About
Private ZIP recovery you can verify
ZipRecover helps people get back into archives they own or are authorized to access, without handing their files to a server.
Why we built it
Forgetting the password to a ZIP you created is common and frustrating. Many online "recovery" services solve it by asking you to upload the archive to their servers, which means trusting an unknown party with a file you clearly consider worth protecting. That never sat right with us.
ZipRecover skips the upload altogether. Modern browsers can run real cryptographic code through WebAssembly, fast enough to test passwords locally. So we moved the entire process onto your device. Your file is read in the browser, tested in the browser, and the result is shown only to you. The archive, its file names and the passwords tried are never uploaded.
What we believe
Local by default
Recovery belongs on your device. We built the tool so your archive never has to be uploaded to anyone.
Limits stated up front
A long, random, unknown password on AES-256 is not feasibly recoverable, and we say so rather than promising results. Success depends on the password's shape and your clues, not on any server-side database.
Authorized use only
The tool exists for people recovering their own archives or ones they are permitted to access.
Built on published code
Key derivation, HMAC and CRC-32 come from established open-source code or the browser's Web Crypto; the ZipCrypto keystream follows PKWARE's published specification.
Who it is for
- People who forgot the password to an archive they created.
- Someone who was given an archive and the authorization to open it.
- IT and support staff recovering archives with the owner's permission.
It is not for accessing files you have no right to. That use is prohibited by our Acceptable Use Policy, and depending on where you are, it may be a crime.
How it is built
ZipRecover is built and operated by Neverland Technologies, LLC. The data flow, the open-source components, and the transport headers are laid out on the security and privacy page.
How we test it
The engine is tested against archives it did not create. A script generates encrypted fixtures with zip.js, an independent ZIP library, covering WinZip AES-128, AES-192, and AES-256 as well as legacy ZipCrypto.
A Node proof run (npm run prove) loads each fixture into the
real WebAssembly engine, checks that it detects the scheme, recovers the
known password from a short list, and reports every wrong list as exhausted
rather than claiming success; zip.js then confirms that the password opens
the archive. A Playwright end-to-end suite drives the recovery page in
Chromium on the build server.
A note on our policies
Our Terms, Privacy Policy, and Acceptable Use Policy are first drafts published for transparency. They are not a substitute for professional legal advice and are marked for review by counsel.
Ready to recover your ZIP password?
Runs locally in your browser. Your archive never leaves your device.