Security

Update if you extract archives you didn't make yourself.

• Names a filesystem treats as one file could overwrite each other. Two entries like straße.txt and STRASSE.txt, or the two encodings of é, are one file on macOS, on Windows and in casefolded Linux folders. HatchZip compared names only by lowercasing, so such a pair could land on one file after the archive was freed. Names are now compared the way filesystems fold them, and such pairs are refused wherever they could meet. A resume also no longer deletes a file whose name on disk is spelled differently from the archive entry. (GHSA-rrfc-2x66-j7xh, thanks @plusky)

New

• LZ4 and Brotli in 7z archives made with 7-Zip ZS. Zstandard already worked. (#75, thanks @011010 and @AbhikRao)
• Folders get their permissions and modified times back after extraction, as the archive stored them. Folders that already existed are left alone. (#47, thanks @jayhemnani9910 and @garvrao80)
• Spanish. The app's main window now also comes in Spanish. (#87, thanks @011010)

Fixes

• A 7z with a method HatchZip can't decode (LZ5, Lizard) is refused before anything changes. Before, the run stopped at that block with the archive partly freed. (#84, thanks @011010 and @AbhikRao)
• Names with : extract on Linux and macOS, such as a Wine prefix's dosdevices/c: or meeting 10:30.txt. A drive letter at the start of a path is still refused everywhere. (#81, thanks @jayhemnani9910)
• The buttons stay reachable when the window is at its smallest size. (#54, thanks @garvrao80)

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip

Checksums and VirusTotal links for every file: Verify your download.

On Windows, HatchZip-x64-portable.zip runs without installing anything.

Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip, and cargo binstall hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

HatchZip is free and open source. If it saved you some disk space, sponsoring keeps it going.

Full Changelog: v0.1.9...v0.1.10

Security

Update if you extract archives you didn't make yourself.

• An archive named ...zip or ..zip extracted outside its folder. When only dots were left of its name, extracting to the default folder wrote into the folder above (for ...zip) or into the archive's own folder (for ..zip). From there a crafted archive could also replace its own progress files, which the next run trusted. Such an archive now gets a folder of its own, and no entry can be written onto the archive's volumes or progress files. (GHSA-rhvf-79m9-6j2g and GHSA-wvr2-58h7-r4f2, thanks @Deadnaut0)
• A crafted 34-byte RAR crashed HatchZip when it was opened. It is now refused as damaged, before anything is touched. (GHSA-hr29-vhvr-xfx9, thanks @kirakira-dev)
• A hard-linked archive is no longer emptied under its other name. Extracting in place shrinks a file under every name it has, so an archive or volume with another hard link is now refused in place, with nothing changed. --keep-archive still extracts it. (#48, thanks @plusky)
• Files are verified before their batch is claimed. A batch's files are now checked on disk before the archive bytes behind them are freed, closing a case where an extraction could finish without one of its files. (#37, thanks @spaxe-dev)

New

• .tar.xz extracts in place, one xz block at a time, with the same crash safety and resume as .tar.gz. Single-block files (what xz -T1 writes) and files without integrity checks are extracted only while keeping the archive. .txz works too. (#38, thanks @011010 and @garvrao80)
• Browse an archive as a folder tree in the app: folders first, sizes totalled, the top folder opened, and the keyboard works (Left, Right, Up, Down). (#40, #53, thanks @garvrao80)
• Names that differ only in case, such as Makefile and makefile in a Linux kernel tree, extract where the destination keeps them apart: ext4, f2fs and tmpfs folders without the casefold flag, btrfs, XFS without ASCII case-insensitivity, and case-sensitive APFS and HFS+. Everywhere else they are still refused before anything changes. (#56, thanks @plusky)
• Hindi. The app's main window follows the system language and is translated into Hindi, the first language after English. Translations from native speakers of other languages are welcome. (#44, thanks @garvrao80)
• cargo binstall hatchzip downloads the release build instead of compiling. (#45)

Fixes

• Correct times for ZIPs from 7-Zip and Windows, read from the NTFS field. Before, files were off by your time zone's offset. (#49, thanks @plusky)
• Zone-less ZIP times are read as local time, as unzip, 7-Zip and Explorer do. (#55, thanks @plusky)
• A .tar.gz or .tar.xz frees space on Windows even when its resume points are close together. NTFS frees space in 64 KiB units, and points closer than that used to free nothing until the end. (#64, thanks @011010)
• Tar times from pax records are used when present. (#42, thanks @jayhemnani9910)

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip

Checksums and VirusTotal links for every file: Verify your download.

On Windows, HatchZip-x64-portable.zip runs without installing anything.

Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip, and cargo binstall hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

HatchZip is free and open source. If it saved you some disk space, sponsoring keeps it going.

