These fields appear in the local file header and the central directory header. This page says what each one means.
Version made by
Two bytes in the central header and the ZIP64 end record. The low byte is the highest ZIP specification version the writer supports, as the version times ten: 20 means 2.0. The high byte is the host system, which says how to read the external attributes.
| Host byte | System |
|---|---|
0 | MS-DOS and OS/2 (FAT, VFAT, FAT32) |
1 | Amiga |
2 | OpenVMS |
3 | Unix |
4 | VM/CMS |
5 | Atari ST |
6 | OS/2 HPFS |
7 | Macintosh |
8 | Z-System |
9 | CP/M |
10 | Windows NTFS |
11 | MVS (OS/390, z/OS) |
12 | VSE |
13 | Acorn RISC |
14 | VFAT |
15 | Alternate MVS |
16 | BeOS |
17 | Tandem |
18 | OS/400 |
19 | OS X (Darwin) |
20 to 255 | Unused |
Version needed to extract
Two bytes. The low byte is the lowest ZIP version a reader needs for this member, times ten. Each value is the minimum for the feature named, and a member takes the highest value of any feature it uses. A reader may treat an unknown value as a reason to refuse the member.
| Version | Value | Feature |
|---|---|---|
| 1.0 | 10 | Default |
| 1.1 | 11 | Volume label |
| 2.0 | 20 | Folder; Deflate; traditional PKWARE encryption |
| 2.1 | 21 | Deflate64 |
| 2.5 | 25 | PKWARE DCL Implode |
| 2.7 | 27 | Patch data set |
| 4.5 | 45 | ZIP64 |
| 4.6 | 46 | bzip2 |
| 5.0 | 50 | DES, 3DES, original RC2, RC4 encryption |
| 5.1 | 51 | AES encryption; corrected RC2 |
| 5.2 | 52 | Corrected RC2-64 |
| 6.1 | 61 | Non-OAEP key wrapping |
| 6.2 | 62 | Central directory encryption |
| 6.3 | 63 | LZMA; PPMd; Blowfish; Twofish |
The high byte is unused here. Real writers do not always follow the table. For LZMA, XZ and Zstandard, libzip writes 20, with a comment that WinZip refuses other values.
General purpose bit flag
Two bytes. Bits are numbered from 0, the least significant.
| Bit | Mask | Meaning |
|---|---|---|
0 | 0x0001 | The member is encrypted. |
1 | 0x0002 | Depends on the method: see the table below. |
2 | 0x0004 | Depends on the method: see the table below. |
3 | 0x0008 | The CRC-32 and sizes are zero in the local header, and the real values are in a data descriptor. |
4 | 0x0010 | Reserved for enhanced deflating (method 8). |
5 | 0x0020 | The data is compressed patch data. Needs version 2.7. |
6 | 0x0040 | Strong encryption. Needs version needed of at least 50 and bit 0 set; AES needs at least 51. |
7 to 10 | Unused. | |
11 | 0x0800 | Language encoding flag: the name and comment are UTF-8. |
12 | 0x1000 | Reserved by PKWARE for enhanced compression. |
13 | 0x2000 | The central directory is encrypted and selected values in the local header are masked. |
14 | 0x4000 | Reserved by PKWARE for alternate streams. |
15 | 0x8000 | Reserved by PKWARE. |
Bits 1 and 2
| Method | Bit 2 | Bit 1 | Meaning |
|---|---|---|---|
| Deflate (8) and Deflate64 (9) | 0 | 0 | Normal compression |
| 0 | 1 | Maximum compression | |
| 1 | 0 | Fast compression | |
| 1 | 1 | Super fast compression | |
| Implode (6) | 0 or 1 | 0 or 1 | Bit 1: 8K dictionary when set, 4K when clear. Bit 2: three Shannon-Fano trees when set, two when clear. |
| LZMA (14) | 0 or 1 | Bit 1: the data ends with an end-of-stream marker. | |
| Others | Undefined. |
The Deflate level bits only record how hard the writer tried. A decompressor can ignore them.
