How to Encrypt ZIP Files and Password-Protect Compressed Archives
Compressing files into a ZIP is routine, but not everyone knows that a standard ZIP doesn't encrypt data — it only compresses it. If you need to protect sensitive information, you need real encryption.
Standard ZIP vs encrypted ZIP
A .zip without a password does not protect its contents: anyone can open it and see the files. Adding a password enables encryption, but there are important differences between methods:
| Method | Security | Compatibility |
|---|---|---|
| ZipCrypto (legacy) | Weak — breakable in minutes | Maximum (all ZIP clients) |
| AES-128 | Good | Good (7-Zip, WinRAR, Info-ZIP) |
| AES-256 | Excellent | Good (7-Zip, WinRAR, Info-ZIP) |
Warning: Windows Explorer only supports ZipCrypto. If you create an AES-encrypted ZIP with 7-Zip, the recipient needs 7-Zip or another compatible client to open it.
Creating a ZIP with AES-256 encryption
On Windows with 7-Zip (free)
- Select files → right-click → 7-Zip → Add to archive
- Archive format:
zip - Encryption method:
AES-256 - Enter a password (minimum 16 characters recommended)
- Enable "Encrypt file names" for stronger privacy
- Click OK
On macOS via Terminal
macOS includes zip with basic ZipCrypto. For AES-256, install 7-Zip:
# Install 7-Zip on macOS
brew install sevenzip
# Create ZIP with AES-256
7zz a -tzip -mem=AES256 -p secure_archive.zip folder_or_files/
On Linux
# Option 1: native zip (ZipCrypto — weak)
zip -e archive.zip document.pdf
# Option 2: 7-Zip with AES-256 (recommended)
sudo apt install p7zip-full
7z a -tzip -mem=AES256 -p secure_archive.zip document.pdf
More secure alternative: 7Z with AES-256
If ZIP format compatibility isn't required, 7Z is preferable:
- Native AES-256 encryption with no extra configuration
- Better compression than ZIP
- File name encryption included by default
# Create 7Z with password (encrypts file names too)
7z a -t7z -mhe=on -p secure_archive.7z documents/
What encrypted ZIP doesn't protect
- File names and count aren't hidden (unless you use "Encrypt file names")
- ZIP file metadata (creation date, total size) is still visible
- Not equivalent to a full disk volume like VeraCrypt — files outside the ZIP remain unprotected
Password best practices
- Minimum 16 characters with uppercase, lowercase, numbers, and symbols
- Use a password manager (Bitwarden, KeePass) so you don't forget it
- Send the password via a different channel than the file (don't email both together)
- For technical recipients, consider public key encryption (PGP/GPG) instead
Recovering a forgotten ZIP password
If you've lost the password to an old ZIP:
- ZipCrypto: brute-force tools (hashcat, John the Ripper) can crack it if the password is weak
- AES-256: practically unrecoverable without the password — mathematically secure
- Commercial tools like PassFab for ZIP or Passware may work for simple dictionary-based passwords
AES-256 ZIP encryption effectively protects sensitive information for transfer. For long-term storage of critical data, consider full-disk encryption solutions.
Related conversions
Archive format conversions used most often: