March 1, 2026
Your .gz is gossiping
Gzpeek: Tool to Parse Gzip Metadata
Your compressed files are spilling secrets, and readers noticed
TLDR: A new tool, gzpeek, reveals hidden notes inside gzip files like original filenames and timestamps. The top comment calls out that gzip doesn’t show this info, while the classic file command does—prompting readers to re-check their archives and think twice about what their compressed files might reveal.
Plot twist: your humble .gz files carry hidden notes, and a new toy called gzpeek reads them like a diary. Built while learning Zig, it peeks at the metadata most of us forget exists—things like which system did the compressing, when it happened, the original filename, a comment field, and even how “hard” the compressor tried. The spec behind it all is RFC 1952, and the surprises keep coming: the “which operating system” byte is often unreliable, the “is this text?” flag basically never gets set, and the extra “effort” flag rarely matters in the real world.
The early comment section delivered instant side-eye. One reader basically asked, “Why doesn’t gzip itself show this?” and immediately pulled out receipts: the classic file command on Debian actually prints some of these hidden goodies—full example and all. That vibe—“old tools knew, new eyes care”—set the tone. People aren’t arguing; they’re nodding along and poking at their own archives, realizing those .gz files might be whispering filenames and timestamps they forgot about. It’s the kind of nerdy reveal that feels a bit like finding a post-it note in your suitcase: not scandalous, but juicy enough to check every pocket. And yes, everyone loves a clean little tool that makes the invisible obvious.
Key Points
- •gzpeek is a tool created to parse and display metadata in gzip headers.
- •gzip headers can include OS identifier, modification time, FTEXT flag, compression effort, original filename, comment, and extra subfields (RFC 1952).
- •Different libraries set the OS flag inconsistently; zlib varies by host OS, some set “unknown,” others hard-code “Unix.”
- •Modification time is a 32-bit Unix timestamp; many tools set it to 0, while gzip CLI may set it to current or file mtime.
- •The extra compression flag may indicate highest or fastest compression, but it’s often hard-coded and not used during decompression.