How to encrypt and password-protect ZIP files the right way

 An anonymous reader asked, “Is there any way to crack a password-protected zip file?”

That question can be interpreted two ways. Do you want to hack into someone else’s private files? Or do you want to avoid a form of encryption that won’t give you much protection? Since I believe that most PCWorld readers are inherently good people, I’ll assume that you simply want to be assured that your files will not be cracked.

For some years now, the .zip format—intended primarily for compression—has provided encryption as an added feature. But what kind of encryption it provides depends on the program you use to create and open the ZIP file.

The .zip format supports two forms of encryption and password protection. The first, nicknamed ZipCrypto, is relatively easy to crack. I’m not saying that anyone could do it, but the Info-ZIP organization calls ZipCrypto ”quite weak”—a view shared by other organzations as well.  

You’d be far safer using the other option, AES-256. Unlike ZipCrypto, AES was not designed for ZIP files. It’s a popular and extremely strong encryption technique used in many programs. Assuming you use a strong password, it’s for all practical purposes unbreakable. 

But when you use it for ZIP archives, AES-256 comes with another problem: Windows’ own, built-in compression tool doesn’t support AES. Email someone an AES-encrypted file, text them the password (safer than emailing it), and if they try to open it in Windows Explorer or File Explorer, they won’t be able to open any of the files within the archive.

Fortunately, most third-party zip tools, including the free 7-zip, support AES-256. To encrypt an archive in 7-zip, once you’re at the Add to Archive dialog box, enter a password and select the Encryption method AES-256. You’ll find these options near the lower-right corner of the dialog box.

One more problem with encrypted ZIP files: No matter which form of encryption you use, anyone with access to the files can see the name of the files within the archive. If the file names provide sensitive information, a thief could take advantage of that. Of course, they would not be able to open any of the files without the password.