Use the unzip utility: inspect the archive with unzip -l archive.zip, test it with unzip -tq archive.zip, then extract to a deliberate destination such as unzip archive.zip -d /srv/app. On a shared server, use a dedicated writable directory and choose -n to preserve existing files unless an intentional deployment requires -o.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The basic command and what it does
unzip is the standard command-line utility for listing, testing, and extracting ZIP archives on Linux. With no destination option, it writes into the current working directory and recreates the directories stored in the archive.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →unzip archive.zipThe command uses the shell’s current directory, not the directory containing the ZIP file. Check where you are first with pwd. If the archive is elsewhere, provide its path, for example:
unzip /var/tmp/releases/site.zipTo choose another destination, add -d followed by a directory path:
#1 Best Overall
unzip /var/tmp/releases/site.zip -d /srv/appThe account running the command must be able to read the archive and write to the destination. The utility creates the stored subdirectories below that destination as it extracts them, but the destination itself must be usable by the account.
A safe extraction workflow for a server
Extraction can change many files at once, so treat it as an operational change rather than a double-click equivalent. This sequence lets you see what will be written, verify that the archive can be read, and make the overwrite decision before files are changed.
- Confirm the location and identity of the archive. Run
pwd,ls -l archive.zip, and, when you need more detail,stat archive.zip. Confirm that the file is the intended upload or release and that your account can read it. - List the members before extraction. Use
unzip -l archive.zip. Review names, directory prefixes, and unexpected files. This is particularly important for archives received from another person, an automated job, or an untrusted source. - Test the archive. Run
unzip -tq archive.zip. The-toption tests the archive and-qkeeps the output compact. A failure means you should obtain or create a good copy before deploying its contents. - Prepare a dedicated destination. A separate release or staging directory prevents an archive from mixing unexpectedly with unrelated system files. Create it with normal shell tools if needed, then verify ownership and write permission.
- Choose the collision policy. Use
-nwhen a file that already exists must be left untouched. Use-oonly when replacing existing files is intentional and controlled. - Extract and review the result. Run the selected command, inspect the destination, and check ownership and permissions. A service account may create files that your login account cannot edit, or vice versa.
Inspect an archive before writing anything
List names, paths, and archive metadata
unzip -l prints the archive’s member listing without extracting it:
unzip -l archive.zipLook for the top-level directory layout. An archive might contain app/config.yml, or it might contain config.yml directly. That difference determines whether extraction produces a new app directory or places files immediately in the destination. Also look for names you did not expect, such as private keys, deployment scripts, or a second application tree.
Archive names and extracted files should be treated as untrusted input. Listing first gives you a chance to stop before writing an unexpected path or sensitive content into a system directory. Do not extract an untrusted archive directly into a directory containing operating-system files or other applications.
Test integrity without extracting
Use the compact test form when you want a quick pass/fail check:
Recommended Free Tools
unzip -tq archive.zipThe test reads the archive members and checks whether they can be processed. It does not replace a review of the member names, and a successful test does not make unknown content trustworthy; it only addresses whether the ZIP can be read successfully.
Extract to the current directory or a chosen directory
Current directory
unzip archive.zipThis is convenient when you have already changed into an empty staging directory. It is risky when run from a home directory, a web root containing live files, or a system directory because the archive’s stored paths will be recreated there.
Another directory with -d
unzip archive.zip -d /srv/app-d accepts an arbitrary extraction directory. Use an absolute path when a script or deployment must not depend on its starting directory. Confirm that the account can write there before running the command. If the directory does not exist, create it with an explicit administrative step and set its intended owner and permissions rather than relying on an accidental default.
mkdir -p /srv/app
unzip archive.zip -d /srv/appThe mkdir command above creates the destination; it does not change the ZIP’s internal layout. If the archive contains release/bin/start, the result will normally be /srv/app/release/bin/start.
Decide what happens when files already exist
Without a deliberate policy, an interactive extraction can ask about collisions. On a server, make the policy explicit so an operator or script gets predictable behavior.
| Goal | Command | Result | When to use it |
|---|---|---|---|
| Keep existing files | unzip -n archive.zip -d /srv/app |
Skips members whose destination files already exist. | Safer when preserving current files matters, especially on a shared server. |
| Replace existing files | unzip -o archive.zip -d /srv/app |
Overwrites existing files without prompting. | Controlled, repeatable deployments where replacement is the intended change. |
-n is a protection against accidental replacement; it does not merge application versions or remove files that are absent from the new archive. Conversely, -o can replace configuration, uploads, or executable files immediately, so use it only after confirming the destination and archive.
