Password-Protected ZIP, 7z and RAR Files: How to Open Them Safely

A password-protected archive is only as useful as your tool's support for its encryption. Windows and macOS open some protected ZIPs but not others; 7z and RAR need their own tools. This guide explains the encryption types, which tools handle them, how to open a protected 7z in your browser without sending the password anywhere, and what to do when the password is lost.

Updated 2026-10-13 · Written and tested by the UnpackNest editorial team (TECCONET)

How to tell that an archive is encrypted

• The tool asks for a password, or shows a lock icon or an asterisk next to file names.
• You can see the file list but extraction fails with "wrong password", "encrypted" or a CRC error.
• You see no file list at all until you enter a password. That means the names are encrypted too (7z and RAR can do this; standard ZIP cannot).

The three main encryption types

The table explains a common puzzle: a colleague's protected ZIP opens fine in Windows, but another does not. The first used ZipCrypto; the second used AES, which Windows File Explorer does not support.

Open a protected 7z in your browser

The UnpackNest 7z tool supports 7z AES-256 encryption, including archives with encrypted file names. The password is passed to the 7-Zip engine running in your browser tab; it is not uploaded, logged or stored.

1. Open the 7z tool and choose the archive.
2. If entries show a lock, or the tool says the archive is password-protected, a Password box appears.
3. Type the password and press Unlock.
4. Press Extract next to a file. A wrong password is reported clearly; nothing is saved.

What UnpackNest does not do yet: encrypted ZIP and RAR entries

We would rather be clear than leave you guessing. The ZIP tool and the RAR tool list encrypted archives so you can see what is inside, but they do not decrypt entries yet. They say so instead of producing an empty or broken file.

For those archives, use a desktop tool:

1. Windows: install 7-Zip, right-click the archive, 7-Zip > Extract Here, enter the password.
2. macOS: install Keka or The Unarchiver and open the archive with it.
3. Linux: 7zz x archive.zip (or .rar) prompts for the password.
4. Android/iPhone: apps such as ZArchiver (Android) or Documents by Readdle (iPhone) support AES ZIPs.

Typing the password correctly

Most "wrong password" errors are not wrong passwords.

• Passwords are case-sensitive: Report2026 and report2026 are different.
• Copying from an email or web page often adds a space at the end. Type it by hand, or paste into a text editor first to check.
• Keyboard layout matters. If the password contains Arabic or other non-Latin characters, the archive may have been created with a different encoding; try a different tool.
• In a ZIP, each file can have its own password. If some files open and others do not, ask the sender.

Lost the password?

Be realistic. With AES-256 and a good password, recovery by guessing is not feasible on any computer you own.

1. Search your password manager, email and chat history for the archive name.
2. Ask the person who created the archive; they may still have the original files.
3. If you remember part of the password, password-recovery tools can try variations. Only use them on archives that are yours.
4. Legacy ZipCrypto ZIPs are an exception: if you have an unencrypted copy of one file inside, tools such as bkcrack can recover the keys. This is a reason never to rely on ZipCrypto.

Sending a protected archive yourself

• Use AES, not ZipCrypto. In 7-Zip, choose AES-256 under Encryption; for 7z also tick Encrypt file names.
• Send the password through a different channel from the archive: for example, the file by email and the password by phone or messaging app.
• Tell the recipient which tool to use. "Use 7-Zip, or the 7z tool at UnpackNest" saves a round of confused emails.
• Use a long passphrase (four or more random words) rather than a short complex password.

Why attackers like password-protected archives

Email security scanners cannot look inside an encrypted archive, so criminals send malware in "protected" ZIPs and put the password in the email body. A protected archive you did not expect, especially with "invoice" or "payment" in the name, deserves extra suspicion. Read the archive safety guide before opening one.

Frequently asked questions

Does UnpackNest store the passwords I type?

No. The password is used by the engine inside your browser tab and is discarded when you close or reload the page. It is not sent to UnpackNest servers.

Why does Windows say the ZIP is invalid when it is just encrypted?

File Explorer does not support AES-encrypted ZIPs and reports a generic error. 7-Zip opens them.

Can I remove a password from an archive?

Extract it with the password, then create a new archive without one.

Is ZIP encryption good enough for sensitive files?

AES ZIP is. Legacy ZipCrypto is not. If unsure, use 7z with AES-256 and encrypted file names.

Related guides

• How to Open 7z Files on Windows, Mac, Linux and Phones
• Archive Safety: How to Open ZIP, RAR and 7z Files Without Getting Malware
• How to Create a ZIP or 7z Archive (and Which One to Choose)
• How to Repair a Corrupted ZIP or RAR File (and When You Can't)