ZIP Password Types and Encryption Explained
Updated July 2026 • 5 min read
"Password-protected ZIP" sounds like one simple thing, but it actually covers two genuinely different encryption schemes with very different security properties: legacy ZipCrypto and modern WinZip AES, which comes in AES-128 and AES-256 variants. Understanding the difference matters, whether you are choosing how to protect an archive yourself or trying to work out what you are up against with one you cannot open. This guide explains both in plain language, without the marketing spin that surrounds so many too-good-to-be-true ZIP password claims online.
The one thing that never changes
Whichever scheme is used, a password-protected ZIP is genuinely encrypted. That is different from some other file protections, like a PDF's editing restriction, which can sometimes be stripped instantly without any password because it is only a flag, not real encryption. A ZIP password is a real encryption key. There is no free, honest way to strip it without the password; the only legitimate paths are entering a password you know, or attempting to recover a weak one, covered later in this guide.
ZipCrypto: the original, and now weak, scheme
ZipCrypto, sometimes called traditional or legacy ZIP encryption, has been part of the ZIP format since the early 1990s. It is why almost every archive tool, old and new, can open a password-protected ZIP without any extra plugin: ZipCrypto support is built in everywhere.
That long history is also its weakness. ZipCrypto's encryption algorithm was designed for an era with far less computing power available to attackers, and by today's standards it is fast to attack. Measured testing shows a modern graphics card can test ZipCrypto password guesses at roughly 8 billion per second, meaning any password a human would actually choose and remember, a word, a name, a short phrase, tends to fall to a dictionary attack in seconds.
ZipCrypto also has a second, more unusual weakness worth knowing about: a known-plaintext attack. If someone has an unencrypted copy of even one file that also sits inside the encrypted archive, a technique using a tool called bkcrack can recover the archive's internal encryption keys directly, without guessing the password at all. Predictable file types, template documents, standard headers, make this more common than it sounds. For anything genuinely sensitive, ZipCrypto is not a safe choice today.
WinZip AES: modern encryption, with one nuance
WinZip AES, which you will see as AES-128 or AES-256 depending on the archive tool's settings, replaced ZipCrypto for anyone who actually needed real security. It uses AES, the same widely trusted cipher used to protect banking systems and government data, and it derives the encryption key from your password through a repeated hashing process rather than using the password directly.
Here is the nuance, and it is a genuinely interesting one: WinZip AES uses a relatively low number of those hashing repetitions, only 1,000 rounds, compared to formats like modern encrypted PDFs, which use far more deliberately expensive key-derivation. That difference has a real, measured effect: testing shows WinZip AES can be attacked at roughly 27 million password guesses per second on the same hardware, around fifty times faster than an equivalent attack against AES-256-protected PDF encryption.
That sounds alarming, but keep it in proportion. Fifty times faster than an already very slow attack is still enormously slow against a genuinely strong password. A long, randomly generated password has so many possible combinations that even at that faster rate, no realistic amount of time or money can exhaust them. The nuance matters specifically for weak, human-chosen passwords: those fall in seconds to minutes on WinZip AES, faster than you might expect from something calling itself AES-256.
What this means for recoverability
Put simply: the encryption scheme decides how fast an attack can run, and the password decides whether it succeeds. A weak or common password is realistically recoverable on either scheme, quickly on ZipCrypto and quickly enough on WinZip AES too, thanks to its lighter key derivation. A strong, long, or randomly generated password resists recovery on both schemes, because the sheer number of possibilities defeats even a fast attack.
The one case that stands apart is ZipCrypto's known-plaintext weakness, which can succeed regardless of password strength if the right conditions are met. That is unique to legacy ZipCrypto and does not apply to WinZip AES at all.
If you want the specific numbers and a side-by-side comparison, see the ZipCrypto vs AES recoverability guide. If you are trying to recover a specific forgotten password right now, our forgotten ZIP password recovery guide walks through the practical steps. Be realistic either way: a strong, random password on either scheme cannot be recovered by any free tool, and no honest guide will tell you otherwise.
Why a ZIP password cannot be "stripped" for free like some file protections can
It is worth being explicit about a distinction that trips a lot of people up. Some file protections are not real encryption at all, just a flag inside the file that says do not allow editing, and a tool can flip that flag off instantly without any password, honestly and for free, because the underlying content was never actually scrambled.
A ZIP password is not that kind of protection. Whichever scheme protects it, ZipCrypto or WinZip AES, the file contents are genuinely encrypted, scrambled using the password as a cryptographic key. There is no flag to flip. The only way to produce a clean, unprotected copy is to actually decrypt the contents with the correct password (or a recovered one) and rebuild the archive without protection. Any site claiming to strip a ZIP password with no password and no attempt at all is either lying about what it does, uploading your file to attack it server-side, or simply broken.
How to work out and act on your ZIP's encryption type
A short path from "which encryption is this" to a usable, unprotected archive:
- Check the encryption type. Open the archive in a tool like 7-Zip and check a file's properties. It will report either ZipCrypto or AES-256.
- Open the browser tool. Go to zippasswordremover.com. All decryption happens on your own device.
- Enter a known password, or attempt a weak one. If you know the password, enter it for an instant clean copy. If not, and the archive is legacy ZipCrypto, try the weak-password recovery option.
- Accept the honest result for strong AES. A strong, random WinZip AES password will not be recovered by any free tool. That is the encryption working as intended.
Remove a known password or try a weak one
Works with both ZipCrypto and WinZip AES archives, entirely in your browser. Open the ZIP Password Remover
Frequently asked questions
What is the difference between ZipCrypto and WinZip AES?
ZipCrypto is the original ZIP encryption scheme from the early 1990s and is weak by modern standards, both against password-guessing and a separate known-plaintext technique. WinZip AES uses real AES encryption and is much stronger, though its lighter key derivation still makes weak passwords fall faster than you might expect.
Is AES-256 always more secure than AES-128 for ZIP files?
AES-256 uses a longer encryption key and is the stronger of the two in principle. In practice, for both, the password you choose matters far more than the key length: a weak password undermines either variant, and a strong password is well protected by both.
Can a ZIP password be removed without knowing it, for free?
Only by attempting to recover it, and only for weak or common passwords, mainly on legacy ZipCrypto. There is no free, honest way to strip a genuinely encrypted ZIP's protection without the correct password.
Why is WinZip AES faster to attack than an encrypted PDF?
WinZip AES uses only 1,000 key-derivation rounds, far fewer than the far more expensive process used by modern encrypted PDFs. That makes each password guess cheaper to test, though it does not help against a genuinely strong password.
How can I tell which encryption my ZIP file uses?
Open it in an archive tool such as 7-Zip and check a file's properties; it will show ZipCrypto or AES-256. If you cannot check, it is safest to assume the stronger AES scheme.