Preserve or flatten the archive’s directory paths
Preserve paths (normal behavior)
Normal extraction recreates the directories recorded in the ZIP. This is the right choice when the archive’s layout is part of the application or when files with the same name are expected in different subdirectories.
unzip archive.zip -d /srv/appFlatten paths with -j
unzip -j archive.zip -d /srv/app-j discards stored directory paths and deposits the files directly in the destination. Flattening can be useful for a collection of unrelated documents, but it can also create filename collisions: one/readme.txt and two/readme.txt become the same destination name. Inspect the listing first and combine -j with a collision policy when appropriate.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Extract only selected members or exclude others
Select matching members
You can name a member pattern after the archive name:
unzip archive.zip 'docs/*.txt' -d /srv/appThe quotes are significant. They prevent the interactive shell from expanding docs/*.txt against files in your current directory before unzip receives the pattern. The pattern is then matched against archive members.
Exclude matching members
unzip archive.zip -x 'secrets/*' -d /srv/appThis extracts other members while excluding names under secrets/. Exclusion is not a substitute for inspecting the complete listing: add or revise patterns only after you know the archive’s actual member names. Quote exclusion patterns for the same shell-expansion reason.
Password-protected ZIP files
For an encrypted archive, start the extraction normally:
Free tools Windows power users keep installed
One-click scans. No signup required.
unzip archive.zipWhen a protected member is encountered, unzip asks for the password interactively and does not echo it as you type. Enter it at that prompt. This avoids exposing the secret in the process list, shell history, job logs, or script source.
Do not use the -P password form for routine operation. The Info-ZIP manual warns that a password placed on the command line may be visible to other users through process arguments and is especially unsafe in scripts. If a noninteractive deployment needs secret handling, supply the credential through a secret-management design appropriate to your environment rather than embedding it in a command or repository.
A ZIP password is not automatically a strong security boundary. The Info-ZIP documentation describes traditional ZIP encryption as relatively weak. If the data requires high confidentiality, use a stronger encryption method and protect its keys separately; do not assume that adding a ZIP password solves the entire security problem.
If unzip is not installed
Install the package named unzip using the official package manager for the particular Linux distribution and release, then verify that the command is available:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
unzip -vThere is no single package-install command that is correct for every Linux distribution. Package names, repositories, privileges, and release documentation vary. Use the distribution’s current documentation, obtain the necessary administrative approval, and run unzip -v afterward to confirm the installed program and version.
If you are working in a minimal container or restricted hosting account, you may not be allowed to install packages. In that case, ask the system administrator to provide the utility or perform extraction in an approved build or staging environment. Avoid downloading an unverified binary into a live server merely to obtain the command.
Rank #4
Permissions, ownership, and shared-server effects
The account must have read permission on the ZIP and write and search permission on the destination and its parent directories. A command can appear correct yet fail because the service account cannot traverse a parent directory, the filesystem is mounted read-only, or the destination has no free space.
Extraction also creates files under the identity and default permission environment of the process. Check the result with ordinary shell tools:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchls -la /srv/app
find /srv/app -maxdepth 2 -type f -print
Review ownership and mode bits after extraction, especially when a web server, worker, or deployment account will consume the files. Do not solve a permission failure by making the entire destination world-writable. Instead, identify which account needs access and apply the least privilege compatible with the service.
On a shared server, coordinate with other users before using -o. A file that belongs to another application or operator may be silently replaced. A dedicated release directory and a service-specific account reduce that risk.
Security precautions for untrusted archives
- Inspect before writing: run
unzip -land check every top-level path and sensitive-looking filename. - Test before deployment: run
unzip -tqand stop if it reports an error. - Use a non-sensitive destination: stage unknown content in a dedicated directory rather than a system directory or a live application tree.
- Use least privilege: extract as the account that should own the files, or use an approved administrative workflow when ownership must be set separately.
- Choose non-overwrite behavior by default: prefer
-nwhen existing data must be protected. - Review what was written: inspect the destination after extraction and check ownership, permissions, and unexpected files.
