Zro7Zro7HomeAboutBlog
Archive5 min

How to Create an AES-256 Encrypted ZIP in Your Browser

Build a WinZip-compatible AES-256 encrypted ZIP fully in the browser with @zip.js/zip.js. No installs, no server upload, works on any OS.

Encryption runs locally via Zro7 Create ZIP using @zip.js/zip.js. Neither files nor passwords are transmitted.

To create an AES-256 encrypted ZIP, open Zro7 Create ZIP, drop your files in, set a password, and choose AES-256. @zip.js/zip.js — a modern WebAssembly-accelerated ZIP library — encrypts each entry with WinZip-compatible AE-2 AES-256, and downloads the archive. The password never leaves your browser.

AES-256 vs legacy ZipCrypto

  • ZipCrypto (the default in Windows Explorer's Send to → Compressed folder): 40-year-old stream cipher, brute-forceable in minutes with any leaked plaintext byte. Effectively unencrypted.
  • AES-256 (WinZip AE-2): 256-bit AES in CTR mode with HMAC-SHA1 integrity. Requires WinZip, 7-Zip, macOS Archive Utility, or any modern ZIP library to open. This is the format Zro7 produces.

Filenames are metadata

Standard ZIP encryption (AES-256 included) does not encrypt filenames — only file contents. If filenames themselves are sensitive ("salary-2026.xlsx", "passport-scan.pdf"), rename them to opaque strings before zipping, or wrap the ZIP in a second encrypted container (7z has an encrypt filenames option; ZIP does not).

Why local matters

Cloud ZIP-with-password tools (ezyzip.com/protect, archive.online) upload the plaintext files and your password together. Even with HTTPS the operator's server sees both — which defeats the point. Browser-side AES-256 keeps both on your machine.

Password strength

AES-256 is uncrackable by brute force if the password has enough entropy. A random 4-word passphrase (diceware) or a 16-char random string is sufficient. "Winter2026" is not — it falls in seconds to a GPU dictionary attack regardless of cipher.

Steps

  1. Open Create ZIP.
  2. Drop files, enter a strong password, select AES-256.
  3. Click Create. The encrypted .zip downloads.

Frequently asked questions

Which tools can open it?

WinZip, 7-Zip, WinRAR, macOS Archive Utility, PeaZip, and Zro7 Extract Archive. Windows Explorer cannot — it only supports ZipCrypto.

Can Zro7 recover a forgotten password?

No. AES-256 has no back door; that's the point.

Does it support AE-1 for compatibility?

Zro7 writes AE-2 (WinZip's current default). AE-1 differs only in CRC handling and is deprecated.

Are filenames encrypted?

No — ZIP never encrypts filenames. Rename sensitive files first, or use a 7z container with the <em>encrypt filenames</em> option.

Any upload?

None. Encryption runs entirely in your browser tab.

Related posts

← Back to blog
Benchmark

Tesseract.js Accuracy Benchmark: 500 Real-World Documents

We ran Tesseract.js against 500 real receipts, invoices, passports, and screenshots. Character accuracy, word accuracy, and per-language numbers — all measured locally.

Benchmark

How Much CPU and RAM Does ffmpeg.wasm Actually Use? (Measured)

We profiled ffmpeg.wasm on real transcodes — CPU %, peak heap, and wall-clock — across four laptops. Here's what to expect before you ship it in a browser app.

Reference

The Definitive List of File Formats You Can Process in the Browser (2026)

Every file format Zro7 handles fully client-side — PDF, image, video, audio, database, archive, 3D, OCR, network. The canonical reference for browser-based file processing in 2026.