Encrypted Archives: How to Password-Protect ZIP, 7z, and RAR Files

The Problem With Most "Protected" Archives

Sending sensitive files in an archive feels like the responsible thing to do. Add a password, compress everything, send the ZIP. Job done.

Except the job is often not done — at least not securely. The single most common mistake is using ZIP's legacy encryption, known as ZipCrypto. ZipCrypto was designed in the early 1990s and has known cryptographic weaknesses that can be exploited by a determined attacker with a known-plaintext attack (if they can guess even a few bytes of one of the files in the archive). With modern computing power, ZipCrypto archives can be broken faster than you might expect.

The good news: the tools for proper encrypted archives already exist, are freely available, and are straightforward to use. This guide explains exactly how to do it correctly with ZIP, 7-Zip, and RAR — on any platform.

Encryption: What the Three Formats Actually Offer

ZIP: Two Very Different Encryption Options

ZIP is the universal archive format. Nearly every operating system can open a ZIP file without additional software. But "ZIP encryption" is not a single thing — there are two fundamentally different encryption methods hiding under the same file extension.

ZipCrypto (Legacy):

ZipCrypto is the default encryption algorithm when you right-click and add a password to a ZIP file in Windows Explorer. It is a stream cipher developed in the early 1990s, predating modern cryptographic standards. Known weaknesses include a known-plaintext attack that can recover the encryption key given approximately 12 bytes of known plaintext — something easily achievable when the archive contains files with predictable headers (like DOCX files, which always start with the same bytes).

Do not use ZipCrypto for anything sensitive.

AES-256 (Modern):

WinZip introduced AES-256 encryption for ZIP files (the "WinZip AES" format). 7-Zip also creates AES-256 encrypted ZIP files when configured to do so. This is the same algorithm used by governments and financial institutions. When implemented correctly, AES-256 is computationally infeasible to break with current and foreseeable technology — the key space is 2^256 possible keys.

The trade-off: AES-256 ZIP files cannot be opened by Windows Explorer's built-in ZIP handler. Recipients need WinZip, 7-Zip, or another tool that supports the AES-256 ZIP extension.

7-Zip: The Gold Standard for Free Encryption

7-Zip is a free, open-source archive utility that creates .7z files with AES-256 encryption and optional header encryption. Header encryption conceals the filenames, directory structure, sizes, and modification dates of the files inside — an eavesdropper opening the archive just sees an encrypted blob with no metadata about what is inside.

This makes 7z the best option for most use cases where you need strong encryption without paying for software. The format is supported by 7-Zip on Windows, p7zip on Linux, and Keka on macOS. It is not as universally openable as ZIP (recipients need a tool installed), but for any use case where you control both ends of the transaction, 7z is the right call.

7-Zip's AES-256 implementation also applies PBKDF2 (Password-Based Key Derivation Function 2) with a salt to derive the encryption key from your passphrase. This means brute-force attacks against a strong passphrase are computationally expensive even if the attacker has the archive file.

RAR / RAR5: AES-256 With Header Encryption Baked In

RAR5 (the format created by WinRAR 5.0 and later) uses AES-256 with SHA-256 for key derivation. Like 7-Zip, RAR5 supports header encryption, which hides filenames from anyone without the password.

RAR has one advantage over 7-Zip in professional contexts: wider acceptance. WinRAR is one of the most widely installed archive utilities in the world, particularly in corporate environments. If you need to send an encrypted archive to someone who may not have 7-Zip installed, a RAR5 file is more likely to be openable than a .7z file. WinRAR can also create self-extracting archives (.exe files) that open without any additional software — useful in some distribution scenarios.

The main limitation is that WinRAR is proprietary software, though it functions without a paid license indefinitely (with a periodic reminder to purchase). Creating RAR files requires WinRAR or a compatible tool; 7-Zip can read RAR files but cannot create them.

Head-to-Head: Format and Encryption Comparison

Creating Encrypted Archives on Windows

Method 1: 7-Zip with AES-256 and Header Encryption (Recommended)

7-Zip is free to download from 7-zip.org. Once installed:

1. Select the files or folder you want to archive.
2. Right-click → 7-Zip → Add to archive.
3. In the "Add to Archive" dialog:
   • Archive format: 7z
   • Compression level: Normal or above (lower compression slightly reduces security through data analysis)
   • Encryption: Enter your password in both fields
   • Encrypt file names: Check this box (enables header encryption)
4. Click OK.

The resulting .7z file has its filenames, sizes, and content all encrypted under AES-256.

