Open NUPKG files in your browser
A .NET library as NuGet hands it out. Open one right here to see what it targets, what it needs and who signed it. Nothing leaves your device.
Or drop it anywhere on this page
What you'll see
Your app opens like a folder, its files listed on the left, with a page beside them on what it is, who signed it and what it asks for.
- Its signature • Checked inside your browser
- SHA-256 • Compare it or look it up on VirusTotal
- Heads-ups • What it asks for and what runs
- Its files • Manifests open as text
About NUPKG
A NUPKG is a ZIP with a .nuspec naming the package, its version, authors, licence and dependencies for each framework, and its assemblies in lib/ under the frameworks they target. build/ holds MSBuild files that join every build of a project that uses it, and tools/ can hold PowerShell scripts.
Packages carry signatures in .signature.p7s: an author's, made with a code signing certificate, and a repository's, which nuget.org adds to every package it serves. Each signs a hash of the whole package, so nothing in it can change without the signature failing.
Filepeek checks every signature, its certificate chain and its timestamp inside your browser, and Check now asks the CA whether it revoked a certificate. It reads the .nuspec, lists the frameworks and dependencies, and flags what runs in your builds or as it installs.
NuGet package
.nupkg
Format
- MIME type
- application/zip
- Made by
- Microsoft and the .NET Foundation
- Released
- 2010
Inside the file
- Container
- ZIP (Open Packaging Conventions)
- Details
- The .nuspec
- Code
- Assemblies in lib/, by framework
- Signatures
- Author and repository, in .signature.p7s
Opens in every browser
No browser opens a NUPKG: they download it. Filepeek opens it as a folder in Chrome, Edge, Firefox and Safari.
- YouChromeOpens through Filepeek
- YouEdgeOpens through Filepeek
- YouFirefoxOpens through Filepeek
- YouSafariOpens through Filepeek
Questions
How do I see what a NuGet package holds?
Drop it on this page or choose Peek a NUPKG. A page shows the package, the frameworks it targets, its dependencies and what joins your builds, and its files are listed like a folder.
Can I check a NuGet package's signature?
Yes. Filepeek checks the author's and nuget.org's signatures over the package's hash, their certificate chains and timestamps, and says who signed it.
How do I look up a NUPKG on VirusTotal?
Filepeek works out its SHA-256 inside your browser. Look up on VirusTotal opens VirusTotal's page for that hash, and only the hash goes, never the file. Compare checks it against a SHA-256, SHA-1 or MD5 you paste.
Does opening a NUPKG install it?
No. Filepeek only reads it: nothing in it runs, nothing is installed and it never leaves your device.
Can I get files out of a NUPKG?
Yes. Pick any file on the left to open it. The .nuspec opens as XML. In Chrome and Edge on a computer, Export extracts them all into a folder.