Encrypting a ZIP file is only as strong as the choices around it: the scheme you pick, the passphrase you choose, and how you store and share it. Get those right and a ZIP is a perfectly reasonable way to protect files. The defaults work against you, though: many archivers still pick the legacy scheme, and the easiest way to send a secret is the same email as the file. A password manager removes the third weak point, having to remember the passphrase at all, and makes the other two easier to get right.

Choose AES, not ZipCrypto

This is the single most important choice. Many tools still default to the legacy scheme for compatibility, so you often have to select strong encryption explicitly.

  • In 7-Zip, keep the archive format as zip and choose AES-256 as the encryption method, or use the 7z format, which always uses AES.
  • In WinZip, Keka, and similar tools, look for an AES or “strong encryption” option rather than the legacy one.
  • Be cautious with any archiver whose ZIP password option only offers the old scheme (7-Zip defaults .zip to ZipCrypto until you change the method), because that produces the weak format. The compress options in File Explorer and Finder cannot add a password; zip -e in the macOS Terminal can, but only with weak ZipCrypto.

Our overview of AES encryption for ZIP files explains what makes it strong.

Choose a passphrase, not a password

Length is the dominant factor. AES key derivation is already strong, so an attacker who cannot break the algorithm is left guessing, and the format’s PBKDF2 step slows every guess. What decides the outcome is how many guesses are needed, and that count grows quickly with length and unpredictability.

  • Prefer a passphrase of several unrelated words over a short, complex string. Length adds far more resistance than swapping a for @.
  • Avoid names, dates, and anything tied to the file’s contents or its recipient.
  • Do not reuse a passphrase that you use anywhere else.

Let a password manager do the hard part

A password manager is the real fix for the human side of the problem. It generates long, random passphrases that you never have to memorize, and it stores them securely, tied to the file name or project, so you can find them again later. Filling them in when needed and keeping an encrypted, backed-up record come with it.

The manager only helps if the entry is findable and the sharing goes through it:

  • Store the archive’s passphrase as its own entry, with the file name in the title and a note describing what it protects.
  • When someone else needs the passphrase, use the manager’s secure sharing feature rather than chat or email.
  • Protect the manager itself with a strong master passphrase and a second factor, since it now holds the key to every archive you have made.

Weaker versus stronger choices at a glance

Choice Weaker Stronger
Scheme ZipCrypto WinZip AES-256
Secret Short, reused password Long, unique passphrase
Storage Memory or a sticky note Password manager entry
Sharing Same email as the file Out-of-band or secure share

Protect more than the contents

A ZIP password covers less than people assume. It protects the contents of each entry, and it does nothing about the file names, the channel the passphrase travels through, or whether the file itself survives.

  • Standard ZIP leaves the directory readable, so names and sizes are visible even when contents are encrypted. If the names themselves are sensitive, use a container that encrypts the header, such as the 7z format with header encryption enabled, or place the archive inside an encrypted volume.
  • Never send the passphrase alongside the archive. Share it through a completely different channel, so intercepting one does not reveal the other.
  • An encrypted archive is still just a file, and a lost copy is lost data. Keep a backup.

Confirm it opens before you rely on it

Do one dry run. After creating the archive, close your tools and open it again using the stored passphrase, ideally on the same device that will actually need it. This catches two common mistakes early: a passphrase that was mistyped when you set it, and a recipient whose software does not support the AES variant you chose. A short check now avoids a locked-out file later, when the original source data may no longer be at hand.

If you ever lose access

Even with good habits, a passphrase occasionally goes missing. If it is your own archive, start with the calm, methodical approach in our guide to what to do when you forget a ZIP password, and remember that recovery is realistic mainly when you can narrow the search with something you remember. On-device recovery is available on the recovery page, and it never uploads your file.

This applies only to archives you own or are authorized to access.

Our security overview explains the principles behind these habits, and why keeping sensitive work on your own device is the safest default.

Sources