Command-line equivalent (Windows):

7z a -t7z -mhe=on -p"YourStrongPassphrase" output.7z file1.docx folder/

• -t7z — 7z format
• -mhe=on — header encryption (encrypts filenames)
• -p"YourStrongPassphrase" — the password

Method 2: ZIP with AES-256 via 7-Zip (For Maximum Compatibility)

When the recipient does not have 7-Zip but you still want AES-256:

1. Right-click → 7-Zip → Add to archive.
2. Set Archive format: zip
3. Set Encryption method: AES-256 (not ZipCrypto — change this explicitly)
4. Enter your password.
5. Click OK.

Note: Header encryption is not available in ZIP format. Filenames are visible.

Command-line:

7z a -tzip -mem=AES256 -p"YourStrongPassphrase" output.zip file1.docx folder/

The -mem=AES256 flag is what forces AES-256 instead of the legacy ZipCrypto default.

Method 3: WinRAR with RAR5 and Header Encryption

1. Select files → right-click → Add to archive (in WinRAR).
2. In the Archive dialog:
   • Archive format: RAR5
   • Click Set password
   • Enter password and check Encrypt file names
3. Click OK.

WinRAR command-line:

rar a -hp"YourStrongPassphrase" -ep1 output.rar file1.docx folder/

• -hp — sets password with header encryption (use -p for content-only encryption without header encryption)
• -ep1 — exclude base folder names from paths stored in archive

Creating Encrypted Archives on macOS

macOS's built-in Archive Utility does not support encrypted archives (only unencrypted ZIP). Use one of these alternatives:

7-Zip via Homebrew (command-line):

brew install p7zip
7z a -t7z -mhe=on -p"YourStrongPassphrase" output.7z /path/to/files/

Keka (GUI application, free on keka.io):

1. Download and open Keka.
2. Set the format to 7Z in the sidebar.
3. Enter a password.
4. Enable "Encrypt the filename" (equivalent to -mhe=on).
5. Drag your files onto the Keka window.

The Unarchiver can open 7z and RAR files on macOS. For creating RAR files, WinRAR does not have a macOS version; use 7z instead.

Creating Encrypted Archives on Linux

Linux has the best command-line support for all three formats:

7z (recommended):

# Install
sudo apt install p7zip-full  # Debian/Ubuntu
sudo dnf install p7zip p7zip-plugins  # Fedora

# Create encrypted 7z with header encryption
7z a -t7z -mhe=on -p"YourStrongPassphrase" output.7z /path/to/files/

Encrypted ZIP with AES-256:

# The standard zip utility does not support AES-256 — use 7z to create AES-256 ZIP
7z a -tzip -mem=AES256 -p"YourStrongPassphrase" output.zip /path/to/files/

# Alternatively, 'zip' on Linux creates ZipCrypto by default (NOT recommended)
# zip -e output.zip files/  # This uses ZipCrypto — avoid

RAR via WinRAR for Linux:

# Install WinRAR for Linux (rar package)
# Create RAR5 with header encryption:
rar a -hp"YourPassphrase" -ma5 output.rar /path/to/files/

The -ma5 flag specifies RAR5 format.

Passphrase Best Practices

Encryption algorithm strength is only half the equation. A 256-bit key derived from the password "hello" is catastrophically weak. The passphrase quality determines actual security.

What makes a strong passphrase:

• At least 16 characters
• Combines letters (upper and lower), numbers, and symbols
• Does not appear in any dictionary or word list
• Not reused from any other service

For shared archives, avoid:

• The company name or project name
• The recipient's name
• Keyboard patterns (qwerty, 123456)
• Predictable substitutions (p@$$w0rd)

The passphrase is often the weakest link. A 12-character random alphanumeric passphrase like X7mK9nPq2vLt takes longer to brute-force than the heat death of the universe against AES-256 — but a dictionary word can be cracked in minutes regardless of the encryption algorithm.

When to Use Encrypted Archives vs Password-Protected PDF

Both encrypted archives and password-protected PDFs protect content behind a passphrase. The choice depends on what you are protecting and how it will be used.

Use an encrypted archive when:

• You need to protect multiple files at once
• File types other than PDF are involved (DOCX, images, spreadsheets)
• The recipient needs the original file format, not a viewing-only document
• You want to hide filenames as well as content (use 7z with header encryption)

Use a password-protected PDF when:

• You are distributing a document for viewing or printing, not editing
• The recipient may not have archive software installed
• You want to restrict specific actions (printing, copying text)
• Universal compatibility is essential — virtually every device can open a PDF

For password-protecting PDFs, our password protect PDF tool adds 256-bit AES encryption directly in the browser. For converting between archive formats or extracting files to re-archive in a more secure format, you can convert RAR to ZIP or use our document converter for changing file types before archiving. See all available file tools at our tools directory.

