Is It Safe to Open a ZIP File From an Unknown Sender?

Yes, a ZIP file is safe to open — the ZIP format itself is just a compressed container, with no ability to run code on its own. The real risk comes from what's packed inside it: an executable, a script, or a macro-laden Office document disguised as something harmless. On a Mac, built-in protections like Gatekeeper catch most of that before it can do damage, but a few quick checks before you open an unfamiliar ZIP make the difference between reasonable caution and unnecessary panic.

What is a ZIP file, actually?

A ZIP file is a container format. It takes one or more files, compresses them to save space, and bundles them into a single file with a .zip extension. That's the entire job of the format — packing and shrinking data, nothing more.

There's no code execution built into that process. A ZIP file can't run a program, install anything, or modify your system just by existing on your Desktop or sitting in Downloads. It's closer to a cardboard box than a machine — the box itself doesn't do anything; what matters is what's inside it.

This is worth sitting with for a second, because a lot of the fear around ZIP files comes from treating the format itself as the threat. It isn't. The format has been part of macOS since the earliest versions of Mac OS X, and Finder extracts millions of ordinary, harmless ZIPs every day without incident — invoices, photo albums, software downloads, project files. The container is neutral. The contents are what matter.

Can a ZIP file contain a virus?

Indirectly, yes — a ZIP can contain a malicious file, but the ZIP itself doesn't infect anything on its own. Malware distributed via ZIP almost always takes one of three forms, and recognizing them is most of what you need to know.

The first is a straightforward executable: a .exe file (Windows malware, harmless on its own on a Mac but still worth avoiding), a .app bundle, a .command or .sh script, or a .pkg installer hidden inside the archive. These are actual programs — opening one runs code on your machine, which a plain document or image can never do.

The second is a macro-enabled Office document — a .docm or .xlsm file, sometimes disguised with a generic-looking .doc or .xls name. These files can contain small embedded scripts that run automatically when you open the document and enable macros, and it's a technique that has been used in phishing campaigns for years because a Word document feels far less threatening than an obvious .exe.

The third, and the sneakiest, is a disguised file extension — something named to look like photo.jpg that's actually photo.jpg.exe. macOS hides file extensions by default in Finder, so at a glance that file just shows an icon and the name "photo," with nothing obviously wrong. Windows systems are more commonly targeted this way since more executable formats run natively there, but the same disguise trick works against a Mac user who trusts the visible name over the real, hidden extension.

How do I know if a ZIP file is safe to open?

A ZIP file from an unknown sender is reasonably safe to open when the sender and context check out, the file listing (viewed before extraction) matches what you'd expect, and nothing inside is an executable, script, or macro-enabled document you weren't expecting. If any of those don't line up, treat it as suspicious rather than opening it and hoping for the best.

None of this requires deep technical knowledge — it's a short, repeatable set of checks, covered in detail below. The goal isn't to be paranoid about every ZIP that lands in your inbox; it's to spend thirty seconds on the ones that don't already have an obvious, trustworthy origin.

How does macOS protect you from a malicious ZIP?

macOS has two built-in layers of defense that quietly handle most of the risk before you ever notice: Gatekeeper and XProtect. Gatekeeper checks whether a downloaded application is signed by a known, registered Apple developer and notarized by Apple — if it isn't, macOS blocks it from opening and shows a warning rather than letting it run silently. This applies to anything you try to launch that originated from the internet, including an executable extracted from inside a ZIP, since macOS tags downloaded files with a quarantine attribute that carries through extraction.

XProtect is Apple's built-in, signature-based malware scanner, running quietly in the background and updated automatically outside the normal macOS update cycle. It checks downloaded files against a list of known malware signatures and blocks matches automatically, without needing you to run a manual scan or install anything extra.

Together, these two systems mean that even if a malicious ZIP does land in your Downloads folder, actually getting infected by what's inside it takes more than a simple double-click — you'd typically need to bypass an explicit warning dialog, sometimes more than one. That's a meaningful, real layer of protection, not a guarantee, which is exactly why the sender and content checks below still matter.

What does a legitimate ZIP attachment look like?

Businesses and services that legitimately send ZIP files tend to follow a recognizable pattern, and phishing attempts usually break it in at least one visible way once you know what to look for.

• The sender's email address matches the organization's actual domain, not a close lookalike (an extra letter, a different top-level domain, a free-mail address pretending to be a company)
• You were expecting the file, or its arrival makes sense in context — an invoice after a purchase, an export you requested, a contract following an earlier conversation
• The filename is specific and plain — Invoice_4471.zip, Q3_Report.zip — rather than urgent or vague, like URGENT_Account_Verification.zip or Documents.zip with no other context
• The email around it isn't pressuring you to act immediately, isn't threatening account suspension, and doesn't ask you to enable macros or "allow content" to view the file

A phishing ZIP usually gets at least one of these visibly wrong — a spoofed or slightly-off sender address, unexpected timing, a generic or artificially urgent filename, or accompanying text pushing you to act fast without thinking. None of these checks require technical skill; they're the same instincts you'd already apply to a suspicious email that had no attachment at all.

