It is worth mentioning that the issue is with the encryption standards of the zip format, not with the
Also, the man page of
zip notes this issue.
Use password to encrypt zipfile entries (if any). THIS IS
INSECURE! Many multi-user operating systems provide ways for
any user to see the current command line of any other user;
even on stand-alone systems there is always the threat of
over-the-shoulder peeking. Storing the plaintext password as
part of a command line in an automated script is even worse.
Whenever possible, use the non-echoing, interactive prompt to
enter passwords. (And where security is truly important, use
strong encryption such as Pretty Good Privacy instead of the
relatively weak standard encryption provided by zipfile util‐
For more comprehensive documentation on this issue, take a look at this paper (written by a professor at my University :) ) https://homes.cs.washington.edu/~yoshi/papers/WinZip/winzip.pdf