Password-Protected ZIP Creator
AES-256 encrypted ZIP archives made and opened on your device.
Files to protect
Your encrypted ZIP is ready
Open AES-encrypted ZIP files with 7-Zip, WinZip or another program that supports them. Built-in unzippers often do not: on macOS, ditto and unzip could not open AES archives in our test. Send the password separately from the files.
Open a password-protected ZIP
Archive
| File | Download |
|---|
About the Password-Protected ZIP Creator
Put files — or whole folders — into a ZIP archive that only opens with your password. Every file is encrypted with AES-256 in the WinZip AES format (AE-2) that 7-Zip and WinZip use, with a new random salt per file and an HMAC that detects tampering. The weak original ZIP encryption ("ZipCrypto") is never used for new archives. Batch mode makes one encrypted ZIP for each file or folder in a single run — for example one payslip per employee.
The second tab opens password-protected ZIP files: AES-128, -192 and -256 archives from WinZip, 7-Zip and others, and old ZipCrypto archives. Download single files, or everything as a normal ZIP without a password — handy when the computer’s built-in unzipper cannot open AES archives. All the work happens in your browser, so your files and password never leave your device.
How to use it
- Choose files, drop them on the box, or press Add a whole folder — folders keep their structure inside the archive.
- Type a strong password twice, or press Generate a strong password and copy it somewhere safe. There is no way to recover a forgotten password.
- Choose One encrypted ZIP with all the files, or One encrypted ZIP for each file or folder (batch). Optionally change the archive name and compression, then press Create encrypted ZIP. With the check option on, the tool decrypts every file again to make sure the archive is complete.
- Press Download (in batch mode, download each archive or all of them in one ZIP) and send the password to the recipient in a different way than the file (for example, by phone or a different app).
- To open an archive, choose Open ZIP, pick the .zip file, type the password and download the files.
Examples
Folder "ITR 2026" with 14 PDFs and photos · a password from “Generate a strong password”
ITR 2026.zip — every file AES-256 encrypted; photos and PDFs stored, text compressed
Already-compressed files (JPG, PNG, PDF, MP4, ZIP, Office files) are stored as they are: compressing them again only costs time.
payslip-anita.pdf, payslip-ravi.pdf, payslip-sam.pdf · batch mode · one password
payslip-anita.zip, payslip-ravi.zip, payslip-sam.zip — download each, or all three in encrypted-zips.zip
A folder you add becomes one archive with everything in it. Every archive uses the same password: to give each person their own password, create them one at a time.
report.zip (AES-256) + the password from the sender
report-unlocked.zip — the same files, no password, opens anywhere
Common uses
- Emailing payslips, ID scans or medical reports so that only the person with the password can open them.
- Backing up a folder to a USB drive or cloud storage in a form that stays private if the drive is lost.
- Opening an encrypted ZIP on a computer where you cannot install 7-Zip or WinZip.
- Turning an AES-encrypted ZIP into a normal one for a computer whose built-in unzipper does not support AES.
How the encryption works
For each file a 16-byte random salt and your password go through PBKDF2-HMAC-SHA1 with 1,000 iterations, giving a 256-bit AES key, an HMAC key and a 2-byte check value. The compressed file is encrypted with AES-256 in counter mode, and a 10-byte HMAC-SHA1 of the encrypted data is stored after it, so changes are detected before anything is unpacked. This is the WinZip AES specification (AE-2, compression method 99, extra field 0x9901), which the 7-Zip site lists as "AES-256 encryption in 7z and ZIP formats".
The output is tested here against two independent implementations — libarchive (the library behind the bsdtar command) and libzip (the library PHP’s ZipArchive uses): both unpack every file with the right password and refuse a wrong one, and archives made by libarchive, libzip and Info-ZIP open in this tool.
Your password is the real protection
AES-256 cannot be broken, but a guessable password can: anyone who has the file can try passwords as fast as their hardware allows, and 1,000 PBKDF2 iterations make each guess cheap. Use at least 12 random characters or a passphrase of five or more random words — the passphrase generator and the password strength checker help. Characters outside plain ASCII (accents, other scripts, emoji) are encoded as UTF-8, which other programs may handle differently, so they are best avoided in archive passwords.
What a ZIP password does not hide
ZIP encryption protects the contents of the files, not the list: file names, folder names, sizes and dates can be read by anyone who has the archive, without the password. If the names themselves are sensitive, rename the files before adding them, or put them in an encrypted archive and encrypt that archive again.
Old archives may use ZipCrypto, the original ZIP encryption, which is weak: researchers published a practical known-plaintext attack against it in 1994 (Biham and Kocher). This tool opens such archives, marks them as weak, and never creates them.
Limitations
- Archives are made in your browser’s memory: up to 2 GB in total and 65,535 files per archive (no ZIP64). Use 7-Zip for larger archives. Archives of any size can be opened, but a single file — or “download all” — can unpack at most 2 GB.
- Opening supports Stored and Deflate compression, which nearly all ZIP files use; Deflate64, BZIP2, LZMA, Zstandard and PPMd entries are listed but cannot be unpacked.
- PKWARE’s proprietary “strong encryption” and split (multi-volume) archives are not supported.
- Built-in unzippers often lack AES support: on macOS, the
dittoandunzipcommands reported unsupported compression for these archives in our test. - File names, sizes and dates inside a ZIP are not encrypted.
Privacy
Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.
Frequently asked questions
Which programs can open the ZIP files made here?
Programs that support WinZip AES encryption, such as 7-Zip and WinZip, and software based on libarchive (like bsdtar) or libzip, which this tool is tested against. The tool itself opens them too, on any device with a modern browser. Some built-in unzippers cannot — if the recipient gets an error, ask them to use 7-Zip, or to open the archive here.
Are my files uploaded anywhere?
No. Compression, encryption and decryption run in your browser, in a background worker. The files and the password are never sent to a server, and the page works offline once it has loaded.
I forgot the password. Can you recover it?
No — nobody can. AES-256 has no back door, and this tool keeps no copy of your password. The only way in is the right password.
Is AES-256 ZIP encryption secure?
Yes, with a strong password. The file contents are protected by AES-256 and an HMAC; the weak points are short or guessable passwords and the fact that file names stay visible.
Why is my archive not smaller than the files?
Photos, videos, PDFs and Office documents are already compressed, so they are stored as they are. Text, spreadsheets in CSV, logs and code shrink a lot.
Can I make a separate encrypted ZIP for each file?
Yes: choose One encrypted ZIP for each file or folder (batch). Each file you add becomes its own archive (report.pdf → report.zip) and each folder becomes one archive with everything in it; all of them get the same password. Download them one by one, or all together in one ordinary ZIP (encrypted-zips.zip) that contains the encrypted archives.
Can I remove the password from a ZIP?
Yes, if you know it: open the archive in the second tab, type the password and press Download all as a ZIP without password. The files are decrypted and saved in a normal ZIP without being compressed again.