How to Password-Protect an Archive (and Is It Safe)

What an archive password actually is

Many people picture an archive password as a lock on a door: without the key, the files simply "won't come out." The reality is more interesting. When you set a password, the archiver encrypts the contents — turns the data into a meaningless stream of bytes. Your password isn't stored inside the archive; a special formula derives an encryption key from it, and that key locks the data.

Two things follow. First: there's nowhere to recover a forgotten password from — it isn't in the file — so you must safeguard it. Second, and crucial: strength depends not on the "door" but on how the data is encrypted. And here's the trap: the same ZIP format can encrypt in two completely different ways — one strong, one almost useless.

ZipCrypto — the illusion of protection

ZipCrypto is the old encryption method built into the ZIP format since the early 90s. Its big plus is compatibility: any program will open such an archive. And that's where the pluses end. ZipCrypto is an outdated stream cipher with a fundamental weakness, and people have long known how to break it.

The main threat is the known-plaintext attack. It sounds complex, but the idea is simple: if an attacker knows or can guess even a small fragment of one of the original files, they can recover the key. And guessing a fragment is often feasible — for example, files of known formats have predictable beginnings (JPG, PDF and DOCX headers are standard). Researchers have shown that in many cases the "known text" requirement reduces to a guess based on file type and size, while the crack itself runs in roughly two hours on a single ordinary computer, using free tools.

AES-256 — a real lock

AES-256 is the modern encryption standard — the same one that protects banking data and government secrets. AES is approved as an official standard (NIST FIPS 197), and in its 256-bit-key variant it resists all known practical attacks. The plaintext attack that's fatal to ZipCrypto doesn't work against AES-256 at all.

The good news: AES-256 is available in all three popular formats. In 7z and RAR it's the only encryption option — there's nothing to choose, protection is strong by default. In ZIP you have to choose manually: the archiver often offers ZipCrypto by default for compatibility, and AES-256 has to be selected explicitly. That's exactly why "I put a password on the ZIP" and "I securely protected the ZIP" are not the same thing. There's more on the differences between formats in the article ZIP vs RAR vs 7z.

Hidden file names: the detail people forget

Here's a nuance almost everyone misses. Even with AES-256, ZIP does not hide the file names inside the archive — only their contents are encrypted. So without knowing the password, an outsider still sees the structure: for instance, that it contains contract_jones.pdf, salaries_2026.xlsx and passwords.txt. Sometimes the names alone give away more than you'd like.

7z and RAR can encrypt the file list itself. In 7-Zip this is the "Encrypt file names" checkbox; in WinRAR it's "Encrypt file names" in the password dialog. With it on, the archive looks like a single opaque block from the outside: no names, no counts, no sizes. If the secret is not just the contents but the very existence of certain documents, this is the only correct choice.

How to set a password the right way

Let's fold it all into a short, safe sequence — the same in spirit for both 7-Zip and WinRAR:

Five mistakes that undo your protection

Even with the right cipher, people routinely leave gaps open. Here are the most common:

• Left ZipCrypto as the default. The classic: a password is set, but the cipher is weak. Always confirm AES-256 is selected.
• A simple password. "qwerty", a birthday, a pet's name — all cracked from a dictionary in seconds, regardless of the cipher.
• Password next to the archive. Sending the archive and the password in one email or chat cancels the point: whoever accessed the conversation got both.
• Forgot about file names. With ZIP the names are always visible; if that's critical, you need 7z/RAR with name encryption.
• Didn't save the password. With AES-256, a forgotten password means the data is lost for good — it can't be recovered. Store it in a reliable password manager.

The bottom line: a password on an archive really can protect your data — but only if it's AES-256 with a good password, not ZipCrypto with "12345". Learn once where the right checkbox lives, and protection becomes a habit. And if your goal isn't so much to lock files as to shrink them for sending, that's a separate topic, covered in how to shrink files for email.