Full Changelog: v0.1.8...v0.1.9

Changes

• SFV checking. When an .sfv file named after the archive is next to it, every volume is checked against it before anything is modified. A damaged or missing volume stops the extraction with nothing changed. This applies to extracting and testing, in the app and on the command line, and can be stopped like any other check. (#16, thanks @garvrao80)
• Open With on macOS. Opening an archive with HatchZip from Finder now extracts it instead of showing an error. (#25)
• Correct file times for ZIPs made with zip on Linux and macOS. These archives also store each file's time in UTC, and HatchZip now uses it, as unzip and 7-Zip do. Before, extracted files were off by your time zone's offset. (#27, thanks @jayhemnani9910)
• Files dated before 1970 in a tar archive are read correctly. Before, opening such an archive stopped with a crash. A .tar.gz extraction resumed in the middle of such a file also keeps its date. (#28, thanks @jayhemnani9910; #30)
• A ZIP entry named like folder/.. is refused before anything is touched. Before, it failed only at its turn, after the rest of the archive had been removed, and the extraction could not finish. (#29, thanks @Bortlesboat)
• Upper-case extensions in the Open dialog on Linux. GAME.RAR and PHOTOS.ZIP are now listed under "Archives". (#31)
• Extracting into a folder that doesn't exist yet skips the scan for existing files. (#23, thanks @spaxe-dev)
• The RAR reader skips empty data chunks from UnRAR before reading them. (#26)

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip

Checksums and VirusTotal links for every file: Verify your download. Windows signing: Code signing policy.

On Windows, HatchZip-x64-portable.zip runs without installing anything.

Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), and scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

Full Changelog: v0.1.7...v0.1.8

Changes

The right-click menu now works the way 7-Zip and WinRAR do.

• Extract files… asks for a destination folder first, then extracts there. Closing the folder picker changes nothing.
• Extract here puts an archive with one folder or one file at its top next to the archive, as before. An archive with several files or folders at its top now goes into a new folder named after it, so its files never mix with what is already there.
• The progress window closes when the extraction completes. A test result, a pause or a failure keeps it open. To keep it open every time, clear Settings, "Close the progress window when extraction completes".
• Replace, Skip or Keep both, for each file. When files the archive contains are already in the destination, the app asks about each one, with "Do the same for the next files" to answer for the rest. Skip keeps the existing file. Keep both keeps it and adds the archive's copy beside it, as name (2).ext. When the archive is removed during extraction, a skipped file's copy in it is not kept.
• Keep archives everywhere. Clearing Settings, "Remove the archive during extraction" now applies to every right-click entry too, so HatchZip can be your everyday extractor without ever removing an archive.
• hatchzip extract --skip-existing keeps files that already exist in the destination instead of the archive's copies.
• Existing files you chose to keep are moved aside before anything is extracted and moved back when it completes, so a crash or power cut at any point never loses one; resuming finishes the job. An extraction with such choices writes a newer progress file format, which earlier versions refuse rather than mishandle.
• The archive parsers are fuzzed in CI, weekly and on every change to the engine.

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip

Checksums and VirusTotal links for every file: Verify your download.

On Windows, HatchZip-x64-portable.zip runs without installing anything.

Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), and scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

Full Changelog: v0.1.6...v0.1.7

Security

This release fixes two security issues. Update if you extract archives into folders that already hold files, or open archives that came together with other files.

• GHSA-cq63-4gv9-w2gc (High), reported by @KKonaNN and independently by Rian (@andzis11). HatchZip first writes each extracted file under its name plus .hatchzip-part. Before this release, a link at that name, such as one an earlier archive extracted into the same folder, made HatchZip write the file wherever the link pointed, outside the output folder, and a file at that name was truncated and replaced. That name is now created only where nothing exists and never through a link, and an archive or output folder that would collide with it is refused before anything is touched. The temporary files behind the progress files next to the archive are created the same way.
• GHSA-m6m5-qcjx-55gv (Medium), reported by Rian (@andzis11). Progress files supplied together with an archive could make a resume delete and replace files already in the archive's default output folder. A resume now uses progress files only for an extraction started on this computer, which records its output folder in your user profile, or when you name the folder again with -o.

An extraction that 0.1.5 or earlier started in the default folder has no such record. To resume it with 0.1.6, name the folder again, for example hatchzip extract game.zip -o game.

Changes

• Replace existing files. When files an archive would write are already in the destination, hatchzip extract --replace, or "Replace" when the app asks, moves them aside until the extraction completes, so a restore can put them back. Without it, HatchZip still refuses before anything is touched.
• Check for updates in the app's Help menu opens the latest release page in your browser. The app itself makes no network connections.
• Portable Windows zip. HatchZip-x64-portable.zip holds the app and the command line tool with nothing to install. Unzip it anywhere and run hatchzip-gui.exe; Settings, "Show in the Explorer context menu", adds the right-click entries for that location and removes them again.
• Crafted archives are refused before anything is touched, or read correctly:
  • 7z: a block with no packed bytes no longer truncates the block after it; a header inside the packed data and packed streams that no block uses are refused; headers are indexed without panicking.
  • tar: a hard link listed before its file is counted at the file's size.
  • .tar.gz: the gzip header is checked as it is read, and its name and comment are capped.
  • RAR: quick open copies are checked against the headers and UnRAR's header fields against HatchZip's own, and old-style volume names stop at .z99.
  • Every format: data past the end of the file, sizes that add up past what a disk holds, and a new extraction with more than 1 GB after the last entry are refused.
• install.sh runs nothing until the whole script has arrived.
• Each release carries its signed build provenance as a file, and its Windows and macOS programs are checked to import no networking library or socket function before it is published.

