How to password-protect a folder of files

The two kinds of zip encryption

The zip format has carried encryption since 1990, and the original scheme — usually called ZipCrypto or “standard zip encryption” — is broken. There is a known-plaintext attack from 1994 that recovers the key without the password, and if any file in the archive is something predictable (a standard header, a file you also have a copy of), it falls in minutes.

The modern option is AES-256, added by WinZip in 2003 and supported by 7-Zip, WinRAR, Keka, and most current tools. It is genuinely strong.

The trouble is that many tools still default to the old one for compatibility, and the interface often does not make it obvious which you got. If a tool does not tell you which it is using, assume the worse one.

The macOS Archive Utility and Windows Explorer’s built-in “Send to → Compressed folder” do not encrypt at all. The zip -e on macOS uses ZipCrypto.

The filenames are usually readable

This surprises people. In a standard encrypted zip, the file contents are encrypted and the central directory — the list of what is inside, with names, sizes and dates — is not.

So an archive called holiday-photos.zip that anyone can see contains 2024-P45-termination-letter.pdf has leaked most of what mattered.

7-Zip’s .7z format can encrypt the header too, which hides the names; in its interface that is the “Encrypt file names” checkbox. If names matter, check it, and know that plain zip cannot do it at all.

Passwords

The encryption is not going to be the weak point. The password is.

Length beats complexity. Four or five random words are stronger than P@ssw0rd!23 and far easier to type accurately once. Substituting characters in a dictionary word is the first thing every cracker tries.

And the password has to travel separately from the file. Emailing an encrypted archive and its password in the same message is not encryption, it is packaging. Send the file by one route and the password by another — a phone call, a message on a different service, in person.

For anything long-lived, put the password in a password manager at the moment you create the archive. The single most common way encrypted archives fail is that they are still encrypted five years later and nobody knows the passphrase.

Before you open one somebody sent you

An archive is a list of paths and a pile of compressed data, and both can be hostile.

• Path traversal. An entry named ../../.ssh/authorized_keys writes outside the folder you extracted into, if the extractor is careless. Most modern tools refuse; not all do.
• Absolute paths, which try to write to a fixed location.
• Compression ratios that make no sense. A 400 KB file that expands to 40 GB is not a document. It is designed to fill your disk.
• Extension mismatches. invoice.pdf.exe, or an entry whose contents are not what its name says.

All of that is readable from the archive’s index without extracting anything. Looking first costs seconds.

The programs for this

• VaultZip turns a folder into one password-locked file, with a checksum recorded for every file inside so verify can confirm the archive still round-trips before you rely on it.
• ArchiveGuard is the sequence for when the originals are meant to go: seal into an encrypted vault, verify the vault reads back byte for byte, and only then shred the originals — in that order, and only with --apply.
• PackSafe splits a large archive into volumes with a manifest, so if one piece goes bad later you can prove which one.
• ZipDock is the read-only inspector: detect the real format from the magic bytes, list every entry with its sizes and ratio, and flag the traversal, absolute-path and expansion-ratio problems above — all without extracting anything.

Free while we are in preview, one file each, Windows and Mac.

When an archive is the wrong tool

If the point is that the files on your own laptop are unreadable to somebody who steals it, use full-disk encryption — BitLocker or FileVault — rather than archives. It covers everything, including the temporary copies applications make, and there is nothing to remember to do.

Archives are for the other case: something leaving your machine.