Skip to main content
7-Zip provides strong encryption capabilities using AES-256 to protect sensitive data in archives.

​
Encryption Methods

​
7z Format Encryption

The 7z format uses AES-256 encryption with SHA-256 key derivation:
  • Method ID: 06 F1 07 01 (7zAES)
  • Key derivation: SHA-256 based
  • Key length: 256 bits
  • Encryption: AES-256 in CBC mode
  • Authentication: Encrypted headers with CRC

​
ZIP Format Encryption

ZIP archives support two encryption methods:
  1. ZipCrypto (legacy, weak)
    • Traditional ZIP encryption
    • Not recommended for sensitive data
  2. AES-256 (recommended)
    • Method ID: 04 01 63 (wzAES)
    • AES encryption with HMAC-SHA1 authentication
ZipCrypto is weak and can be cracked. Always use AES encryption for ZIP archives.

​
Creating Encrypted Archives

1

Set a strong password

Use the -p switch followed by your password:
For interactive password prompt (more secure), use -p without a value:
2

Encrypt file names (7z only)

Use -mhe=on to encrypt file names in the archive headers:
This prevents anyone from seeing file names without the password.
3

Choose encryption method (ZIP)

For ZIP archives, explicitly set AES-256:

​
Extracting Encrypted Archives

​
Password Requirements

​
Best Practices

  • Minimum length: 12+ characters
  • Complexity: Mix uppercase, lowercase, numbers, and symbols
  • Avoid: Dictionary words, personal information, common patterns

​
Password Strength Examples

​
Header Encryption

​
7z Archives

Use -mhe=on to encrypt archive headers:
Benefits:
  • File names are encrypted
  • File sizes are hidden
  • Directory structure is concealed
  • Cannot list contents without password
Without header encryption (default):
With header encryption:
ZIP format does NOT support header encryption. File names are always visible.

​
Encryption Performance

AES-256 encryption has minimal performance impact:

​
Advanced Encryption Options

​
Solid Archives with Encryption

Combine solid compression with encryption for maximum security and compression:

​
Multi-volume Encrypted Archives

Split encrypted archives into volumes:

​
Self-Extracting Encrypted Archives

Create encrypted SFX archives:

​
Security Considerations

Password Security
  • Passwords on command line may be visible in process lists
  • Use interactive prompt (-p without value) for sensitive operations
  • Command history may store passwords
  • Use password managers for strong, unique passwords
AES-256 SecurityAES-256 is considered unbreakable with current technology when used with a strong password. The weakest link is typically:
  1. Weak passwords - Use strong, random passwords
  2. Password reuse - Use unique passwords per archive
  3. Social engineering - Protect passwords from unauthorized access

​
Scripting with Encrypted Archives

​
Using Password Files

​
Environment Variables

​
Batch Processing

​
Encryption Implementation

7-Zip’s encryption is implemented in:
  • C/Aes.c - AES algorithm (lines 1-544)
  • C/AesOpt.c - Optimized AES with hardware acceleration
  • C/Sha256.c - SHA-256 for key derivation
  • CPP/7zip/Crypto/7zAes.cpp - 7z encryption wrapper
  • CPP/7zip/Crypto/WzAes.cpp - ZIP AES encryption
7-Zip uses hardware AES acceleration (AES-NI) when available, providing fast encryption with no measurable performance impact on modern CPUs.

​
See Also