These steps reduce the chance that an archive’s contents will alter an unrelated directory. They do not make malicious software safe to execute; treat scripts and binaries as untrusted until they have been reviewed and approved.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Practical command recipes
Stage a release without replacing current files
pwd
ls -l /var/tmp/releases/site.zip
unzip -l /var/tmp/releases/site.zip
unzip -tq /var/tmp/releases/site.zip
mkdir -p /srv/app-staging
unzip -n /var/tmp/releases/site.zip -d /srv/app-staging
ls -la /srv/app-stagingThis sequence keeps inspection, integrity testing, destination creation, non-overwriting extraction, and review as separate visible steps.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsReplace files in a controlled deployment directory
unzip -l release.zip
unzip -tq release.zip
unzip -o release.zip -d /srv/appUse this only when /srv/app is the confirmed target and replacement is the intended deployment action. It does not remove obsolete files that are no longer present in release.zip; cleanup or version switching requires a separate, explicitly planned operation.
Extract documentation only
unzip archive.zip 'docs/*.txt' -d /srv/docsQuote the pattern and verify the listing first so you know the archive uses the expected docs/ prefix.
Best Value
Troubleshooting common failures
“command not found”
The utility is absent or not on the account’s PATH. Confirm with unzip -v. If it is unavailable, install the distribution’s unzip package through the official package manager or ask an administrator to do so.
“cannot find or open” the archive
Check the working directory with pwd, verify the exact spelling and capitalization with ls -l, and use an absolute path. Linux filenames are case-sensitive, and a shell alias or a different login directory may not be where you expected.
Permission denied
Check read permission on the archive and write and traversal permission on the destination and its parents. Confirm whether the filesystem is read-only and whether the destination belongs to another service account. Move staging to a directory intended for your account or obtain the required administrative change rather than broadly loosening permissions.
The archive fails the test
Run unzip -tq again with the correct file path and preserve the output for diagnosis. A damaged or incomplete upload must be replaced or recreated; extracting whatever happens to work can leave a partial deployment.
Files appeared in an unexpected subdirectory
Read the member names from unzip -l. The archive may contain a top-level directory such as release/. Extracting normally preserves that structure. If flattening is genuinely appropriate, use -j only after checking for filename collisions.
Existing files were not replaced
You may have used -n, which intentionally skips existing files. If replacement is approved, rerun with -o against the verified destination. Remember that overwriting still will not delete files absent from the archive.
A password prompt fails
Re-enter the password interactively and confirm that the archive is the one intended. Do not paste the password into a -P argument. If the password is unknown or the archive uses an encryption method the installed utility cannot process, obtain the credential or an appropriately supported archive through an approved channel.
Choosing the right command
| Situation | Recommended form | Reason |
|---|---|---|
| You are unfamiliar with the archive | unzip -l archive.zip, then unzip -tq archive.zip |
Shows paths and checks readability before any files are written. |
| Extract into a staging directory | unzip archive.zip -d /srv/staging |
Makes the destination explicit and keeps content isolated. |
| Never replace existing files | unzip -n archive.zip -d /srv/app |
Skips collisions. |
| Controlled replacement deployment | unzip -o archive.zip -d /srv/app |
Overwrites without prompts; requires a verified target and rollback plan. |
| Only a subset is needed | unzip archive.zip 'pattern' -d /srv/app |
Extracts matching members; quoting protects the pattern from shell expansion. |
| Archive paths must be discarded | unzip -j archive.zip -d /srv/app |
Flattens names, with possible collisions. |
| Archive requests a password | unzip archive.zip |
Prompts without exposing a command-line password. |
Final operational checklist
- Is the archive path correct, and can the account read it?
- Did you run
unzip -land verify the stored paths and filenames? - Did
unzip -tqcomplete successfully? - Is the destination dedicated, writable, and outside sensitive system directories?
- Should existing files be preserved with
-n, or is controlled replacement with-oexplicitly required? - Do you need normal directory preservation, selective extraction, or path flattening with
-j? - If the archive is encrypted, will the password be entered interactively rather than placed in
-P? - After extraction, did you review files, ownership, permissions, and the service account’s access?
For the ordinary case, the dependable pattern is therefore: inspect, test, extract to an explicit directory, and select the overwrite behavior consciously. That keeps a one-line ZIP operation predictable even on a busy shared Linux server.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
