Gzip Text Decompressor
Decompress gzip, zlib, or raw deflate payloads locally from Base64, hex, escaped bytes, or a local file with text decoding and byte evidence.{{ decodedOutput }}
| Metric | Value | Detail | Copy |
|---|---|---|---|
| {{ row.metric }} | {{ row.value }} | {{ row.detail }} |
| Signal | Value | Evidence | Copy |
|---|---|---|---|
| {{ row.signal }} | {{ row.value }} | {{ row.evidence }} |
Gzip and zlib payloads often appear as copied text even though the compressed content is really bytes. API traces, queue messages, cached responses, diagnostics, and support tickets may show those bytes as Base64, Base64URL, hex dumps, or escaped byte strings. Before the original message can be read, the visible text has to be turned back into bytes, inflated with the correct wrapper rules, and decoded with the right character encoding.
The wrapper matters because gzip, zlib, and raw deflate are not the same container. Gzip adds a recognizable header and trailer around a DEFLATE stream. Zlib uses a shorter header and an Adler-32 checksum. Raw deflate has the compressed blocks without those wrapper bytes, so there is less evidence to inspect when something fails.
Successful decompression proves only that the compressed byte stream can be inflated under the selected wrapper. It does not prove that the content is safe, complete, human-readable, or encoded as UTF-8. A payload can inflate correctly and still display replacement characters, binary control bytes, or the wrong language text when the output encoding is wrong.
The safest reading starts with the bytes: check the detected wrapper, compressed and decompressed sizes, strict text status, and any gzip trailer evidence before treating the decoded text as the original message.
How to Use This Tool:
Start with the form in which you actually received the compressed payload. Auto choices are useful for common API and log fragments, while explicit format choices help when copied byte output has ambiguous characters.
- Paste the compressed payload into Compressed payload, drop a file onto the text area, or use Browse file. Local gzip-style files are converted into editable Base64 text, and files larger than 8 MB are rejected by the file loader.
- Set Input format. Auto detect recognizes clear hex dumps first, then Base64 or Base64URL. Choose Hex dump for byte pairs such as
1f 8b 08 00, and choose Escaped byte string for copied\x1f\x8bor percent-escaped bytes. - Set Compression wrapper. Auto detect tries gzip, zlib, and raw deflate in a practical order. Force Gzip, Zlib, or Raw deflate when you need the run to fail unless the expected wrapper is correct.
- Choose Decoded output. Use UTF-8 strict when replacement characters would hide corruption, UTF-16LE text or Latin-1 text for known legacy payloads, and Raw byte preview when the inflated content is not meant to be displayed as text.
- Read the summary badges before copying. They show the detected input reader, detected wrapper, and text status. If Decompression failed appears, compare the selected input format with the pasted representation, then try the matching wrapper instead of leaving all choices on auto.
- Use Decoded Text for the recovered content, Byte Evidence for byte counts and expansion ratio, and Wrapper Evidence for gzip or zlib header and trailer clues. Open Payload Size Bars when compressed and decoded byte sizes are part of the investigation.
A useful run has readable decoded output or a clear byte preview, a wrapper that matches the expected format, and evidence rows that explain the compressed size, decompressed size, and strict text result.
Interpreting Results:
The first result to trust is whether decompression completed. After that, compare the decoded content with the evidence rows. A readable paragraph, JSON object, or log line is only trustworthy when the wrapper and text status also make sense for the data you expected.
| Result Cue | Best First Reading | What to Verify |
|---|---|---|
| Decoded Text is readable | The payload inflated and the selected text encoding produced displayable text. | Check Strict UTF-8 check, wrapper type, and byte counts before forwarding the text. |
| Strict UTF-8 check is invalid | The inflated bytes are not valid UTF-8, or the content is binary data. | Switch to Raw byte preview or the known legacy encoding instead of copying garbled text. |
| Compression wrapper is raw deflate | The stream inflated without gzip or zlib wrapper bytes. | Confirm that the source really provides raw deflate, because there is no wrapper checksum or header metadata to inspect. |
| Trailer ISIZE differs from expectations | The gzip trailer reports the original size modulo 2^32, which may not equal a separate file-size claim for very large content. | Compare Decompressed bytes with the expected payload length and retest from the original source when the numbers disagree. |
| Expansion ratio is very high | A small compressed payload expanded into much more data. | Inspect the content before pasting it elsewhere, especially if the payload came from an untrusted ticket, log, or message queue. |
False confidence is common with decompression. A successful inflate does not prove that the payload is complete, safe, intended for text display, or from a trusted producer. It only proves that the bytes can be interpreted under the selected compression wrapper.
