Zro7Zro7HomeAboutBlog
Archive5 min

Extract Password-Protected ZIPs in the Browser — A Full Guide

Open password-protected ZIPs, including AES-256 and legacy ZipCrypto, fully in the browser with libarchive.js. Nothing uploaded, no software installed.

Decryption runs locally via Zro7 Extract Archive using libarchive.js. Passwords are never transmitted.

To extract a password-protected ZIP, drop it into Zro7 Extract Archive. When libarchive.js hits an encrypted entry, a password prompt appears; type it once and the archive decrypts locally. Both AES-256 (WinZip AE-2) and legacy ZipCrypto are supported. The password lives in memory only and never leaves your browser.

The two encryption schemes you'll meet

  • AES-256 (WinZip AE-2) — modern, secure. Produced by WinZip, 7-Zip, macOS Archive Utility, and Zro7 Create ZIP.
  • ZipCrypto — the legacy scheme Windows Explorer's Send to → Compressed folder still uses. Cryptographically weak but universally supported.

What Zro7 handles automatically

  • Detects the encryption type from the entry header.
  • Prompts for a password on the first encrypted entry, then reuses it for the rest.
  • Extracts selected entries or the whole archive.
  • Reports the exact entry that fails if the password is wrong.

Filenames aren't secret

Standard ZIP encryption leaves filenames in plaintext in the central directory. Zro7 Inspect Archive shows them without needing the password. If your filenames themselves are sensitive, use a 7z container with encrypt filenames enabled.

Forgot the password?

There's no recovery. AES-256 has no back door, and even ZipCrypto attacks (Biham-Kocher, plaintext attack) require ~13 GB of RAM and matching known plaintext — beyond a browser tab. Ask the sender to re-send with a fresh password.

Why local matters

Cloud unlockers (unzip-online, ezyzip) receive both the encrypted archive and the password. Even with HTTPS the operator sees plaintext of both, which nullifies the encryption you paid for. Browser-side decryption keeps both on your device.

Steps

  1. Open Extract Archive.
  2. Drop the encrypted ZIP.
  3. Enter the password when prompted; extract entries.

Frequently asked questions

Can it brute-force a lost password?

No. Brute-forcing AES-256 in a browser is not feasible; that's the point of AES-256.

Encrypted RAR archives?

Yes — libarchive handles RAR3/RAR5 encrypted entries the same way.

Password with unusual characters (Unicode, emoji)?

Supported — Zro7 sends the password to libarchive as UTF-8 exactly as typed.

Can the site see my password?

No. It's held in a JS variable in your tab and passed to the WASM module. No network calls involve the password.

Any upload?

None.

Related posts

← Back to blog
Benchmark

Tesseract.js Accuracy Benchmark: 500 Real-World Documents

We ran Tesseract.js against 500 real receipts, invoices, passports, and screenshots. Character accuracy, word accuracy, and per-language numbers — all measured locally.

Benchmark

How Much CPU and RAM Does ffmpeg.wasm Actually Use? (Measured)

We profiled ffmpeg.wasm on real transcodes — CPU %, peak heap, and wall-clock — across four laptops. Here's what to expect before you ship it in a browser app.

Reference

The Definitive List of File Formats You Can Process in the Browser (2026)

Every file format Zro7 handles fully client-side — PDF, image, video, audio, database, archive, 3D, OCR, network. The canonical reference for browser-based file processing in 2026.