MS-DOS date and time
Two 16-bit fields, time then date, in local time with no time zone. A zone can only come from an extra field, such as the extended timestamp.
| Field | Bits | Meaning | Range |
|---|---|---|---|
| Time | 0 to 4 | Seconds divided by 2 | 0 to 29 |
| 5 to 10 | Minutes | 0 to 59 | |
| 11 to 15 | Hours | 0 to 23 | |
| Date | 0 to 4 | Day of the month | 1 to 31 |
| 5 to 8 | Month | 1 to 12 | |
| 9 to 15 | Years since 1980 | 0 to 127 (1980 to 2107) |
Seconds can only be even. A date and time of zero means no time was recorded. In a local header with bit 13 set they are masked to zero.
Example: the date 0x5D69 is binary 0101110 1011 01001: year
46 (2026), month 11, day 9. The time 0x6000 is
01100 000000 00000: 12:00:00.
CRC-32
A 32-bit CRC of the uncompressed data, stored as a little-endian number. The polynomial
is 0x04C11DB7, used in reflected form as 0xEDB88320. The
register starts at 0xFFFFFFFF and the result is inverted at the end.
crc = 0xFFFFFFFF
for each byte b:
crc = table[(crc ^ b) & 0xFF] ^ (crc >> 8)
result = crc ^ 0xFFFFFFFF
Each table entry for index i starts with the value i, and is shifted right eight
times, with the polynomial XORed in whenever the bit shifted out is 1.
This is the common CRC-32. The check value for the nine ASCII bytes
123456789 is 0xCBF43926. APPNOTE gives the magic number
0xDEBB20E3, the register value after processing a complete message and
its own CRC. In the sample archive
the 12 bytes Hello, ZIP! and a newline have the CRC-32
0x8F865D0C.
The field is zero in the local header when bit 3 is set, and is masked in some cases when the directory is encrypted. In an AE-2 member it is zero.
Internal file attributes
Two bytes in the central header.
| Bit | Meaning |
|---|---|
0 | The data is apparently text (set) or binary (clear). A hint only. |
1 | A four-byte little-endian record length control field precedes each logical record, for mainframe transfers. APPNOTE also marks bits 1 and 2 as reserved for PKWARE. |
| Others | Unused. |
External file attributes
Four bytes in the central header. Their meaning depends on the host system in version made by. For an entry read from standard input, the field is zero.
MS-DOS attributes
On hosts 0, 6, 10 and 14, the low byte holds the MS-DOS attribute byte. Unix tools often also set this low byte, so that DOS and Windows readers see the folder bit.
| Bit | Mask | Attribute |
|---|---|---|
0 | 0x01 | Read only |
1 | 0x02 | Hidden |
2 | 0x04 | System |
3 | 0x08 | Volume label |
4 | 0x10 | Folder |
5 | 0x20 | Archive |
Unix mode
On hosts 3 (Unix) and 19 (OS X), the high 16 bits hold the Unix st_mode:
the external attributes are mode << 16, with the low byte optionally
holding the DOS attributes. The type is in the top four bits of the mode.
| Mode bits (octal) | Type |
|---|---|
0010000 | FIFO |
0020000 | Character device |
0040000 | Folder |
0060000 | Block device |
0100000 | Regular file |
0120000 | Symbolic link. The member’s data holds the link’s target path. |
0140000 | Socket |
The low 12 bits are the permissions: setuid 04000, setgid
02000, sticky 01000, then read, write and execute for owner,
group and others.
Examples: 0x81A40000 is mode 0100644, a regular file
with read and write for the owner and read for everyone else.
0x41ED0010 is mode 040755, a folder, with DOS folder bit
0x10 set in the low byte.
Extractors should mask out setuid and setgid. A symbolic link can point out of the extraction folder: see path traversal.