For ticket or incident work, copy the decoded text only after checking Byte Evidence and Wrapper Evidence. Those rows explain how the result was reached and make wrong-format failures easier to reproduce.
Technical Details:
Gzip and zlib are wrappers around DEFLATE-compressed data. DEFLATE stores a sequence of blocks using literal bytes, length and distance references to earlier bytes, and Huffman coding. The wrapper tells a decoder how to recognize the stream and, for wrapped formats, gives extra checks that can catch corruption after the compressed blocks are expanded.
Gzip starts with fixed identification bytes 1F 8B and a compression method byte, normally method 8 for DEFLATE. Its trailer stores a CRC-32 value and ISIZE, the uncompressed size modulo 2^32. Zlib begins with CMF and FLG bytes whose combined value must satisfy a modulo-31 header check, then ends with an Adler-32 checksum of the uncompressed data. Raw deflate skips both wrapper styles, so a decoder can only try to inflate the block stream directly.
Transformation Core:
The decompression path has three separate conversions. Failure in any one of them can produce a different error even when the compressed content itself is valid.
| Stage | Accepted Form | What Changes | Common Failure |
|---|---|---|---|
| Text representation to bytes | Base64, Base64URL, hex byte pairs, escaped bytes, or a loaded local file | Printable characters are converted back into the compressed byte stream. | Bad Base64 alphabet, odd hex digit count, or copied labels inside the payload. |
| Wrapper recognition | Gzip, zlib, or raw deflate | The decoder decides which wrapper rules and integrity checks apply before or after inflate. | Forcing gzip for a zlib stream, or treating raw deflate as if it had header bytes. |
| DEFLATE expansion | Compressed blocks with literal, length, distance, and Huffman-coded data | Compressed bytes expand into the original uncompressed byte stream. | Truncation, damaged block data, bad checksum, or a missing preset dictionary. |
| Text display | UTF-8, strict UTF-8, UTF-16LE, Latin-1, or raw byte preview | Uncompressed bytes are shown as characters or as a hex and ASCII-style preview. | Binary content or the wrong character encoding creates unreadable text. |
Wrapper Evidence:
| Wrapper | Recognition Clue | Integrity or Metadata | Interpretation Limit |
|---|---|---|---|
| Gzip | Starts with 1F 8B and method 8 for DEFLATE. |
May expose flags, modification time, operating-system byte, CRC-32 trailer, and ISIZE. | Header metadata can be absent, defaulted, or copied from another system; it is not proof of content trust. |
| Zlib | CMF and FLG describe DEFLATE and pass the modulo-31 header check. | Ends with Adler-32 for the uncompressed bytes; CMF can imply the window size. | Short zlib streams can be confused with other bytes until an actual inflate attempt succeeds or fails. |
| Raw deflate | No wrapper bytes are required; only DEFLATE blocks are present. | No gzip header, zlib header, CRC-32 trailer, ISIZE, or Adler-32 value is available. | A successful raw inflate gives less provenance and integrity evidence than a wrapped stream. |
Formula Core:
Two size metrics help compare the compressed representation with the recovered byte stream. The expansion ratio is shown as decompressed bytes divided by compressed bytes.
If a pasted Base64 gzip payload represents 94 compressed bytes and inflates to 154 bytes, the expansion ratio is 154 / 94, or about 1.64x. Ratios below 10x are displayed with two decimal places; larger ratios use one decimal place.
