Recover a ZIP password on Linux

What Linux gives you out of the box

Linux is well stocked for working with ZIP archives from the terminal. The unzip utility extracts a password-protected archive once you supply the password, and zip creates them, but neither recovers a password you have forgotten. For that you reach for dedicated tools, most of which are a single package-manager command away. The trade-off is that these tools are fast and scriptable but also unforgiving, so it is worth understanding the encryption you are up against before you commit hours of CPU time to a search.

As on any platform, the format matters. A legacy ZipCrypto archive is quick to test, while a WinZip AES archive is slow by design, because each guess runs through a deliberately expensive key-derivation step. That single fact decides whether a wide search is realistic or whether you should lean on a precise dictionary or mask. Checking first costs a few seconds and can save you from a run the format was specifically built to defeat.

Check the encryption method

The clearest way to inspect an archive is with 7z, part of the p7zip package available in most distributions. Install it with your package manager, for example sudo apt install p7zip-full on Debian or Ubuntu, then read the method it reports.

1. Run 7z l -slt archive.zip. The -slt flag prints technical details for each entry.
2. Read the Method line. You will see ZipCrypto for the legacy scheme or AES-256 for WinZip AES.
3. Alternatively run zipinfo -v archive.zip for a verbose listing that shows which entries are encrypted.

Once you know the method you know what to expect. ZipCrypto tolerates a broad brute-force or dictionary run; AES effectively rules out anything but a targeted guess. The time estimates page puts real numbers on this, and why recovery can fail explains what to try when a search comes up empty.

Recover with native Linux tools

If you prefer the command line, two tools cover most cases. Use them only on archives you own or are authorized to open.

1. John the Ripper with zip2john. John does not read a ZIP directly; its zip2john helper first extracts a hash that represents the archive's password check. zip2john comes with John the Ripper's jumbo build, which Openwall publishes as source on GitHub; the john package in Debian 12 and Ubuntu 24.04 does not include it, so on those systems build the jumbo version first. Run zip2john archive.zip > hash.txt, then john hash.txt to start a search, or point it at a wordlist with john --wordlist=rockyou.txt hash.txt. Show a recovered password with john --show hash.txt. John handles both ZipCrypto and AES archives and is the most capable of the native options.
2. fcrackzip. A lighter, self-contained cracker aimed at traditional ZipCrypto archives. Try a dictionary with fcrackzip -D -u -p rockyou.txt archive.zip, where -u checks each guess by actually unzipping so you avoid false positives, or a bounded brute force with fcrackzip -b -c a1 -l 1-6 -u archive.zip. It is quick to set up but does not target modern AES archives, so confirm the method first.

Both benefit enormously from a good wordlist and from any structure you can remember about the password. A blind brute force over a long keyspace is rarely worth starting, especially against AES, where the slow key derivation multiplies every guess.

Recover the password in the browser

You do not have to install anything at all. ZipRecover runs entirely in a modern browser on Linux. Current Firefox, Chrome, and Chromium run it: the end-to-end tests drive the recovery page in Chromium, and on 27 September 2026 in Firefox too. The archive is read and every candidate is tested on your own machine with no upload step, so a private file stays on your device. The heavy hashing runs in WebAssembly, or through the browser's built-in Web Crypto when that is faster. There is no package to add, no background service, and no root permission to grant, which makes ZipRecover a clean option on a locked-down or minimal system where you would rather not install a cracker.

1. Select the file. Open the recovery tool and choose the ZIP from your machine. The browser reads its bytes locally and detects whether it uses ZipCrypto or WinZip AES.
2. Choose a strategy. Pick a dictionary of passwords you might have used, a mask if you remember the shape, or a bounded brute-force run for a short password. A focused dictionary or mask is far more effective than a wide search, especially on AES.
3. Confirm and start. Tick the box confirming you own the archive or are authorized to open it; the Start recovery button stays locked until you do. Then begin the run.
4. Read the result. A candidate that passes the fast pre-check is confirmed before it is shown whenever the archive allows it: the HMAC for AES, and decryption plus the CRC-32 for a ZipCrypto entry of at least 4 bytes that is stored or Deflate-compressed, which is nearly every archive. When only a shorter or differently compressed ZipCrypto entry can be tested, the result says the password passed a quick check only. Either way it appears in your tab alone.

On Linux, the native tools carry real caveats: fcrackzip targets ZipCrypto and does not handle AES, while John the Ripper via zip2john covers both but rewards a good wordlist far more than a blind run, so confirm the method first. If you chose the password and can describe part of it, a dictionary or mask that fits it can finish in seconds on ZipCrypto, and on AES too when the search is small. A long random password on an AES archive is effectively not recoverable by guessing, which is the encryption doing its job, so the productive move is to hunt for a saved copy rather than out-compute PBKDF2. The same ground is covered for other systems in the Windows guide and the macOS guide, and the forgot your ZIP password checklist is a good companion if you set the password yourself.