Open RPM files in your browser
The package Fedora, Red Hat, AlmaLinux and openSUSE install software from. Open one right here to see what it installs, the scripts it runs and who signed it. Nothing leaves your device.
Or drop it anywhere on this page
What you'll see
Your app opens like a folder, its files listed on the left, with a page beside them on what it is, who signed it and what it asks for.
- Its signature • Checked inside your browser
- SHA-256 • Compare it or look it up on VirusTotal
- Heads-ups • What it asks for and what runs
- Its files • Manifests open as text
About RPM
An RPM is a header of the package's details, its name, version, what it requires and every file it installs with its hash, then a cpio archive of those files, compressed with xz, zstd or gzip. Scriptlets run as root before and after it installs and is removed, and triggers when other packages change.
Packages are signed with OpenPGP: a signature over the header, which holds the files' hashes, and a digest of the whole payload. dnf and zypper check it against the keys of the repositories you trust, like Fedora's or openSUSE's.
Filepeek checks the signature against the keys of Fedora, Red Hat, AlmaLinux, Rocky Linux and openSUSE it carries, and the payload against its digest. It lists the requirements, every file it installs and each scriptlet, which opens as text, and flags programs that run with root's rights.
RPM package
.rpm
Format
- MIME type
- application/x-rpm
- Made by
- Red Hat
- Released
- 1997
Inside the file
- Header
- The package's details and files
- Files
- A cpio archive, compressed
- Scripts
- Scriptlets and triggers, as root
- Signature
- OpenPGP, over the header and payload
Opens in every browser
No browser opens an RPM: they download it. Filepeek opens it as a folder in Chrome, Edge, Firefox and Safari.
- YouChromeOpens through Filepeek
- YouEdgeOpens through Filepeek
- YouFirefoxOpens through Filepeek
- YouSafariOpens through Filepeek
Questions
How do I see what an RPM installs without installing it?
Drop it on this page or choose Peek an RPM. A page shows the package, what it requires and the scriptlets it runs as root, and every file it installs is listed like a folder.
Can I check an RPM's signature?
Yes. Filepeek checks its OpenPGP signature against the distros' keys it carries and says whose key signed it. A package signed with another key shows the key's ID, to check against its maker's.
How do I look up an RPM on VirusTotal?
Filepeek works out its SHA-256 inside your browser. Look up on VirusTotal opens VirusTotal's page for that hash, and only the hash goes, never the file. Compare checks it against a SHA-256, SHA-1 or MD5 you paste.
Does opening an RPM install it?
No. Filepeek only reads it: nothing in it runs, nothing is installed and it never leaves your device.
Can I get files out of an RPM?
Yes. Pick any file on the left to open it. Its scriptlets open as text. Export saves them all as a ZIP, or, in Chrome and Edge on a computer, extracts them into a folder.