Zlib Decompress

Zlib decompress (inflate) text data

The zlib decompress tool inflates data compressed with DEFLATE. It first tries the zlib format (RFC 1950) — the output of Python’s zlib.compress, PHP’s gzcompress, Java’s Deflater or Node’s zlib.deflateSync — and if the header does not match, it automatically retries as raw DEFLATE (RFC 1951), the format of PHP’s gzdeflate and ZIP entries.

Example

Zlib data (Base64):

eJzzSM3JyVcozy/KSVFU8MDFAQAGNw1Y

Decompressed:

Hello world! Hello world! Hello world!

Recognising the input

• Zlib data in Base64 usually starts with eJ (bytes 78 9C) or eN (78 DA); eA and eF appear at lower compression levels.
• In hex it starts with 78. Auto-detect treats all-hex input starting with 78 as hex; otherwise Base64 is assumed.
• URL-safe Base64, missing padding and line breaks are handled.

The status bar shows how many bytes went in and how many came out, which gives you the compression ratio at a glance and confirms that the whole stream was decoded.

What the two header bytes mean

A zlib stream starts with two bytes. The first, 78, says “DEFLATE with a 32 KB window”; the second records the compression level the encoder used and makes the pair divisible by 31, which is how decoders detect a valid header:

The third Base64 character also depends on the first byte of compressed data, hence the ranges. The stream ends with the Adler-32 checksum of the original data, big-endian. In the example above the last four bytes are 06 37 0D 58, the Adler-32 of the decompressed text.

Where zlib data turns up

• Application databases and caches that store compressed JSON or serialized objects.
• SAML redirect requests, which are raw-DEFLATE compressed and Base64 encoded (URL-decode them first).
• Git loose objects in .git/objects are zlib streams — convert the file to Base64 first to inspect one.
• PDF content streams with the FlateDecode filter.

Compressed payloads are often wrapped in further layers — URL encoding around Base64, or JSON around the Base64 string. Peel them off from the outside in: URL-decode, extract the string, then decompress here.

Inflating in code

Python’s zlib.decompress(data) expects the zlib header; pass wbits=-15 for raw DEFLATE, or wbits=47 to auto-detect zlib and gzip. Node.js offers zlib.inflateSync and zlib.inflateRawSync, and PHP gzuncompress and gzinflate for the two formats. Choosing the wrong one is the most common cause of “incorrect header check” errors — this tool simply tries both.

Troubleshooting

• Input starts with H4sI or 1f8b. That is gzip, not zlib. The gzip header is recognised and the data is decompressed here as well; Gzip Decompress is the dedicated page.
• “invalid stored block lengths”, “invalid block type” or “unexpected end of file”. The data is incomplete, corrupted, or not compressed at all.
• Unreadable output. The content is binary; download it with the output panel’s Download button.

To create zlib data, use Zlib Compress; for plain Base64 without compression, use Base64 Decode. Decompression runs in your browser and nothing is uploaded.

Zlib decompress in Python

zlib.decompress() works on bytes, so Base64 or hex text must be decoded first; passing the string itself raises TypeError: a bytes-like object is required. The other frequent error is incorrect header check, which means the data is not in zlib format. Raw DEFLATE needs wbits=-15, and wbits=47 accepts both zlib and gzip. The result is bytes again, so finish with .decode("utf-8") for text.

import base64
import zlib

encoded = "eJzzSM3JyVcozy/KSVFU8MDFAQAGNw1Y"

data = base64.b64decode(encoded)       # zlib needs bytes, not the Base64 text
print(data[:2].hex())                  # 789c = zlib header
print(zlib.decompress(data).decode("utf-8"))

# raw DEFLATE (no header): negative wbits
raw = data[2:-4]
print(zlib.decompress(raw, wbits=-15).decode("utf-8"))

The decompressor above returns the same text for this Base64 string and tries zlib and raw DEFLATE automatically; gzip data belongs in Gzip Decompress.