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip

Checksums and VirusTotal links for every file: Verify your download.

Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), and scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

Full Changelog: v0.1.5...v0.1.6

Security

This release fixes GHSA-446w-m5mg-2f58 (High), reported by @Valcyle. Update if you open archives that came together with other files.

HatchZip keeps two progress files next to an archive while it extracts, <archive>.hatchzip and <archive>.hatchzip-tail, so a stopped extraction can resume. Before this release, progress files planted next to an archive, for example inside a downloaded bundle, could make a resume shrink or delete other files, or create links outside the output folder. A resume now uses them only when:

• every volume they name is one of that archive's own volumes, and none of them is a link;
• every link they name is inside the output folder, and no link already in the output folder lies on the way;
• the output folder is the default one next to the archive, a folder chosen on this computer, or the folder named again with -o.

Anything else is refused before a file is changed. Folders you choose with -o or in the app are recorded in your user profile, so a resume on the same computer works as before. To continue on another computer, name the folder again with -o.

Also published: GHSA-6rh6-c2xg-gj28 (High), reported by Benjamin Kincses (@Dextheking1), a link entry below another link entry. It was already fixed in 0.1.3.

Changes

• hatchzip restore accepts -o to name the output folder of the extraction it undoes.
• HatchZip refuses to extract into a default output folder that is a link, and to change an archive volume that is a link.
• CodeQL analysis of the Rust code and the workflows runs on every change.

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip

Checksums and VirusTotal links for every file: Verify your download.

Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), and scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

Full Changelog: v0.1.4...v0.1.5

Highlights

• RAR archives with encrypted file names. RAR 5 and RAR 4 archives made with "Encrypt file names" (rar -hp) now ask for the password, then list and extract in place, with space freed file by file, crash safety and resume (#15). hatchzip restore refuses these archives, since it takes no password.
• MSI installer. HatchZip-x64.msi installs the same app as the setup, as a Windows Installer package for deployment tools: msiexec /i HatchZip-x64.msi /qn. Install one or the other.
• Version information on Windows. hatchzip.exe and the setup carry the product name, company and version, shown in the file's Properties.

Supply chain

• CI runs cargo-deny on every change for advisories, licenses and sources, and fails if an HTTP, TLS or socket library enters the dependencies.
• OpenSSF Scorecard analysis, and a security policy that describes what HatchZip does and how to verify it.
• Dependency updates: ctutils for RUSTSEC-2026-0385, and clipboard-win off a yanked release.

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip

Checksums and VirusTotal links for every file: Verify your download.

Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), and scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

Full Changelog: v0.1.3...v0.1.4

Highlights

• RAR support. RAR 5 and RAR 4, single files and volume sets (.part1.rar, .rar/.r00), with passwords. Space is freed file by file, the same way as ZIP. Solid RAR archives extract with the archive kept.
• Extract and keep the archive. A normal extraction that removes nothing: the "Remove the archive during extraction" option in the app, "Extract here (keep archive)" in the right-click menu, and --keep-archive on the command line.
• Several archives in one run. hatchzip extract a.zip b.7z c.tar.gz, and several archives selected in the right-click menu on Linux.
• Opening large archives is much faster. A 50 GB ZIP now opens in 0.01 s instead of reading the whole archive first (42 s). Long opens show their progress.

Fixes

• Archives with a link where a folder is needed, or with duplicate ZIP entry names, are refused before anything is touched (#10, #11).
• Paths and names longer than the system allows are refused before anything is touched, instead of failing partway through.
• A clearer diagnosis when a file system cannot free space inside a file, including FAT32 on macOS 27.
• "Open another archive" after a completed extraction.

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

gh attestation verify HatchZip-x64-setup.exe --repo xevrion/hatchzip

New package managers: brew install xevrion/tap/hatchzip, and scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

Thank you

• @kodejeet: faster ZIP opening (#1)
• @011010: codec tests, punch diagnostics, the FAT32 report and fix, and "Open another archive" (#2, #3, #7, #8, #9)
• @MokshVerma: the first RAR implementation (#4)
• @Dextheking1: the security reports (#10, #11)

Full Changelog: v0.1.2...v0.1.3

Full Changelog: v0.1.1...v0.1.2

Full Changelog: v0.1.0...v0.1.1