Password protect a zip file on a Mac, and the weakness to know
· 7 min read
To password protect a zip file on a Mac, open Terminal and run zip -er Taxes.zip Taxes, replacing Taxes with your folder’s name. It asks for a password twice and makes an encrypted zip that Archive Utility on a Mac and File Explorer on Windows both open with a password prompt. Finder’s Compress command has no password option on macOS Sequoia, so Terminal is the built-in route.
The weakness to know before you rely on it: standard zip encryption is old and breakable, and the file names inside stay readable to anyone who has the file. Both are covered below, along with a stronger option that is also already on your Mac.
How to password protect a zip file on a Mac
- Open Terminal (Applications, Utilities).
- Move to the folder that holds the item you want to zip. If it is on the Desktop, type
cd ~/Desktopand press Return. - Run the command below, using your own names.
- Type the password at “Enter password:” and again at “Verify password:”. Nothing appears while you type; that is normal.
zip -er Taxes.zip Taxes
Taxes.zip appears next to the original folder. The -e means encrypt and the -r means include everything inside the folder. For a single file, drop the r: zip -e Contract.zip Contract.pdf.
Two refinements worth knowing:
- Leave out Finder’s hidden files. Add
-x "*.DS_Store"to the end of the command, so the recipient does not get the invisible .DS_Store files Finder leaves in folders. - Already made the zip with Finder’s Compress? Run
zipcloak Archive.zipand it adds a password to every file inside, using the same encryption.
You may see zip -P recommended online, with the password typed into the command itself. Do not use it. The password ends up in your shell history and is visible to other processes while zip runs, and zip’s own manual calls the option insecure.
The zip does nothing to the original folder, which is still sitting there unencrypted.
Opening it on a Mac or a PC
On a Mac, double-click the zip. Archive Utility asks for the password and expands it into a folder next to the zip. In Terminal, unzip Taxes.zip does the same and prompts for the password.
On Windows, File Explorer opens this kind of zip and asks for the password when the files are extracted. That compatibility is why this old encryption is still so common. If the zip refuses to open, the Mac says it is unable to expand a zip file covers the usual causes.
The weakness: what zip encryption does not protect
The encryption itself is weak. The zip command’s own help describes the -e option as “standard (weak) PKZip 2.0 encryption”, often called ZipCrypto. It has two problems. Checking a guessed password costs almost nothing, so short passwords fall quickly to guessing software. Worse, a known-plaintext attack published in the 1990s can recover the encryption keys without ever finding the password, if the attacker knows a small piece of the original content of one file in the archive. That is not always available, but do not build your privacy on it being unavailable.
The file names are not encrypted. Encryption covers the contents of each file, not the list. Names, folder structure, sizes and dates stay readable. Anyone can run unzip -l Taxes.zip and see the full listing without the password. An archive containing “Passport scan.jpg” and “2025 tax return.pdf” says plenty on its own.
Once extracted, it is plain. The recipient’s expanded copy is an ordinary, unencrypted folder on their disk.
For keeping casual eyes off a file in transit, a zip password is fine. For anything that would do real harm in the wrong hands, use one of the stronger options below.
A stronger zip with the tar command
The tar command built into macOS can make zips with AES-256 encryption. That is not open to the known-plaintext attack above, and each guess costs far more, though a long passphrase still matters. The command is longer:
tar --format zip --options zip:encryption=aes256 --exclude .DS_Store -cf Taxes.zip Taxes
Unlike zip, tar asks for the passphrase only once, so a typo would be locked in. Test the archive straight away:
tar -xOf Taxes.zip > /dev/null
That asks for the passphrase and reads every file without writing anything. No message means it worked; a wrong passphrase prints “Incorrect passphrase”.
Two caveats. File names are still visible, exactly as with a standard zip. And fewer tools open AES zips: on a Mac, tar -xf Taxes.zip extracts one, but Windows’ built-in zip support has long refused them, so the recipient may need a third-party archiver. Check what they use before you send it.
When a zip is the wrong tool
Keeping files private on your own Mac. A zip is a copy you have to extract every time you use it, and the unencrypted original is usually still on the disk. An encrypted disk image is AES-encrypted, hides file names until you unlock it, and can be edited in place. Encrypt a folder with Disk Utility walks through it. If you would rather not manage images at all, Hushbox locks a folder where it sits from the Finder right-click menu, using the same AES-256 disk images Disk Utility makes, and locks it again when the screen locks or the Mac sleeps. It is for files that stay on your Mac: it does not share or send anything, and the locked item’s name still shows in Finder.
Sending one document. A PDF with an open password is often simpler than a zip, because the recipient needs nothing but a PDF reader. Password protect a PDF on a Mac shows how.
Sending to someone on Windows. A standard zip opens everywhere but is weak; an AES zip is strong but may need an archiver on their side. Choose based on how sensitive the contents are.
Whichever you use, never send the password in the same email as the file. A text message or a phone call keeps the two apart, so one intercepted message does not hand over both.
Questions
Why is there no password option when I compress a file in Finder?
On macOS Sequoia, Finder’s Compress makes an ordinary zip with no password. The zip -e command in Terminal is the built-in way to add one, and zipcloak adds one to a zip you already made.
Can someone see what is inside a password-protected zip without the password? They can see the file and folder names, sizes and dates, but not the contents. Choose file names with that in mind, or use an encrypted disk image, which hides names too.
How do I remove the password from a zip?
Run zipcloak -d Archive.zip and enter the password; it rewrites the archive without encryption. Or expand it and compress the folder again with Finder.
Is a password-protected zip safe to email? For ordinary privacy, yes, with the password sent separately. For tax returns, ID scans or anything similar, prefer an AES zip, a password-protected PDF, or a secure file-sharing service.