ZIP and GZIP: how compression works and when it helps

ZIP and GZIP are the two compressed formats almost everyone meets. ZIP is the attachment that holds a folder of documents, and GZIP is the .gz at the end of a log file or a download. They use the same compression algorithm under the hood, but they solve different problems. Knowing the difference, and what compression can and cannot do, saves time and avoids a few security traps.

How lossless compression works

Both formats use DEFLATE, which combines two ideas. It replaces repeated sequences with short references to their earlier occurrence (“the same 40 bytes as 200 bytes ago”), and it encodes frequent symbols with fewer bits than rare ones (Huffman coding). Decompression restores every byte exactly, which is what “lossless” means.

Compression only works when there is repetition to find. A 190 KB JSON export of 2,000 customer records, full of repeated keys and city names, shrinks to about 11.5 KB with the GZIP compressor, a 94% reduction. A JPEG photo of the same size barely shrinks at all, because JPEG data is already compressed and looks random to DEFLATE.

Compression levels trade speed for size. Level 1 is fastest. Level 9 tries hardest, but often gains only a few percent over the default level 6. On the customer export above, levels 6 and 9 produce exactly the same size.

GZIP: one file, compressed

A .gz file contains a single compressed file, plus a small header and a CRC-32 checksum and size at the end. That is why Unix tools combine two steps for folders: tar first bundles files into one archive, and gzip then compresses it into .tar.gz or .tgz. Web servers use gzip (and its newer relative Brotli) to compress pages on the fly, which is why enabling compression is one of the first web performance fixes.

The GZIP decompressor checks the stored CRC-32 and size after decompressing, so a truncated or corrupted file is reported instead of silently producing damaged output.

ZIP: many files, one archive

A ZIP file is an archive: it holds many files, each compressed separately, with a central directory at the end listing names, sizes, dates, and checksums. Because entries are independent, you can list or extract one file without reading the rest. Windows, macOS, and Linux open ZIP files without extra software, which makes ZIP the default for sending several files at once. Many other formats are ZIP archives in disguise: DOCX, XLSX, PPTX, EPUB, JAR, and APK.

The ZIP creator stores files without recompressing them. That is fast, keeps bytes exactly as they were, and loses little for photos, PDFs, and videos that would not shrink anyway. It also makes names portable: characters that Windows forbids are replaced, and duplicate names are numbered instead of overwriting each other.

Archives can be hostile

• Zip bombs are tiny archives that expand to gigabytes or more, designed to exhaust disk space or memory. Declared sizes that are wildly out of proportion to the archive size are the warning sign.
• Path traversal (“Zip Slip”) uses entry names like ../../.bashrc to write files outside the extraction folder when a careless program unpacks them.
• Disguised executables such as invoice.pdf.exe rely on hidden file extensions.

The ZIP inspector lists entries without extracting anything, so you can check an unexpected attachment before opening it. The ZIP extractor limits total expansion, rejects unsafe entry names, verifies each file’s CRC-32, and offers files as downloads rather than writing them into folders.

Encryption is a separate question

Compression does not protect anything. Anyone can open a ZIP or GZIP file. Password-protected ZIP files exist, but the traditional ZipCrypto method is weak. If confidentiality matters, use AES-256 encryption, for example 7-Zip’s AES option, and share the password through a different channel than the file, or use a file-sharing service with proper access control.

Quick reference

• Several files to send to someone: ZIP.
• One large text file or log to shrink: GZIP.
• A folder on Linux or for a server deployment: tar.gz.
• Photos or videos: compression gains little. Resize or re-encode instead.
• An unknown archive: inspect first, extract selectively.