0x05054B50.
42SizeThe length of the signature data.
6sizeDataThe signature.

APPNOTE does not define what is signed in this record; the certificate extra fields 0x0014 to 0x0016 on the extra fields page carry certificates and signatures for files and the directory.