ZIP password attack methods, compared

The one idea behind every method

A well-made encrypted ZIP does not store your password anywhere inside it, so there is no way to read it back out. Every method on this page works the same way underneath: it generates candidate passwords, tests each one against the archive, and stops the moment the file confirms a match. (A ZipCrypto archive has one other route for an owner who still holds an unencrypted copy of one of its files, a known-plaintext attack that ZipRecover does not run; ZipCrypto explained covers it.) The methods differ only in how they choose which candidates to try. That choice decides whether the search finishes in seconds or never finishes at all. The short version is on the ZIP password recovery overview; this page goes method by method so you can pick the one that matches what you remember about a file you own.

Dictionary attack

A dictionary attack tests passwords from a list, one after another, until one works. The list can be a set of common passwords, or, far more usefully, the handful of passwords you personally reuse. If you reuse passwords rather than inventing a fresh random string each time, a dictionary of them is the fastest route back into your own archive. The method is only ever as good as the list: a short list of your own likely candidates that holds the password finishes long before a giant generic wordlist would reach it.

The real power comes from mutations. A dictionary run can take each word and try small variations automatically: capitalizing the first letter, appending a year or a couple of digits, swapping letters for look-alike symbols. This mirrors how people actually build passwords from a memorable base, so it catches near-misses that a plain word list would skip. When you roughly know what you chose but not the exact form, a dictionary with mutations is the method to start with.

Mask attack

A mask attack is the most efficient method when you remember the structure of the password rather than the password itself. You describe its shape with placeholders: a known prefix, then some unknown characters of a known type, then perhaps a known suffix. Only candidates that fit that pattern are ever generated, so the search stays small even when several positions are unknown. If you recall that your password was a capitalized word followed by four digits, a mask tests only that space rather than the whole universe of strings.

Masks reward every scrap of memory. Knowing the length alone cuts the work dramatically, and narrowing the character set at each position, for instance lowercase letters here, digits there, shrinks it further. The more precisely you can describe the shape, the smaller and faster the run becomes. This is why a mask suits a password you set yourself whenever you remember something about its form: a mask turns that memory directly into a smaller search.

Brute-force attack

A brute-force attack makes no assumptions at all. It tries every possible combination of characters from a chosen set, up to a chosen length, until it either finds the password or exhausts the space. Its strength is that it needs no memory of the password; its weakness is that the number of combinations grows explosively. Add one character to the length, or widen the character set, and the total multiplies. This is why brute force is a last resort rather than a first move.

Feasibility comes down to length and character set. A short password over a small set, say a few lowercase letters, has few enough combinations to test quickly. Extend it to a medium length with mixed case, digits, and symbols, and the count climbs past any practical timescale. In practice brute force is realistic mainly for short passwords, and mainly on the weaker encryption scheme discussed next. If you remember anything at all about the password, a mask or dictionary that covers it gets you there sooner.

How the encryption scheme changes the math

Which encryption your ZIP uses affects how long each guess takes, and that changes what is feasible more than the method you pick. The ZIP format supports two very different schemes.

• ZipCrypto is the legacy scheme built into the original ZIP format. It is weak by modern standards, and each candidate is very cheap to test, so dictionaries, masks, and even modest brute-force runs are all practical. See ZipCrypto explained for the details.
• WinZip AES is the strong, modern scheme. It derives its key with 1,000 rounds of PBKDF2-HMAC-SHA1 for every single guess, on purpose, so bulk testing is slow. Dictionaries and tight masks are still worth running; wide brute force usually is not. See WinZip AES encryption for how it works.

The same method can be practical on one scheme and hopeless on the other, purely because of the per-guess cost. That is why identifying the encryption matters before you commit to a wide search. ZipRecover detects the scheme automatically when you load a file. For realistic timing across both schemes and all three methods, the how long recovery takes page puts numbers on it.

Choosing a method for your file

Match the method to your memory. A short list of passwords you tend to reuse calls for a dictionary first. Remembering the length or the shape makes a mask the most efficient choice by a wide margin. When you remember nothing but know the password was short, brute force can still work, especially on a ZipCrypto archive. Whichever you pick, use recovery only on archives you own or are clearly authorized to open, and everything you load stays on your device. When you are ready, you can start ZIP password recovery in your browser right now.