Password protect a ZIP file
An AES-256 locked ZIP, made on your device, for files you would rather not hand to a website.
- Nothing is uploaded
- Works offline after first visit
- Open source
- No watermark. A ZIP can be up to 4 GB, and phones hold less.
Make a password-protected ZIP of your files or a folder with AES-256 encryption, in your browser on Windows, Mac or a Chromebook. It is free, needs no account and adds no watermark, and your files are not uploaded: everything runs in your browser on your device. A ZIP can be up to 4 GB, and phones hold less; give the page a short while after one visit to save itself for offline use, and then it works offline.
Done
Open the network tab. Your files never appear in it.
Add files and run the tool to see every request this tab makes.
Your files are processed on this device and never sent to a server. Reload the page to clear everything from memory.
Windows can make a ZIP but cannot put a password on it, and neither can the Finder on a Mac, which is why people search for a way to do it. The usual answers are to install 7-Zip or to upload the files to a website, and uploading private files to a stranger’s server so it can lock them for you is exactly the risk the password was meant to remove. This page builds the ZIP and encrypts it in the browser tab instead.
A worked example: you need to email three scanned tax forms to your accountant. Drop the PDFs here, type a long password such as a line from a song, and press Create locked ZIP. You get tax-forms.zip if you named it, or files.zip, with every PDF encrypted with AES-256. Email the ZIP, then send the password by text message rather than in the same email, so someone who gets into one inbox does not get both.
Your accountant opens it with 7-Zip or WinRAR on Windows, or The Unarchiver or Keka on a Mac, all free; the zip opener built into Windows and macOS may not accept the AES format. The names of the files inside stay visible without the password, as in every ZIP, so do not put secrets in the file names.
How it works
- Drop the files or the folder.
- Type a password, and tick Show password to check it.
- Press Create locked ZIP and send the password separately.
In your browser, not on a server
Your files are read into this tab and packed with fflate (MIT), which deflates text and documents and stores already-compressed photos, videos and archives as they are. Folders you drop or pick keep their structure inside the ZIP. With a password, each file gets its own random salt; PBKDF2 with SHA-1 (the browser’s Web Crypto) turns the password into an AES-256 key and an authentication key, the compressed file is encrypted with AES in counter mode (the AES code is @noble/ciphers, MIT, an audited JavaScript library), and an HMAC lets the opener check the password and spot tampering. This is the WinZip AE-2 format that 7-Zip and WinRAR write.
Compared with upload-based tools: Online zippers upload every file, and a password-protect service sees both the files and the password, which defeats the point of locking them. Here nothing leaves your device and there is no size cap beyond your device’s memory (phones hold less).
Verify it yourself. Give the page a short while after one visit to save itself for offline use, then turn off Wi-Fi or switch to airplane mode and run the tool again. Or open your browser's developer tools (F12, or Cmd-Option-I on a Mac), pick the Network tab, and watch it while you convert. The panel above does the same count for you.
Questions
Can I add a password to a ZIP I already have?
Open it with our archive opener, download all the files, then drop them here to make a new locked ZIP. A ZIP cannot be locked in place without being rebuilt.
What if I forget the password?
The files cannot be recovered: nothing about the password is stored anywhere, here or in the ZIP. Keep the original files until you know the person got them.
Are the file names hidden?
No. ZIP encryption covers the contents of each file but not its name or size. If the names give something away, rename the files before zipping, or zip them in a folder called something plain.
Is anything uploaded?
No. The files are read, compressed and encrypted in this tab, and the password never leaves it.
More PDF tools
Create ZIP
Files and folders packed into one ZIP on your own device, locked with a password when they are private.
Signature maker
Draw it with a finger or mouse, type your name in a script font, or take it from a photo. Save a transparent PNG for documents, or place it on a PDF.
Extract Images from PDF
Every picture in the file, at its real size, without screenshots and without uploading the PDF.
Fill PDF form
Tax forms, applications and contracts carry your most personal details. Fill them in here and the file never leaves this device.
Other conversions
Guides
- How to open a RAR or 7z fileRAR and 7z are archive formats like ZIP, but not every device opens them. Here is what works on Windows, Mac and phones, and a way that needs no install.