The compressed share expresses the compressed bytes as a percentage of the decompressed byte count. It is useful when someone wants to state how much of the original size the compressed representation occupies.
The character count is separate from byte count. UTF-8, UTF-16LE, and Latin-1 can display different character lengths for the same recovered bytes, while Raw byte preview intentionally reports preview characters rather than decoded text characters.
Privacy and Accuracy Notes:
The compressed payload is decoded and inflated in the browser. The decompression run does not need to upload the pasted payload or selected local file to a remote decompression service, but local processing is still not a reason to paste secrets into a page you do not trust.
- Browser file loading rejects files larger than 8 MB, but a small compressed payload can still expand into much larger text.
- Strict UTF-8 failure means the decoded bytes are not valid UTF-8 text, not necessarily that decompression failed.
- Raw deflate results have fewer integrity clues than gzip or zlib because there is no wrapper checksum or trailer metadata.
- Decoded logs, tokens, and API bodies may contain credentials or personal data. Review before sharing or pasting the output elsewhere.
Worked Examples:
Base64 gzip from an API log:
A copied value beginning with H4sIA is pasted into Compressed payload with Input format on Auto detect, Compression wrapper on Auto detect, and Decoded output set to UTF-8 text. A successful run shows Compression wrapper as gzip, Decoded Text as readable JSON or log text, and Byte Evidence with compressed bytes, decompressed bytes, and Expansion ratio.
Hex zlib bytes from a command-line trace:
A trace such as 78 9c followed by more byte pairs usually points to a zlib-wrapped DEFLATE stream. Choose Hex dump and Zlib when you want a strict check. If the run succeeds, Wrapper Evidence includes Zlib CMF and Zlib FLG; if it fails, the hex may be truncated or copied from a larger framed protocol.
Inflates, but the text looks broken:
A payload can decompress while Strict UTF-8 check reports invalid. Switch Decoded output to Raw byte preview to inspect the first bytes, then try Latin-1 text or UTF-16LE text only if the producer is known to use that encoding. Do not copy replacement-character text as evidence unless the byte preview also matches the expected content.
FAQ:
Why does auto detect choose Base64 for my text?
Auto detect treats clear hex dumps as hex, then falls back to Base64 or Base64URL. If the payload contains byte-pair separators, choose Hex dump; if it uses \xNN escapes, choose Escaped byte string.
Should I force gzip instead of using auto?
Force Gzip when the producer claims the stream is gzip and you want that claim tested. Auto mode is better for unknown payloads because it can also try zlib and raw deflate.
Why did decompression work but the decoded text is unreadable?
The inflated bytes may be binary, encrypted, serialized, or written in a different character encoding. Use Raw byte preview and the Strict UTF-8 check row before changing the text encoding or copying the result.
Does a valid gzip trailer prove the payload is trustworthy?
No. CRC-32 and ISIZE help catch accidental corruption for the gzip member, but they do not authenticate the producer or prove the content is safe to open, execute, or share.
Are selected files uploaded?
The file loader reads one selected local file in the browser and converts gzip-style binary files into editable Base64 text. The decompression run does not upload the selected payload to a remote decompression service.
Glossary:
- DEFLATE
- The compressed data format used inside gzip and zlib streams.
- Gzip
- A wrapper format with identification bytes, optional header fields, DEFLATE data, and a CRC-32 plus ISIZE trailer.
- Zlib
- A compact wrapper around DEFLATE data with CMF and FLG header bytes and an Adler-32 trailer.
- Raw deflate
- A DEFLATE stream without gzip or zlib wrapper bytes.
- ISIZE
- The gzip trailer field that stores the original uncompressed size modulo 2^32.
- Base64URL
- A URL-safe Base64 variant that uses
-and_instead of+and/.
References:
- RFC 1952: GZIP File Format Specification version 4.3, IETF, May 1996.
- RFC 1950: ZLIB Compressed Data Format Specification version 3.3, IETF, May 1996.
- RFC 1951: DEFLATE Compressed Data Format Specification version 1.3, RFC Editor, May 1996.
- Encoding Standard, WHATWG.