How to Password-Protect a ZIP File (Mac, Windows, Free)

When sending multiple files together, you often want to ZIP them and add a password. But many ZIP tools don't include password options. This guide shows the easiest free ways to password-protect a ZIP file on each OS.

How Do I Protect a ZIP File With a Password?

The short answer: use 7-Zip on Windows, Terminal on Mac, or an encrypted file-sharing link when the recipient should not need any ZIP software.

For Windows, 7-Zip with AES-256 is usually the best free option. For Mac, Terminal's zip -er command works, although it is less friendly for non-technical users. For one-time sharing, especially with clients or family members, a password-protected LOCK.PUB file link is often easier because the recipient opens it in the browser.

On Mac: Use Terminal

Mac's GUI doesn't show a password option, but Terminal does it in one line:

zip -er archive.zip folder/

-e enables encryption, -r recursively zips a folder. After running it, you'll be prompted for the password twice.

Pros: No extra software Cons: Requires comfort with Terminal

On Windows: Use 7-Zip

The built-in Windows ZIP doesn't support passwords. You need 7-Zip.

1. Download 7-Zip from 7-zip.org
2. Right-click your file → 7-Zip → Add to archive
3. Enter a password in the "Encryption" section
4. Choose ZIP (or stronger 7z)
5. OK

Pros: Free, strong encryption Cons: Requires installing 7-Zip

Online ZIP Tools

Browser-based tools like ezyZip, ArchiveExtractor.

Pros: No installation Cons: Files are uploaded to a third-party server — security concern

Limits of ZIP Passwords

ZIP password protection has well-known weaknesses:

1. ZIP Password Crackers Are Common

Older ZIP encryption can be broken with tools like john the ripper or fcrackzip. Short passwords get cracked in minutes.

2. Filenames Are Still Visible

Even with a password, the list of filenames inside the ZIP is visible. If your filenames contain sensitive info, the password doesn't help.

3. AES vs ZipCrypto

7-Zip can use strong AES-256 encryption, but some ZIP tools only support weak ZipCrypto. Using ZipCrypto for compatibility means weaker security.

Is a Password-Protected ZIP File Safe Enough?

It depends on the threat. A password-protected ZIP is fine for casual privacy, but it is not ideal when the file contains contracts, IDs, tax documents, medical records, passwords, API keys, or other sensitive data.

The main risk is that ZIP passwords can be attacked offline. If someone gets the ZIP file, they can keep guessing passwords without touching your account again. That makes short or reused passwords especially dangerous. For sensitive one-time transfers, use a protected link with expiration and access limits instead of sending a permanent encrypted archive.

A Safer Alternative: LOCK.PUB

Instead of password-protecting the ZIP, share the file via a password-protected link.

How to use LOCK.PUB:

1. Go to lock.pub and choose "File Share"
2. Upload your ZIP or original file
3. Set a password
4. Send the link to the recipient

Pros:

• ✅ Nothing is stored as a plain downloadable file
• ✅ AES-256 encryption with a key derived from your password
• ✅ No sign-up
• ✅ Recipient needs no tools (opens in the browser after entering the password)

ZIP Password vs LOCK.PUB

Feature	ZIP Password	LOCK.PUB
Expiry (Pro)	❌	✅
Brute-force defense	❌ (offline attack)	✅ (server rate-limit)
Cracker tools exist	✅ Many	❌
Recipient tool needed	7-Zip etc.	Browser only
Sign-up required	❌	❌

Which to Choose

Situation	Recommended
Recipient keeps ZIP long-term	7-Zip + AES-256
One-time share	LOCK.PUB
Highly sensitive content	LOCK.PUB
Mac only	Terminal zip -er
Windows	7-Zip

Related guides

• Send large files securely
• Send confidential documents
• Secure password sharing

Sources and further reading

• 7-Zip — free AES-256 ZIP encryption
• OWASP Cryptographic Storage Cheat Sheet

Final Thoughts

ZIP password protection is convenient but has security limits. For truly sensitive files, a service like LOCK.PUB — which stores the file encrypted under a key derived from your password, and never stores that password — is safer.

No sign-up, password-protected file sharing in 30 seconds.