Recover Forgotten ZIP Password: Step-by-Step Guide

Updated 6 November 2026 · Standard formula, shown below

This guide walks you through practical methods to recover or bypass a forgotten password on a ZIP file. You’ll learn how to use built-in tools, free software, and manual tricks, and what to do when none of them work. Start by identifying the ZIP type and having a list of possible passwords ready.

What You’ll Need

The encrypted ZIP file itself
A computer running Windows, macOS, or Linux
Optional: a list of likely passwords (dictionary)
Optional: free third-party tools like 7-Zip, John the Ripper, or Hashcat
Patience â€“ brute-force recovery can take time

Step-by-Step

Identify the ZIP encryption type. Right-click the ZIP file and open its properties (Windows) or Get Info (macOS). Look for encryption details. Traditional ZipCrypto is weaker than AES-256; knowing the type helps choose the right tool.
Try common passwords first. Before using any software, test simple passwords like “123456”, “password”, the date, or names of people/pets. Many users set simple passwords.
Use a password recovery tool. Download a reputable tool such as 7-Zip (for extraction attempts) or a dedicated recovery tool like John the Ripper. For example, with John the Ripper, you can extract the hash using zip2john file.zip > hash.txt and then run john hash.txt.
Run a dictionary attack. Use a wordlist (e.g., rockyou.txt) with your tool. This tries thousands of common passwords quickly. In John: john --wordlist=rockyou.txt hash.txt.
Try a brute-force attack. If dictionary fails, set a mask for characters (e.g., 4-8 lowercase letters). In Hashcat: hashcat -m 13600 hash.txt -a 3 ?l?l?l?l?l. Start with short lengths and increase.
Consider a known-plaintext attack. If you have an unencrypted version of one file inside the ZIP (e.g., a README), you can use tools like pkcrack to recover the password faster.
Check for backup copies. Look in your email, cloud storage, or old backups for an unencrypted version of the file. Sometimes the password is stored in a note or password manager.
Contact the sender. If the ZIP came from someone else, ask them for the password. They may have it in their records.
As a last resort, accept the loss. If all methods fail, you may need to recreate the file from other sources or ask the creator to re-send it unencrypted.

Common Mistakes

Using the wrong tool for the encryption type. Some tools only support ZipCrypto, not AES-256. Check compatibility.
Giving up too early on brute-force. Even a 6-character password can take hours. Let it run overnight.
Not trying a dictionary first. Brute-force is slower; always start with common passwords.
Forgetting that the password might be case-sensitive. Try variations like “Password” vs “password”.
Using a tool that modifies the original file. Some tools may corrupt the ZIP. Always work on a copy.

Tips

Use a password manager to store passwords for future ZIP files.
Keep a backup of the unencrypted file if you ever need to access it without a password.
If you know part of the password, use a mask attack (e.g., ?l?l?l?l?l for 5 letters).
For very complex passwords, consider cloud-based recovery services (but be aware of privacy risks).
Always download tools from official sources to avoid malware.

Troubleshooting

Tool not recognizing the ZIP? Ensure the file is not corrupted. Try opening it with 7-Zip to see if it reads the header.

Brute-force too slow? Use a GPU-accelerated tool like Hashcat. It can be hundreds of times faster than CPU-only tools.

Dictionary attack finds nothing? Try a larger wordlist or combine with rules (e.g., adding numbers to the end).

Hash extraction fails? Make sure you have the correct version of zip2john. Some ZIPs use a different format.

Password found but doesn’t work? Double-check for typos or spaces. Try the password in a different extraction tool.

File is encrypted with AES-256? Use tools that support AES, like 7-Zip’s own brute-force plugin (though it’s slow) or specialized software like Elcomsoft.

Frequently Asked Questions

Q: Can I recover a ZIP password for free?
A: Yes, tools like John the Ripper and Hashcat are free and open-source. They work well but may require technical knowledge.

Q: How long does it take to brute-force a ZIP password?
A: It depends on password length and complexity. A 6-character lowercase password can take minutes to hours on a modern GPU; a 10-character mixed password could take years.

Q: Is it legal to recover a ZIP password?
A: It’s legal if you own the file or have permission from the owner. Using it on someone else’s file without permission may be illegal.

Q: What’s the difference between ZipCrypto and AES-256?
A: ZipCrypto is older and weaker; AES-256 is stronger. Recovery tools often have separate modes for each.

Q: Can I use my graphics card to speed up recovery?
A: Yes, Hashcat supports GPU acceleration and can be much faster than CPU-only methods.

Q: What if I remember only part of the password?
A: Use a mask attack. For example, if you know it’s 8 characters starting with “abc”, set the mask to abc?l?l?l?l?l.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.