If you are searching for this, you are probably about to send real data: HR packs, customer exports, contracts, financials, tax folders, maybe a whole "project" directory that you don't want floating around in plain text.

And someone has said:

“Can you just send it as a password-protected ZIP?”

Totally reasonable ask. The problem is that a lot of "password-protected ZIPs" are fake security:

Many tools still use ZipCrypto, an old ZIP 2.0 scheme that is widely documented as weak and vulnerable to known-plaintext attacks.
Some OS features "compress" but do not encrypt at all.
Even with AES, ZIP doesn't have modern password hashing, so short passwords are especially dangerous.

So your instinct—“I want this to actually be secure, not just look secure”—is exactly right.

Let's build a setup that is honest, cross-platform, and not painful for the people on the other side.

1. Why you need this (how ZIPs actually cause problems)

ZIPs show up in all types of workflows:

HR: offer letters, payroll exports, ID scans.
Finance / tax: bank exports, statements, full-year documents.
Legal / deals: contracts, disclosure bundles, cap table snapshots.
Customer work: CSVs, logs, reports, delivery assets.

The ways they leak are boring:

You send an unencrypted ZIP thinking "at least it's in one file." Anyone who gets it can open it.
You use default "password protection" that turns out to be ZipCrypto, which is considered broken and easily crackable with widely available tools.
You send the ZIP and password in the same email, so anyone who gets the thread has everything they need.
Once the recipient extracts the contents, files spread into Downloads, synced folders, backups—you lose visibility completely without document analytics.

So yes, you should care. You just need to aim at the right target.

2. What “password protecting a ZIP” really has to do

Strictly speaking, a good setup needs to handle two separate jobs:

Protect the archive at rest.
- Use real encryption, not just compression.
- Prefer AES-256 over ZipCrypto; modern archivers like 7-Zip can create AES-encrypted ZIPs or 7z archives.
- Assume the attacker can run password-guessing tools; this is why password length matters.
Accept the limits of the format.
- Once someone has both the archive and the password, they can copy, extract, and forward everything. Screenshot protection and watermarking help deter this.
- ZIP has no built-in revocation, no analytics, no expiry. Secure document sharing platforms provide access revocation and page-level analytics.
- ZIP also lacks modern key-stretching; short passwords are extra weak even with AES.

That is why, whenever there is a real relationship (clients, investors, partners), a lot of people are moving to:

"Use ZIP for packaging; use a separate system for access control."

This is where Peony gives you a cleaner default.

3. How to do it with Peony (including passwords)

With Peony, you get two layers:

A secure room around the ZIP (identity, revocation, analytics).
An optional file-level password if someone insists on “we need a password to type in.”

Step 1 – Create a secure room for your bundle

First, prepare your ZIP however you like (it can be plain or already AES-encrypted):

Example: client-x-2025-financials.zip

In Peony:

Create a room, e.g. “Client X – 2025 Financial Pack”.
Upload the ZIP file (and any related documents you might want to share later).

This room is now your “vault” for that bundle.

Step 2 – Set who is allowed in

In the Peony room:

Grant access only to specific email addresses or trusted domains (e.g. @client.com) using identity-bound access.
Add passwords to Peony rooms for an additional layer of protection—you can require both identity verification and a password.
For external parties, set view/download permissions according to need:
- If they must receive the ZIP file: allow downloads but keep access restricted.
- If they only need to see contents you've previewed: keep them view-only.

Already, you have something better than a shared ZIP password: identity-based access.

Step 3 – Add a Peony passcode for the file/link

On top of identity, you can:

Add a passcode to the shared Peony link or file.
Recipients must both:
1. Reach the Peony link, and
2. Enter the passcode to view or download.

This achieves the “we want a password gate” requirement without relying on fragile ZipCrypto, and it keeps all crypto and keys on the Peony side rather than inside a brittle archive format.

You can share this passcode out-of-band (SMS, call), just like you would with a ZIP password—but now, even if the ZIP itself is not encrypted, it is never served without that gate.

Step 4 – Share one secure link instead of a raw attachment

In your email:

“Here’s a secure link to the ZIP. It’s behind a passcode so we keep access under proper control on our side.”

Drop the Peony link rather than attaching the archive.

You can:

Replace or update the ZIP without changing the link.
Disable the link or pull access entirely using access management once the work is done.

