Recover a ZIP password on Windows

What Windows can and cannot do on its own

Windows has handled ZIP archives natively for years through File Explorer, which it calls compressed folders. If your archive uses the legacy ZipCrypto method, Explorer can open it: double-click the file, and Windows prompts you for the password before extracting. That covers the everyday case where you still know the password and simply want the contents. Recent Windows releases have broadened archive support in File Explorer, but a password prompt for classic ZipCrypto is the behavior you can count on across versions.

There is an important limit. Explorer's built-in support does not understand WinZip AES encryption. An AES-encrypted archive will not open in Explorer even when you type the correct password, which often confuses people into thinking the password is wrong. It is not; the format is simply beyond what the built-in handler supports. This is also why identifying the encryption method first is worth a minute of your time.

Identify the encryption method

The clearest way to see how an archive is encrypted on Windows is with 7-Zip, a free and widely used utility. It exposes a Method column that names the exact scheme.

1. Right-click the archive in File Explorer.
2. Choose 7-Zip, then Open archive. The 7-Zip window lists the entries.
3. Read the Method column. You will see ZipCrypto for the legacy scheme or AES-256 for WinZip AES. If the column is hidden, right-click the column header to enable it.

If you prefer a terminal, open PowerShell or Command Prompt and run 7z l -slt archive.zip. The -slt flag prints technical details, and the Method line for each entry reports ZipCrypto or AES-256. Knowing this tells you what to expect: ZipCrypto is fast to test, while AES is slow by design, so wide searches are only realistic on ZipCrypto. There is no penalty for checking first, and it can save you from starting a brute-force run that the format was specifically designed to defeat.

Recover the password with ZipRecover

Once you know the method, you can recover the password without installing anything. ZipRecover runs entirely in a modern browser on Windows. Current Edge, Chrome, and Firefox run it: the end-to-end tests drive the recovery page in Chromium, the engine of Edge and Chrome, and on 27 September 2026 in Firefox too. The archive is read and tested on your own machine, and neither it nor the passwords tried are uploaded, which keeps a file you clearly care about on your PC where it belongs. The heavy hashing runs in WebAssembly, or through the browser's built-in Web Crypto when that is faster, so recovery runs inside the browser, fast enough to test passwords locally, with no installer, background service, or system permission to grant.

1. Select the file. Open the recovery tool and choose the ZIP from your device. The browser reads its bytes locally and detects whether it uses ZipCrypto or WinZip AES.
2. Choose a strategy. Pick a dictionary of passwords you might have used, a mask if you remember the shape, or a bounded brute-force run for a short password. A focused dictionary or mask is far more effective than a wide search, especially on AES.
3. Confirm and start. Tick the box confirming you own the archive or are authorized to open it; the Start recovery button stays locked until you do. Then begin the run.
4. Read the result. A candidate that passes the fast check is confirmed before it is shown whenever the archive allows it: the HMAC for AES, and decryption plus the CRC-32 for a ZipCrypto entry of at least 4 bytes that is stored or Deflate-compressed, which is nearly every archive. When only a shorter or differently compressed ZipCrypto entry can be tested, the result says the password passed a quick check only. Either way it appears in your tab alone.

Windows makes one thing worth repeating: File Explorer can prompt for and open a ZipCrypto archive, but it cannot open a WinZip AES one even with the correct password, so reach for 7-Zip to read the method before you commit to a search. If you chose the password and can describe part of it, a dictionary or mask that fits it can finish in seconds on ZipCrypto, and on AES too when the search is small. A long random password on an AES archive is effectively not recoverable by guessing, which is the encryption doing its job, so the better move is to hunt for a saved copy. The same steps carry over to the macOS guide and the Linux guide, and if you set the password yourself the forgot your ZIP password checklist is a good companion.