How to password-protect a ZIP file

A password is not always encryption

Most archive tools will happily put a password on a ZIP, but they do not all protect it the same way. The ZIP format supports two encryption schemes: the legacy ZipCrypto cipher, which is fast and weak, and WinZip AES, which is slow to attack and strong. Several tools still default to ZipCrypto, so the single most important part of protecting a ZIP is choosing AES-256 on purpose.

Windows: the built-in ZIP cannot do it

The Compress to ZIP feature built into Windows File Explorer cannot add a password at all. It makes ordinary, unencrypted archives and offers no password field anywhere in the flow. To encrypt a ZIP on Windows you need a separate tool.

Windows: 7-Zip with AES-256

7-Zip is free, open source, and the most reliable way to create an AES-encrypted ZIP on Windows. The one catch is that its default encryption method for the ZIP format is the weak ZipCrypto, so you must change it yourself.

1. Install 7-Zip. Download it from the official site, 7-zip.org, and run the installer.
2. Select your files. In File Explorer, select the file or folder, right-click, and choose 7-Zip, then Add to archive.
3. Choose the ZIP format. In the dialog, set Archive format to zip.
4. Set AES-256. In the Encryption section, open the Encryption method menu and change it from ZipCrypto to AES-256.
5. Enter a strong passphrase. Type a long, unique passphrase into the Enter password and Reenter password fields.
6. Create the archive. Click OK. The resulting .zip is encrypted with AES-256.

One limit remains. In the ZIP format, the file names inside the archive are not encrypted, so they remain visible even after you set a password. If the names themselves are sensitive, switch Archive format to 7z, which enables the Encrypt file names option, or place the files inside a single container first.

Confirm the result. Open the new archive in 7-Zip (right-click it, choose 7-Zip, then Open archive). The file names are listed, because ZIP does not encrypt them, and the Method column should read AES-256 Deflate. Double-click a file: 7-Zip should ask for the password. If a file opens without a prompt, or the method starts with ZipCrypto, make the archive again with the Encryption method set to AES-256. Windows File Explorer lists the names too but cannot open AES entries, so an Explorer error here is expected.

macOS: use Keka or 7-Zip, not the built-in zip

macOS can make an encrypted ZIP from the Terminal with zip -e archive.zip file, but that command uses the weak ZipCrypto cipher, so it is not a good choice for sensitive data. The Finder's own Compress command has the same limitation as Windows Explorer: it makes an unencrypted archive with no password option at all. For real protection, use a tool that supports AES. Keka is a straightforward Mac app, but its ZIP output is the legacy Zip 2.0 scheme unless you switch AES on: keka.io states that Keka uses the "AES-256 encryption specification for your 7z files and Zip 2.0 legacy encryption specification for your Zip files". Current Keka builds have two controls for it: the Use AES-256 encryption check box among its advanced compression options, and Use AES-256 when encrypting ZIP files (less compatible) in its settings. Tick one before you compress, or use Keka's 7z format, which is AES-256 already. Either way, check the result afterwards in the Terminal: zipinfo -v archive.zip reports a WinZip AES entry as compression method: unknown (99), so an encrypted entry that shows a method such as deflated is not WinZip AES. 7-Zip is another option, but on macOS it is a console program: 7-zip.org offers only a console version for Mac, run from the Terminal.

Choosing a passphrase you will not lose

Strong encryption only helps if the passphrase is strong, so use something long and unique rather than a short word you reuse elsewhere. A random string from a password manager works well, and so does a passphrase built from several unrelated words; either is far stronger than a single dictionary word with a number added to the end. AES-256 is also built to be unforgiving. A passphrase strong enough to stop an attacker is equally able to lock you out for good, because there is no back door and no reset. Save it in a password manager the moment you create the archive.

Skip the built-in ZIP, pick AES-256 in 7-Zip or Keka, and record the passphrase safely. If you later need an unprotected copy, removing the ZIP password is a matter of extracting the files and zipping them again without one. If you want to understand what you are turning on, the overview of encrypted ZIP files and the note on how secure protected ZIPs are cover the reasoning behind each choice.