How do I check a ZIP file's contents before extracting it?

This is the single most useful habit for handling an unfamiliar ZIP: look inside before you extract anything. Extracting immediately unpacks every file onto your disk, whether or not you actually needed or trusted all of them — previewing first lets you see exactly what's in the archive with nothing touching your filesystem yet.

Finder's own tools here are limited — Quick Look (select the ZIP and press spacebar) shows a basic file listing for some ZIPs, but its support is inconsistent and it doesn't always work. A dedicated archive app with a proper preview feature shows the complete file listing, including nested folders, instantly, with no extraction step at all. That listing is exactly what you should scan for the disguised-extension and unexpected-executable patterns described above, before deciding to extract anything.

If the listing shows only the file types you'd expect — a PDF, a set of images, a spreadsheet — matching what the sender described, you're looking at a low-risk archive. If it shows a .exe, a .scr, a .command file, or a document with a macro-enabled extension you weren't told to expect, stop there and don't extract. See our guide on previewing archive contents without extracting for more on how this works in practice.

Should I scan a ZIP file before opening it?

If a ZIP arrived from someone you don't know, or the context feels even slightly off, running it through a malware scanner before extraction is a reasonable extra step and costs you nothing. Free options like uploading the file to VirusTotal (which checks it against dozens of antivirus engines at once) or running a scan with a Mac-native tool like Malwarebytes give you a second opinion beyond what Gatekeeper and XProtect already check automatically in the background.

This step is proportional to the situation, not a requirement for every ZIP you ever receive. A ZIP from a colleague you email daily, containing exactly the file type you were expecting, doesn't need a scan. A ZIP from an address you don't recognize, with a vague filename and no context, is exactly the case where the extra thirty seconds is worth it.

What should I do if I already opened a suspicious ZIP?

If you extracted a suspicious ZIP but haven't opened or run anything inside it yet, the safest move is to delete the extracted folder and the original ZIP without opening any of the individual files, then empty the Trash. Extraction alone — unpacking the files onto disk — doesn't run anything or infect your system; the actual risk only materializes if you then double-click an executable or open a macro-enabled document and approve running its content.

If you did open or run something inside it, disconnect from the internet, run a full scan with a reputable Mac malware scanner, and change passwords for any accounts you're worried may have been exposed, ideally from a different, known-clean device. macOS's built-in protections mean this is a less common outcome than it would be on an unprotected system, but it isn't impossible, so treat it seriously rather than assuming Gatekeeper caught everything automatically.

Frequently asked questions

Can a ZIP file infect my Mac just by downloading it, without opening anything inside? No. Downloading a ZIP, or even extracting it, doesn't run any code by itself — infection requires actually opening and running a malicious file from inside the archive, typically past a Gatekeeper warning.

Is it safe to open a password-protected ZIP from an unknown sender? Password protection doesn't make a ZIP any safer to open — if anything, a password can be used specifically to hide the contents from automated malware scanners until a human manually enters it and extracts the file. Treat a password-protected ZIP from an unfamiliar source with more caution, not less.

Do image or PDF files inside a ZIP carry the same risk as executables? Not in practice — an ordinary photo or PDF can't run code the way an executable or macro-enabled document can. Genuine document-based exploits targeting viewer software exist but are rare and typically require an outdated, unpatched app; keeping macOS and your apps updated closes that gap.

Why does my Mac warn me before opening a file from a ZIP even though I trust the sender? That warning is Gatekeeper doing its job on any downloaded file, regardless of source — it checks for a valid Apple developer signature and notarization, not whether you personally trust the sender. It's normal to see it even for legitimate software.

Is it safer to ask the sender to send individual files instead of a ZIP? Not meaningfully — a malicious file is just as dangerous sent on its own as it is inside a ZIP. The ZIP format doesn't add or remove risk either way; the same sender-verification and content checks apply regardless of how the file arrives.

The bottom line

A ZIP file is safe by default — it's a container, not a program, and the format itself has no ability to harm your Mac. The real question is always about what's packed inside: an unexpected executable, a macro-enabled document, or a file disguised with a fake extension. Verify the sender, look at the filename and context, preview the contents before extracting, and scan anything that still feels off. That's the whole process, and macOS's Gatekeeper and XProtect are already working in the background as a second layer beneath it.

Previewing a ZIP's contents before extraction is the single most useful habit here, and it's built into Unzipr for free — see the full file listing instantly, extract only what you actually trust, and handle ZIP, RAR, and 7Z archives in one place without ever extracting blind. For more on the format itself, see our guide on ZIP vs RAR vs 7Z.