ZipCrypto and AES look identical at the password prompt but protect very differently. Learn which one your archive uses and why it decides whether recovery is even possible.
Not all ZIP passwords protect equally. Archives made years ago often use the old ZipCrypto system, while modern tools offer AES - and the difference decides whether a forgotten password is a weekend project or permanently lost. This page explains both in plain words, how to check which one your archive uses, and what to choose when you protect your own files. Use this guide only for archives you own or are authorised to open - your own forgotten password, or a file someone sent to you. Never use these steps to break into someone else's protected files.
ZipCrypto is the encryption built into the original ZIP format. It is what Windows Explorer still uses today when you add a password through some older tools, and it is what most archives from the 2000s and 2010s carry. Its weakness is well documented: researchers published attacks (the best known is the Biham-Kocher known-plaintext attack) that can recover the internal keys of a ZipCrypto archive if part of one file inside is known - which is often true for common file types. In plain language: a determined person with the right tools may open a ZipCrypto archive without ever finding the password. It keeps out casual eyes only.
AES encryption (128-bit and 256-bit) was added to ZIP tools later - WinZip introduced it, and 7-Zip and WinRAR support it fully. AES is the same family of encryption trusted for banking and government data. There is no known shortcut attack against a properly made AES ZIP archive: the only route in is the password itself, guessed one by one, which is deliberately slow. One honest footnote: in standard ZIP AES, file names inside the archive may still be visible even though contents are locked; 7-Zip's own 7z format can encrypt names too, when that matters to you.
Open the archive in 7-Zip and look at the file list, or select a file inside and view its properties or info panel - 7-Zip reports the encryption method for each entry, shown as ZipCrypto or AES-256 (wording varies slightly by version). Windows Explorer tells you nothing, which is one more reason technicians keep 7-Zip installed. Knowing the type changes your recovery decision instantly: a forgotten password on ZipCrypto has extra attack options, while a forgotten AES password leaves only guessing - and the honest time maths from our recovery guide applies in full.
When you protect your own archive, choose AES-256 - in 7-Zip it is a single dropdown choice while creating the archive. Pair it with a password that is long and unique, and store that password in a password manager. Understand the trade honestly: strong encryption means a forgotten password is a real loss, not an inconvenience. That is not a flaw; it is the protection working. If the contents merely need privacy from casual viewing, ZipCrypto is better than nothing - but never rely on it for genuinely sensitive documents.
Watch the video for the recovery side of the story - how a forgotten password is found for your own archive, attack type by attack type.
Watch Full VideoArchives password-protected through older Windows-compatible tools are typically ZipCrypto, because that is the only type the built-in ZIP support understands. If an AES archive will not open in Explorer, that is expected - use 7-Zip or WinRAR for AES archives.
No - both are considered strong; AES-256 simply has a larger key and is the standard recommendation. Against password guessing, your password's length and randomness matter far more than the difference between 128 and 256.
Yes, if you know the password: extract the files, then create a fresh archive with AES-256 selected. There is no in-place upgrade - the files must be re-packed. Do this for any old sensitive archive you still rely on.