Features
Safety Check (Safe Extract)
Archydes checks an archive’s contents before anything lands on your Mac. Here’s how to read the results.
As soon as an archive is open, Archydes looks at its table of contents. Nothing is extracted for this. The result appears in the bar above the file list.
The safety bar
| Color | Meaning |
|---|---|
| Green: Nothing suspicious | Nothing suspicious was found. |
| Yellow | Notes that are usually harmless, such as Office documents with macros or files downloaded from the internet. |
| Red: Caution: … warnings | Something in the archive could harm your Mac or is trying to deceive you. |
Click Details to open the overview with all checks. Under each item, you can expand the list of affected files.
If there are warnings, Archydes asks again before extracting.
What’s checked
Dangerous paths and archive bombs
- Paths outside the destination folder: Entries such as
../../Library/…or absolute paths would write files outside the folder you chose. Archydes neutralizes them when extracting. Such paths almost only appear in manipulated archives. - Links pointing outside: Archydes creates symbolic links that point outside the archive as links, but never follows them.
- Archive bombs: An archive that expands to many times its size may be a “zip bomb” meant to fill up your disk. Archydes warns you, and stops immediately if more data comes out than declared.
- Disk space: Archydes shows how much space extracting needs and how much is free.
Programs, scripts and macros
- Disguised programs:
Invoice.pdf.applooks like a document, but it’s a program. - Apps and programs: Archydes checks the signature: Who signed it, is it an identified developer, and has Apple notarized the app?
- Scripts: Archydes reads scripts without extracting them and reports suspicious commands: downloading files from the internet, requesting administrator rights, deleting files, setting up automatic launch or bypassing Gatekeeper.
- Installers and disk images: These can make changes to the system.
- Office documents with macros: Only enable macros if you trust the source.
- Windows programs: They don’t run on a Mac, but take care when passing them on.
Origin and integrity
- Downloaded from the Internet: Archydes shows where the archive came from. The marker is passed on to the files when you extract them, so macOS checks any programs they contain when they first run.
- Integrity: Archydes reads all the data once and compares the checksums. If the archive contains a
SHA256SUMSfile, it’s checked too. Up to 512 MB this happens automatically; for larger archives, click Check Integrity Now. - Encrypted files: Archydes can check their contents only after you enter the password.
What the check is not
So a green bar means Archydes found nothing suspicious. Still, only open programs from sources you trust.
Check from the Finder
If the Finder menu is turned on, right-click an archive and choose Archydes › Inspect Security. Archydes then opens the archive with the overview already showing.