UnpackForge

Privacy

Your archives are never uploaded. That is not a policy commitment that could be quietly revised — it is a property of how the site is built, and you can verify it yourself in about thirty seconds.

What happens to a file you open

Nothing leaves the tab. When you drop an archive, the browser hands the page a File handle, which is passed to a Web Worker. The worker reads the bytes, parses the archive and writes the output as a Blob. Both of those are browser-managed storage on your own machine. No request carrying that data is ever made, because there is nothing on the other end to receive it: this site has no API routes, no server actions and no serverless functions.

How to check that yourself

  1. Open your browser’s developer tools and switch to the Network panel.
  2. Clear it, then convert or extract an archive.
  3. You will see the page’s own scripts, and — the first time you open a RAR or 7z — a one megabyte libarchive.wasm. Nothing else. No request contains any part of your file.

The site also sends a Content-Security-Policy header with connect-src 'self'. That means the browser itself refuses any network connection to another origin from this page. Even a bug or a compromised dependency could not send your archive somewhere, because the browser would block the request before it left.

Passwords

A password you type for an encrypted ZIP is held in memory for as long as that archive is open and is used only to drive the decryption running in the worker. It is never sent anywhere, never written to localStorage or a cookie, never included in a downloaded manifest, and gone the moment you close the tab.

What is collected

Vercel Analytics records page views: which page was loaded, roughly where in the world the request came from, and what kind of device it was. It is cookieless and does not build a profile of you across sites.

No custom events are sent. In particular, nothing records:

  • file names, paths or extensions
  • archive contents, sizes or checksums
  • metadata read out of your archives
  • passwords, or whether you entered one
  • which files you selected, or how many
  • whether a job succeeded or failed

That last one is a deliberate trade. Knowing which conversions fail would be genuinely useful for improving the site, and collecting it would mean sending something about your file to a third party. The site is less well instrumented as a result.

What is stored on your device

  • unpackforge.theme in localStorage — light or dark, nothing else.
  • Ordinary HTTP caching of the site’s scripts and the WebAssembly engine, so a second visit does not re-download them.

No cookies are set by this site. No account exists to create. There is no upload history because there are no uploads.

Third parties

One: Vercel, who host the static files and provide the analytics described above. The WebAssembly engine is served from this same origin rather than a CDN, specifically so that no third party sees a request when you open a RAR.

Contact

There is no personal data held here to request or delete. If something on this page turns out to be inaccurate, that is a bug worth reporting, and it will be corrected on the page rather than explained away.