Encoding and security guides

Gzip text payloads: identify the container before decoding

Trace text through UTF-8, Gzip and Base64, and distinguish Gzip from zlib or raw DEFLATE.

Nav Tools ·

Write down the transformation order

The site's Gzip encoder turns UTF-8 text into Gzip bytes and then returns Base64. Its decoder expects that Base64 wrapper.

Reverse the stages in order; a valid Base64 string might contain an entirely different binary format.

Text → UTF-8 bytes → Gzip bytes → Base64
Base64 → Gzip bytes → decompressed UTF-8 text

Inspect the magic bytes

A Gzip member begins with 1f 8b; the usual compression method byte is 08 for DEFLATE. A ZIP archive has a different container.

Inspect bytes before choosing a decoder. Renaming a file or removing a prefix cannot convert zlib or raw DEFLATE into Gzip.

Gzip header starts: 1f 8b 08
ZIP commonly starts: 50 4b 03 04

Compare decompressed content

Two valid Gzip streams can represent identical text with different compressed bytes because headers or compression choices differ.

For a text round trip, compare the decompressed text and UTF-8 bytes. Compare compressed hashes only when the exact container artifact matters.

Keep expansion bounded

Small compressed inputs can expand into very large outputs. Successful decompression does not imply safe memory usage.

The site bounds decompressed output to one million bytes. For larger data, use a streaming tool with an explicit output limit rather than disabling the guard.

References

← Encoding and security guides