Before you open, recover, or re-secure a ZIP file, it helps to know exactly what you are holding: whether it is encrypted at all and, if so, with which scheme. A password prompt answers the first question but not the second, and a file can be compressed without being encrypted.

Quick signs a ZIP is encrypted

  • Extracting it prompts you for a password.
  • Some tools show a lock icon, or an “encrypted” column, next to the entries.
  • An attempt to open a file fails with a message about a wrong or missing password.

Any one of these confirms encryption. None of them tells you which scheme is in use, and that distinction decides how safe the contents are and how a recovery attempt will go.

Encrypted is not the same as compressed

Every ZIP compresses, or at least stores, its entries. Compression is not protection: a merely compressed ZIP opens for anyone with any ZIP tool, while encryption is a separate layer applied on top, and only that layer asks for a password. The size of a file, or the fact that it is obviously compressed, says nothing about whether it is encrypted.

What the format itself reveals

Each entry’s header records whether it is encrypted and how, so the structure settles the question even when the archiver’s interface does not.

The encryption flag

Every entry has a general purpose bit flag, and its lowest bit is set when that entry is encrypted. If that bit is clear on every entry, the archive is not protected at all, regardless of what the file name suggests.

ZipCrypto markers

A ZipCrypto entry has the encryption bit set but otherwise uses an ordinary compression method, and it prepends a 12-byte encryption header to its data. The tell is what is missing: there is no AES extra field to find. An encrypted entry that looks otherwise ordinary is ZipCrypto.

WinZip AES markers

An AES entry is more distinctive:

  • Its compression method is recorded as 99, a placeholder that means “look in the AES extra field for the real method.”
  • It carries an extra field with the identifier 0x9901.
  • Inside that field, a strength byte holds 1, 2, or 3 (meaning AES-128, AES-192, or AES-256), and a separate two-byte version field says whether the entry uses the AE-1 or AE-2 variant.
Marker ZipCrypto WinZip AES
Encryption bit set Yes Yes
Compression method Normal (stored or deflate) 99
Extra field 0x9901 Absent Present
Records key strength No Yes (strength byte 1, 2, or 3 = AES-128, -192, -256)

AE-1 versus AE-2

The variant byte in the AES extra field distinguishes two closely related formats that share the same encryption. In AE-1, the entry’s stored CRC-32 field still holds the real checksum of the uncompressed data, which allows an integrity check against the original. AE-2 sets that field to zero. The HMAC authentication code already guarantees integrity, and a stored CRC could leak a small amount of information about the hidden contents. Both variants use the same AES key size and the same PBKDF2 derivation, so the choice affects verification details rather than the strength of the encryption itself.

Tools that report encryption

Verbose listings expose the same fields without a hex editor.

  • Command line: zipinfo -v (or unzip -Z -v) shows the encryption flag and the compression method for each entry, and 7-Zip’s 7z l -slt lists an encryption method for each file. Plain unzip -l lists names only.
  • 7-Zip’s graphical version shows an encryption method column when you open the archive.
  • On macOS, the built-in Archive Utility prompts for a password on ZipCrypto archives but cannot open WinZip AES entries (it fails with an error), and the zipinfo command reveals the flags either way.
  • A local detector: you can load the archive into a browser tool that parses it on-device and names the scheme for you. Our guide to encrypted ZIP files walks through what such a report means, and the parsing happens locally, so the file is not uploaded.

Why the file names may still be visible

You can often list the contents of an encrypted ZIP without the password, which surprises people. It is how the format works. Standard ZIP encrypts each entry’s data but leaves the central directory readable, so names, sizes, and timestamps stay visible even when the contents are locked. If those names are themselves sensitive, the plain ZIP format is not enough on its own.

Knowing the scheme guides your next step

  • With ZipCrypto, treat the contents as lightly protected and consider re-encrypting with AES. The mechanics and weaknesses are covered in ZipCrypto explained.
  • An AES archive is strongly protected, and any recovery attempt will be slow by design. Our overview of AES encryption explains why that is intentional.
  • Whichever scheme you find, if the archive is your own and you have lost the password, you can attempt local recovery from the recovery page.

Identify and recover only archives you own or are authorized to access; that rule applies to every step above.

Sources