What an encrypted ZIP file really protects

What "encrypted ZIP" really means

A ZIP file is a container. It bundles many files, called entries, together, and stores each one with its own header and, usually, its own compression. Encryption in ZIP is applied to individual entries rather than to the container as a whole. When an entry is encrypted, its compressed bytes are scrambled with a cipher keyed by your password, so the data cannot be read without it. The surrounding structure that tells a program where each entry begins and ends is left in the clear.

An encrypted ZIP protects the contents of the files inside it, but by default it does not hide the fact that those files exist, nor their names.

What stays visible

Every ZIP ends with a central directory: an index that lists each entry's name, its compressed and uncompressed sizes, timestamps, CRC-32 checksum, and the offset where its data lives. In a normal encrypted ZIP, that index is stored in plaintext. Anyone who has the file can read the filenames, the folder layout, and the sizes, even though they cannot open the contents.

If hiding the names matters, there are two options. One is a less common scheme that encrypts the central directory itself, which few everyday tools produce or read. The other, and the more portable, is to wrap the entire archive inside an outer encrypted container, so the ZIP structure is never exposed on its own. For most encrypted ZIPs you meet in practice, the names are readable.

The "encrypted" bit

Each entry carries a small set of flags called the general purpose bit flag. The lowest bit, bit 0, is the encrypted bit: when it is set, a reader knows the entry's data is protected and a password is required. Additional flags and an extra field attached to the entry record which encryption scheme is in use. This metadata is how any compliant tool, ours included, can look at a ZIP and know what to expect before a single password is tried.

Two common schemes

Almost every encrypted ZIP you will encounter uses one of two methods. Traditional PKWARE encryption, widely known as ZipCrypto, is the original scheme built into the format decades ago. WinZip AES is the modern replacement, based on the Advanced Encryption Standard. They differ sharply in strength and in how quickly a password can be tested.

Which scheme an archive uses is decided by whoever created it, not by you. Some older or minimal tools still default to ZipCrypto for compatibility, while most current archive managers offer WinZip AES and many prefer it. Because the choice is baked in when the file is written, you cannot change one existing scheme into the other without re-creating the archive, and recovery has to work with whatever is already there.

How to tell if a ZIP is encrypted

The simplest sign is your operating system. If opening a file inside the archive brings up a password prompt, at least that entry is encrypted. For more detail, an archive manager such as 7-Zip shows a Method column for each entry: an encrypted entry lists ZipCrypto or AES-256 next to the compression method, while an unencrypted entry shows only the compression, for example Deflate or Store. The command-line zipinfo marks encryption another way. It prints one letter per entry for text or binary content and capitalizes that letter, T or B, when the entry is encrypted; it names compression in its own shorthand, such as stor or defN, and prints no scheme name at all. Because encryption is per entry, it is possible, though unusual, for one archive to mix encrypted and unencrypted files. For a step-by-step walkthrough, see how to identify an encrypted ZIP.

Automatic detection

You do not need to identify the scheme yourself. When you select a ZIP in the recovery tool, it reads the central directory and its extra fields, then reports whether the archive uses ZipCrypto or WinZip AES, along with the AES key size where relevant. Detection runs on your device, before any recovery begins, so the correct check is chosen automatically. To see exactly what happens at each step, read how the recovery process works.