Zip files can be password-protected, but the standard Zip encryption scheme is extremely weak. If your operating system has a built-in way to encrypt zip files, you probably shouldn’t use it.
To gain the actual benefits of encryption, you should use AES-256 encryption. 7z archives support this natively, but you can also encrypt Zip files with AES-256 encryption.
Zip 2.0 Legacy Encryption vs. AES Encryption
There are actually two types of Zip file encryption. The older Zip 2.0 encryption is extremely insecure, while the newer AES encryption is fairly secure.
Unfortunately, many pieces of software — particularly operating systems with built-in support for Zip files — don’t support the newer AES encryption standard. This means that using the Zip password-protection features found in Windows XP, current versions of Mac OS X, and even typical Linux desktops won’t give you securely encrypted Zip files. Even some third-party utilities are reluctant to switch to AES for their Zip encryption as it means those AES-encrypted zip files will then be incompatible with the built-in Zip features in Windows, Mac OS X, and other software.
It’s still possible to get AES encryption with Zip files — but such files will require third-party software to view, anyway. You may just want to use a different archive format, such as 7z. The 7z archive format requires strong AES-256 encryption. Whenever you create a password-protected 7z file, you know that it’s securely encrypted. Really, 7z is great — it came out on top in our file-compression benchmarks. It’s generally on the top of other file compression benchmarks we’ve seen, too.
Windows – 7-Zip
Windows offers a built-in way to create Zip files. Windows XP even offered a way to password-protect and encrypt these Zip files. However, Windows XP used the extremely insecure “standard” zip file encryption algorithm. Even if you’re still using Windows XP, you shouldn’t use this feature. Later versions of Windows dropped the password-protection option entirely.
Nearly every popular encryption utility offers this features. We like 7-Zip, which is completely free and open-source, so it won’t try to nag you for any money.
With 7-Zip installed, you can select some files in a File Explorer or Windows Explorer window, right-click them, and select 7-Zip > Add to archive. Be sure to select the “Add to archive” option, as it gives you the ability to set a password. If you don’t see the menu option here, you can also open the 7-Zip application directly and use it to create an archive.
7-Zip will create a 7z archive by default, but you can also choose Zip. If you do opt to go with Zip, be sure to select the AES-256 encryption method instead of the weaker ZipCrypto method. Enter your password into the provided boxes and click OK to create your encrypted archive file.
Mac – Keka
Mac OS X also provides an easy way to create Zip files from a Finder window, but there’s no way to encrypt a zip file with the graphical user interface. The zip command included with Mac OS X does offer a way to encrypt zip files without using any third-party software. However, like the password-protection feature built into Windows XP, it uses the old and insecure standard zip encryption scheme. If you really wanted, you could use the “zip -e” command in a Terminal on a Mac. However, we strongly recommend against this.As on Windows, you’ll once again need a third-party file compression app for secure compression. Keka seems to be one of the most well-loved file compression and decompression apps for Mac, and we can recommend it. However, even Keka doesn’t use AES for encrypting Zip files by default. You can get the currently-in-beta version of Keka and enable a hidden option to do this, or just use the standard version of Keka and create encrypted 7z files instead.
Launch Keka, select 7z, and enter a password for your archive. (If you select Zip, be sure you have the correct version of Keka and that you’ve enabled the hidden option above to get the secure encryption.)
Drag and drop one or more files you want to compress onto the Keka window and they’ll be compressed into a 7z file encrypted with the password you provided. You’ll need the password to access the file’s contents in the future.
Linux – File Roller with p7zip-full
The standard Archive Manager (File Roller) application included with Ubuntu and other GNOME-based desktop environments does have an option to create password-protected zip files. However, the underlying zip command used still uses the old, weak encryption instead of strong AES encryption. Thankfully, File Roller can be used to create encrypted 7z archives.
To enable this option, you’ll first need to install the p7zip-full package. (On some Linux distributions, it may just be called p7zip instead.) For example, on Ubuntu, you can either open the Ubuntu Software Center, search for p7zip-full and install it, or open a Terminal window and run the sudo apt-get install p7zip-full command.
Once you have, you can create encrypted 7z files directly from the File Roller window. Select some files in a file manager window, right-click them, and select Compress — or open the Archive Manager application directly and use it to create a new archive.
In the Compress window, be sure to select the 7z archive format. Click the Other Options header and provide a password. The password will be used to unlock your archive later.
There are many different software programs for creating password-protected archives, but — whatever you use — be sure it’s using secure encryption. The problem with Zip encryption isn’t purely theoretical. The web is full of tools that can “recover” a password-protected zip file that was created using the old encryption scheme. “Recover” is a less-scary word for breaking and removing the encryption.