Why Header Encryption Matters

When header encryption is disabled, anyone with access to the archive file can see the list of filenames inside — even without the password. This is more revealing than it sounds.

Consider an archive containing:

• NDA-AcquisitionTarget-Inc.pdf
• Due-Diligence-Report-Final.docx
• Board-Minutes-Q4-2025.pdf

Even without cracking the encryption, an attacker knows who is involved, what type of document it is, and the general subject matter. In legal, financial, or competitive contexts, this metadata leak alone can be damaging.

With header encryption enabled in 7z or RAR5:

• Filenames are encrypted
• File sizes are hidden
• Directory structure is hidden
• Modification timestamps are hidden

The archive appears as a featureless encrypted blob until the correct passphrase is entered.

Sending Encrypted Archives Safely

Creating a strong encrypted archive is only half the workflow. Transmission matters too.

Email: Acceptable for encrypted archives, but be aware that email servers log message metadata (sender, recipient, subject, file size, timestamp) even if the content is encrypted. For classified or legally sensitive material, this metadata trail may be a concern.

File transfer services: Encrypted archives can be uploaded to any file transfer service — the encryption protects the contents regardless of whether the transfer service itself encrypts files in transit. Use services that support direct downloads without requiring account creation on the recipient's side.

Passphrase delivery: Never send the passphrase in the same message as the archive. A different channel (phone call, Signal message, or a separately timed email) is the standard approach. Even better: agree on a passphrase verbally before sending the file.

Frequently Asked Questions

Is ZipCrypto really that dangerous?

Yes, for anything sensitive. ZipCrypto uses a 96-bit key derived through a known-weak algorithm. A known-plaintext attack can recover the encryption key in seconds on modern hardware if the attacker knows 12 or more bytes of any file in the archive — which is trivially achievable because common file formats have fixed, predictable headers. DOCX, XLSX, PNG, JPEG, and PDF files all begin with known byte sequences. There are freely available tools that exploit this weakness. Use AES-256.

Does 7-Zip's AES-256 encrypt the ZIP TOC (table of contents)?

Not in ZIP format — the ZIP specification does not support encrypting the central directory (the table of contents where filenames are listed). When you create an AES-256 encrypted ZIP with 7-Zip, the file contents are AES-256 encrypted but the filenames remain visible. Only the 7z format supports full header encryption. If filename privacy is required, use 7z format.

Can an encrypted 7z file be cracked with a GPU?

The PBKDF2 key derivation used in 7-Zip's AES-256 implementation is specifically designed to be slow, which limits GPU brute-force throughput. Hashcat (the most capable GPU-based password cracker) achieves roughly 50,000 to 200,000 attempts per second against 7z on high-end GPU hardware, depending on configuration. Against a truly random 16-character alphanumeric passphrase, brute-force is computationally infeasible. The risk comes from weak passphrases: dictionary words, names, and common substitutions can be cracked in minutes even with the key derivation overhead.

What happens if I forget the passphrase?

There is no recovery mechanism for strong encrypted archives. AES-256 without a backdoor means the data is unrecoverable without the correct passphrase. This is by design — the security guarantee would be meaningless with a recovery mechanism. Keep passphrases in a password manager, or store them in a secure location separate from the archive itself.

Should I use compression and encryption together?

Yes, with one caveat: compress before encrypting, not the other way around. Encrypted data is essentially random noise, which does not compress well — compressing after encrypting adds file size without benefit. 7-Zip, WinRAR, and any properly implemented archive tool automatically compress first, then encrypt. The order is handled correctly by default.

Closing Thoughts

Encrypted archives are one of the most practical tools in the everyday security toolkit — not for hiding criminal activity, but for the mundane and important task of protecting sensitive business files, financial records, legal documents, and personal data from casual exposure.

The key points to remember: ZipCrypto is broken and should not be used for anything that matters. AES-256 in ZIP format protects content but not filenames. 7z with header encryption is the strongest option available for free. RAR5 with header encryption is a solid choice when recipients are likely to have WinRAR already.

Use a passphrase that would survive a dictionary attack, send the passphrase through a different channel than the file, and you have a genuinely robust solution with widely available, free tools. For more on archive formats and their trade-offs, see our comparison of ZIP vs RAR vs 7z formats, our guide to file conversion security, and the TAR, GZ, BZ2 Linux archive guide for Linux-specific workflows.