Step 5 – Use analytics and revocation

Because everything flows through Peony, you can with page-level analytics:

You see who accessed and downloaded the ZIP.
You see when they accessed it and how long they viewed it.
You can revoke specific users, domains, or the whole room using access management.

That is everything people secretly want ZIP passwords to do—but the ZIP format itself cannot.

4. Other methods if you can’t use Peony

If you truly must hand over a self-contained, password-protected ZIP file, here is the honest cross-platform picture.

Windows

The built-in “Send to → Compressed (zipped) folder” does not encrypt; it just compresses.
To get real encryption:
- Use 7-Zip and choose:
  - Format: zip or better 7z
  - Encryption: AES-256 (not ZipCrypto)

macOS

Finder's "Compress" with Terminal zip -er uses legacy ZIP encryption (ZipCrypto), which is considered weak.
For better security:
- Use a tool like Keka or another 7-Zip-compatible archiver. Keka supports AES-256 for 7z archives and legacy ZIP 2.0 for .zip.
- If the other side can install 7-Zip/compatible tools, prefer 7z + AES-256.

Linux / CLI

zip -er file.zip folder/ uses traditional ZIPCrypto encryption—again, weak.
Install p7zip and use:
```
7z a -t7z -p -mhe=on secure.7z folder/
```
for AES-256-encrypted 7z archives.

In all of these, security rests heavily on the password quality.

5. Practical setup tips (so this becomes a calm habit)

A few simple rules will put you in the top tier of “people who actually do this right”:

Use long passphrases, not cute 8-char strings. NIST’s more recent guidance leans toward 12–16 characters or more and treats length as the main defense.
Never send file and password in the same channel. Email the ZIP (or Peony link), text or call the passcode.
Prefer AES-256 or 7z over ZipCrypto. Legacy ZIPCrypto is explicitly described as broken and easy to crack; use it only when compatibility absolutely forces you.
Keep a clean original and clean up after. Store your unencrypted source in a safe place; delete stray encrypted copies once they are no longer needed, and revoke Peony access using access management when a project ends.
Default mindset:
- ZIP (or 7z) = "protect at rest."
- Peony = "control who can get it, when, and how."

You don't have to become a crypto engineer. If you:

Use Peony rooms + link passcodes for sharing,
Use AES-based archives only when you truly need a "standalone" encrypted file, and
Follow sane password hygiene,

then "password protecting ZIP files" stops being a vague anxiety and becomes a straightforward, boring, reliable part of how you move sensitive bundles around.

Frequently Asked Questions

How do you password protect a ZIP file?

Peony is the best solution: share your ZIP via a secure Peony link with identity-bound access and optional password protection instead of embedding a password. For traditional password protection, use 7-Zip on Windows (AES-256), Keka on macOS, or terminal zip -er on Linux/macOS.

Can you password protect ZIP files for free?

Yes, multiple free options exist: 7-Zip (Windows, open-source), Keka (macOS), or built-in terminal tools on macOS/Linux. Peony provides secure sharing with identity-bound access, password protection, watermarking, and tracking without password embedding.

What's the best way to password protect a ZIP file?

Peony is best for sharing: provides identity-bound access, password protection, watermarking, revocation, and tracking without password sharing. For static password-protected ZIPs, use 7-Zip with AES-256 encryption—avoid ZipCrypto which is easily cracked.

Can you update a password-protected ZIP after sending it?

No, password-protected ZIPs cannot be updated after creation. You must create a new protected archive and resend. Peony solves this: update the ZIP or contents behind the same secure link—all recipients automatically see the latest version without resending files.

How secure is password protecting a ZIP file?

Secure when done correctly with AES-256 encryption. ZipCrypto is weak and easily cracked, so always use AES-256. However, password-protected ZIPs provide no tracking or revocation after sharing. Peony adds identity-based access, password protection, watermarking, and revocation for better security in shared scenarios.

Can you see who accessed a password-protected ZIP?

No, password-protected ZIPs provide no access logs or tracking. Once the password is shared, you can't see who opened the archive or when. Peony provides complete visibility: see who accessed files, when, how long they viewed them, and which files they engaged with.

Secure Your Documents

How to Password Protect ZIP Files in 2025: Complete Cross-Platform Guide to Archive Encryption