Recovery
Open a password-protected ZIP without the password
You own the archive but the password is gone. WinZip AES has no bypass, and ZipCrypto has none unless you hold an unencrypted copy of a file from inside the archive, but a password you chose yourself can be searched for on your own device, without uploading anything, and the more of it you remember, the smaller that search.
Authorized use only
Use this tool only on ZIP archives you own or are authorized to access. Attempting to open files without permission may violate applicable laws. See our Acceptable Use Policy and Terms of Use.
What "without the password" really means
If you have lost the password to a ZIP you created, it is natural to search for a way to open it "without the password." A properly encrypted ZIP does not hold your password anywhere inside it, and for a WinZip AES archive there is no reputable tool, setting, or trick that peels the protection off the file. The legacy ZipCrypto scheme has one documented exception, and it needs something most people do not have: an unencrypted copy of a file that sits inside your own archive. Given at least 12 known bytes of that entry as it is stored, that is after compression, with 8 of them in a row, the 1994 known-plaintext attack described on ZipCrypto explained recovers the cipher state directly, without the password. With nothing to match against, and on AES either way, the encryption is doing exactly what it was designed to do: refuse access to anyone who cannot supply the right key. ZipRecover itself only tests candidate passwords.
So the practical route is recovery rather than bypass. A recovery tool generates candidate passwords, tests each one against the archive, and stops the moment the file confirms a match. Strictly speaking, you find the password you already set, and then the file opens normally. That distinction matters because it decides whether your case is easy, slow, or effectively impossible. When you are ready, you can recover your ZIP password in the browser with nothing to install and nothing to upload.
Why the encryption method decides almost everything
The ZIP format supports two very different kinds of encryption, and which one your file uses matters more than any option you will pick later. The encrypted ZIP files page has the full background.
- ZipCrypto is the legacy scheme built into the original ZIP format. It is weak by modern standards, and each candidate is very cheap to test. Dictionaries, patterns, and even modest brute-force runs are genuinely practical here.
- WinZip AES is the strong, modern scheme. It derives its key deliberately slowly, running a thousand hashing iterations for every single guess, precisely so that mass testing is painful. Focused guesses still help; wide, blind searches usually do not.
ZipRecover detects the method automatically when you load a file, so you do not have to figure this out by hand. But keep it in mind, because it sets your expectations for everything below.
The realistic paths back in
Every guessing strategy is a smarter way of narrowing the pile of candidates to test, whether you describe a remembered shape as a mask, feed in a list of passwords you reuse, or brute force a short one. The ZIP password recovery overview compares all three and shows when each fits. If you actually know the password and only want an unprotected copy, the remove a ZIP password guide is the faster route.
Start with what you know, not with brute force
A focused mask or a short list of your own passwords can shrink a search of trillions of candidates to thousands. The more you can describe about the password you set, the smaller the search becomes and the sooner a run can finish.
When it is feasible, and when it is not
If you chose the password yourself and can describe even part of it, your chances are much better, especially on a ZipCrypto archive. A short or human-picked password that a dictionary or mask can describe may be found in seconds or minutes on either scheme, as the illustrative estimates in how long recovery takes show; we have no data on how often a search succeeds. That is the hopeful case.
The hard case is a long, random password on a WinZip AES archive. There the slow key derivation means testing enough guesses to stumble onto it would take longer than any timescale you care about. That is the format doing its job. If you want to understand exactly why a run can stall, the why ZIP password recovery fails page explains the limits plainly, and how long recovery takes puts real numbers on it. Knowing this up front saves you from waiting on a search that cannot finish.
Do it privately, on your own device
Many sites that promise to "unlock" a ZIP ask you to upload it to their servers first. That means handing a copy of the private file you are trying to protect to a third party you do not control, where it can be logged, retained, or exposed. ZipRecover takes the opposite approach. The archive is read in your browser and every candidate is tested on your own machine, so the archive, its file names and the passwords tried are never uploaded and there is no server-side copy of them to trust. If you want to vet any tool, including this one, the are online ZIP tools safe page gives you a checklist.
Use recovery only on archives you own or are clearly authorized to open. The goal here is to get you back into your own file, not into someone else's. If that is your situation, you can recover your ZIP password in the browser right now, and nothing you load will ever leave your device.
Common questions
Can I really open a ZIP if I do not have the password?
For a WinZip AES archive, and for a ZipCrypto one you have no plaintext for, the route is recovering the password you originally set: there is no button that strips the protection off. A recovery tool tests candidate passwords against the file until one matches, so success depends on the password being something you can describe or partly recall. One documented exception exists, and it applies to the legacy ZipCrypto scheme only: if you still hold an unencrypted copy of a file that is inside your own archive, the 1994 Biham and Kocher known-plaintext attack can recover the cipher state from at least 12 known bytes of that entry as it is stored, that is after compression, with 8 of them in a row, without the password. See ZipCrypto explained. ZipRecover does not do that; it only tests candidate passwords.
Do I have to upload my ZIP to a website to unlock it?
No, and you should not have to. ZipRecover reads the archive in your browser and tests every candidate locally, so the file never leaves your device. Uploading a private archive to a stranger's server is the exact risk you want to avoid; see are online ZIP tools safe.
How long will it take to open the file?
It depends on the encryption method and how much you remember. A short or guessable password can fall in seconds to minutes, while a long random password on AES may never finish. The how long recovery takes page gives realistic ranges.
What if I remember nothing about the password at all?
Then the odds are poor, and it is better to know that up front. Blind brute force only works for short passwords, and on a strong AES archive it is effectively hopeless. Try any list of passwords you commonly use first: if the forgotten one is on it, a dictionary search can finish in seconds on ZipCrypto, and on AES too when the list is short.
Ready to recover your ZIP password?
Runs locally in your browser. Your archive never leaves your device.