How secure are password-protected ZIP files?

Security depends on the method, not the prompt

A ZIP that asks for a password can feel equally safe whatever tool made it, but that feeling is misleading. The password box looks the same either way. What actually protects your files is the encryption scheme the archive uses underneath, and the ZIP format supports two very different ones. Knowing which you have is the difference between a file a determined person can open and a file that stays shut.

The two schemes you will meet

Traditional ZipCrypto is weak

The original PKWARE encryption, usually called ZipCrypto, is a simple stream cipher with a 96-bit internal state and no key stretching, so a computer can test candidate passwords very quickly. Worse, it has a well-documented structural flaw. In 1994, Eli Biham and Paul Kocher published a known-plaintext attack on the PKZIP cipher: given at least 12 known bytes of one entry as it is stored in the archive (after compression, 8 of them in a row), an attacker can recover the internal keys and decrypt the whole archive without ever guessing the password. Because the attack works on the cipher state rather than the password, a longer password does not defend against it. ZipCrypto is fine for keeping honest people out of trivial files, but it should not be trusted with anything you would mind a capable stranger reading.

WinZip AES is strong

The modern scheme, WinZip AES, replaces that cipher with the Advanced Encryption Standard at 128, 192, or 256 bits. It derives the key from your password with PBKDF2-HMAC-SHA1 over 1000 iterations and a random salt, then authenticates each entry with a truncated HMAC-SHA1 in an encrypt-then-MAC design. AES has no practical shortcut, and the deliberate cost of PBKDF2 makes every guess expensive. The combination means that, with a good passphrase, the archive is not breakable by guessing on any hardware you are likely to face. That protection is built into the scheme; faster machines lower the cost of each guess, but exhausting the keyspace of a good passphrase stays far out of reach.

How the two compare

The gap between the two is not subtle. Against ZipCrypto, an attacker who knows at least 12 bytes of one entry as it is stored (after compression) can decrypt the archive without the password, and where that shortcut does not apply, the absence of key stretching still lets a machine try enormous numbers of guesses each second. Against WinZip AES neither avenue is open. That is why the method matters far more than how long or clever the password looks.

What encryption does not hide

Even strong encryption protects less than people expect. Neither ZipCrypto nor standard WinZip AES encrypts the archive's central directory, so the list of file names, their sizes, and their modification times stays in cleartext. Someone who cannot read a single byte of your data can still see that the archive holds salary-2026.xlsx and passport-scan.pdf, and roughly how large each one is. Contents are protected; the labels on the contents are not.

Practical guidance

Use AES rather than ZipCrypto whenever the data matters, and prefer AES-256 when the tool offers a choice. A strong cipher only helps if the passphrase is strong too, so use a long, unique passphrase rather than a short word you will reuse. Then store that passphrase in a password manager, because AES is built to be unforgiving: forget it, and there is no reset that will let you back in. Our guide to password-protecting a ZIP file shows the exact settings to use, and the overview of encrypted ZIP files explains how the pieces fit together.

Keep key size in perspective, too. AES-128 is already far beyond brute force, so moving up to AES-256 is a sensible default rather than a rescue from any real weakness. In practice the strength of your passphrase, not the number of bits in the cipher, decides whether the archive holds.

What the difference means for recovering your own password

ZipCrypto is very fast to test, so a search over a forgotten ZipCrypto password gets through many more candidates per second than an AES one. Whether it finds the password still depends on the hint you can give it, and we have no data on how often it does. If you also hold an unencrypted copy of a file from inside the archive and can reproduce at least 12 of its bytes as stored (after compression, 8 of them in a row), specialist tools can exploit the known-plaintext weakness to decrypt the archive without the password (ZipRecover does not use that attack; it tests candidate passwords).

AES is slow by design. Every guess runs the full PBKDF2 derivation, so recovery depends on narrowing the search with a good wordlist or a pattern you remember. There is no instant unlock for a strong, random AES password, and any product that claims otherwise is overselling. One quick tell when you inspect an archive: AES entries carry a salt, a verification value, and an authentication code, so very small files look slightly larger than they would under ZipCrypto. When you are ready, on-device recovery runs in your browser.