Archive

Browsers ship a real deflate implementation now, so zipping a handful of files is something a page can do without a server and without a library. Drop files in, get an archive out; drop an archive in, get the files.

The archives it writes are real: correct CRC-32, proper central directory, ZIP64 fields when needed. On extraction it verifies each CRC and refuses entries whose names try to escape the target directory, which is the path-traversal trick that makes malicious archives dangerous.