Skip to content
SecretPNG

Create a Password-Protected ZIP

Sometimes you need an encrypted archive in a format the other person's software already understands. This tool builds AES-256 encrypted ZIP files (WinZip AE-2 format) locally in your browser — compatible with 7-Zip, WinRAR, and macOS tools like Keka. It deliberately refuses to offer legacy ZipCrypto, which is weak enough to be considered broken.

The actual tool runs in our ad-free secure workspace — nothing on this page processes your file.

Open Password-Protect a ZIP →

What this tool does

  • Builds password-protected ZIP archives using AES-256 in the widely supported WinZip AE-2 format.
  • Compresses and encrypts entirely in your browser — files never leave your device.
  • Accepts multiple files and folders and preserves the folder layout inside the archive.
  • Refuses to create legacy ZipCrypto archives, whose encryption can be broken with commodity tools.
  • Shows a clear compatibility note so you know what the recipient needs to open the archive.

Your privacy on this tool

Stays on your device

  • Files are compressed and encrypted into the ZIP on your device.
  • The archive password never leaves your browser.
  • The finished ZIP downloads directly to your computer — no server copy exists.

Reaches our server: nothing

This tool makes no upload. Your content is processed entirely in your browser.

How to use it

  1. Open the ZIP tool at /app/password-protect-zip.
  2. Add the files or folders you want in the archive.
  3. Set a strong password — it protects every file in the ZIP.
  4. Build the archive and download the finished .zip.
  5. Tell your recipient to open it with 7-Zip or WinRAR on Windows, or Keka or The Unarchiver on macOS — and send the password separately.
Open Password-Protect a ZIP →

Common uses

  • Sending encrypted files to someone whose company only allows well-known archive tools, not new software.
  • Delivering project files to a client who expects 'a ZIP with a password' and nothing more exotic.
  • Meeting a vendor or institution's requirement that submissions arrive as an encrypted ZIP.
  • Bundling several documents into one encrypted attachment where a .svault file would confuse the recipient.

Supported formats

  • Any files and folders as input
  • Output: .zip (AES-256, WinZip AE-2)

Runs in current Chrome, Edge, Firefox, and Safari; the resulting ZIPs open in 7-Zip, WinRAR, Keka, The Unarchiver, and other AE-2-aware archivers.

Limitations & security notes

Limitations

  • Windows Explorer's built-in ZIP extractor cannot open AES-encrypted ZIPs — recipients on Windows need 7-Zip, WinRAR, or similar. This is a Windows limitation, not a bug.
  • ZIP archives do not encrypt filenames: anyone can list the contents' names and sizes without the password.
  • Legacy ZipCrypto would open everywhere, including Windows Explorer, but it is genuinely weak and this tool will not create it.
  • The AE-2 format authenticates each file individually but the archive structure itself is not tamper-proof the way a .svault container is.
  • SecretPNG is in beta and has not been independently audited.

Security notes

  • AES-256 in AE-2 format is the encryption; the password you pick is the weak point — use a long passphrase.
  • Because filenames stay visible, rename files with revealing names before zipping ('offer_letter_jane_doe.pdf' says a lot on its own).
  • If filename privacy or stronger integrity guarantees matter, the encrypted vault (.svault) tool is the better choice — trade compatibility for stronger properties.
  • Send the password out-of-band: if the ZIP and the password ride in the same email thread, the encryption bought you nothing.

Frequently asked questions

Why can't my recipient open the ZIP by double-clicking it on Windows?
Windows Explorer's built-in extractor only understands the obsolete ZipCrypto encryption, which is weak enough that we refuse to produce it. AES-256 ZIPs require a free third-party tool such as 7-Zip or WinRAR. Mention that when you send the file — it saves a confused reply.
What is wrong with the 'normal' ZIP password everyone used to use?
Legacy ZipCrypto has known cryptographic weaknesses — known-plaintext attacks can recover the keys, and cracking tools handle it routinely. It gives a feeling of security without the substance, which is worse than no lock at all. That is why this tool only produces AES-256 (AE-2) archives.
Can people see what's inside the ZIP without the password?
They can see the file names, sizes, and folder structure — the ZIP format leaves that directory metadata unencrypted. They cannot read the file contents. If the names themselves are sensitive, rename files first or use our .svault vault tool, which encrypts names too.
ZIP vs. .svault vault — which should I use?
Use the ZIP when compatibility is the priority: the recipient can use standard archive tools and expects a familiar format. Use the vault when protection is the priority: encrypted filenames, chunked authenticated encryption, and recovery-key support. Both are built locally in your browser.
Is there a size limit on the archive?
No fixed cap, but everything happens in your browser, so device memory and storage set practical bounds. Multi-gigabyte archives generally work on desktop; on phones, keep archives modest.

Related tools

Create an Encrypted VaultTurn folders and files into one encrypted vault file — locally.Encrypt a FilePassword-encrypt any file in your browser. Nothing is uploaded.
Guides:encryption vs password protectionchoose strong encryption password
Last reviewed: 2026-07-14Open Password-Protect a ZIP

SecretPNG is in beta and has not been independently audited. Security status.