Let's suppose that I share an illegal copy of a material on web which is in password protected zip file, can the owner send me a copyright notice or know what's inside the zip without knowing the password?

  • 2
    Possible duplicate of Are password-protected ZIP files secure?
    – Alexei
    Commented May 31, 2018 at 18:06
  • They can definitely try to crack it and succeed, but the question then might become about law: is it legal to crack o try to crack a password protected file to check if it contains something that breaks copyright? You might want to ask on law.stackexchange, if you don't I might do it myself because it seems interesting.
    – reed
    Commented May 31, 2018 at 18:27
  • 1
    There was a criminal case involving an encrypted archive from F-Secure where all that was needed for a conviction was file names and sizes, no file contents.
    – forest
    Commented Jun 1, 2018 at 0:15
  • 3
    Yes, and trivially. An attack from '94 has allowed decrypting ZipCrypto-encrypted files in minutes without knowledge of the password.
    – forest
    Commented Jun 1, 2018 at 14:46

3 Answers 3


Potentially, yes.

Encrypted zip files protect the data reasonably well (perhaps the equivalent of a cheap lock) but leak meta-data about the files inside the zip. Like a cheap lock, an attacker with a small degree of training could still break the underlying encryption. The far easier scenario is the meta-data, which requires no cracking. That means the filenames, file dates, file lengths, and directory names of all the files inside the zip file are all stored in the clear. This is extremely trivial to find without the password, and can be done using the command line zip utility to list the contents of the zip file.

If the file names inside the zip file have names associated with copyrighted content, the copyright holder is going to assume the zip file contains copy-written content. Matching file sizes of the original files would only provide further evidence.

One way to protect against this is to simply zip up your files, and then zip-encrypt the resulting zip file again. The meta-data at the lower level should now be protected by the outer layer zip file. You'd still be vulnerable to the attacks above to decrypt the data since the encryption is still "cheap lock" equivalent.

  • 2
    @dandavis Now that I think about it, I think you're right. There's no need to encrypt the inner zip. I'll change the answer. Commented May 31, 2018 at 19:54
  • 2
    Zip encryption (when using the default ZipCrypto rather than one of the two strong ad hoc implementations using AES) is not reasonably good. In fact, it's really, really bad.
    – forest
    Commented Jun 1, 2018 at 0:14
  • 1
    @SteveSether In a month? You could crack it in a few hours on a 10+ year old home PC. It literally uses a non-cryptographic CRC to encrypt the files.
    – forest
    Commented Jun 1, 2018 at 14:02
  • 1
    13 known plaintext bytes is trivial, to the point where any file will contain significantly more than that. Even a blank JPEG will contain that many known plaintext bytes. I would actually be surprised if you could show me a single Zip file that does not contain that. Also it can require even less with more computing power (and it turns out it took a few hours on a '94 home PC so 20+ years old, not 10, so it should take a fraction of a second today). Given that a simple program could automate decryption for someone without any crypto knowledge, it's more like a sign saying "keep out".
    – forest
    Commented Jun 1, 2018 at 14:14
  • 3
    DON'T DO THE "ONE WAY..." OPTION - zips are bad for security, just don't.
    – Jonathan
    Commented Jun 1, 2018 at 18:24

Yes. Aside from the fact that the filenames are unencrypted, the contents of a password-protected Zip file can be recovered if it uses the old, insecure ZipCrypto cipher which uses the insecure, non-cryptographic CRC algorithm for data confidentiality. A research paper from 1994 showed that an attack against the underlying encryption can be done in several hours regardless of the strength of the password on a contemporary home PC. Nowadays, such an attack can be completed in seconds with free and publicly available tools. You must not rely on default, legacy Zip encryption.

The PKZip format supports three encryption methods. The first is the legacy, highly-insecure ZipCrypto. The second is AES-based encryption stored in the compression field in the metadata, and the third is AES-based encrypting using its own header format. The encryption specification is online. Using AES-based encryption rather than legacy encryption can result in incompatibilities, especially with older programs, but most modern, well-designed Zip programs can handle it.

In order to protect the contents of a Zip file, you should use strong encryption. Various tools such as WinZip and 7zip support an ad hoc AES-based format for Zip files which additionally encrypts the individual filenames and sizes within the compressed archive.


Yes. Yes. They can.


The main point is in zip encryption, the filenames are not encrypted. WHAT A JOKE.

That means if you name your file "taylor swift's latest song", they could reasonably infer that your zip archive contains tailor swift's song, and file a takedown notice.

I haven't tried this, but maybe you can double zip. 1. zip the files into a file called "files.zip", and 2. zip and encrypt the file "files.zip". Then when you look into the encrypted archive's files, all you see is "files.zip" and that reveals no information about the actual data.

Do not use zip for security. --- INSTEAD try send.firefox.com

  • The compression algorithm is fixed, zip within zip file size will leak original file name size. You should add some "salt" file to the inner zip.
    – mootmoot
    Commented Jun 1, 2018 at 15:39
  • @mootmoot the size of the filename isn't part of the new zip file. But regardless, it doesn't matter. Don't use zip for security.
    – Jonathan
    Commented Jun 1, 2018 at 18:20
  • Not sure I'd recommend trusting a web service for encrypting files when it's really not necessary Commented Jun 1, 2018 at 23:41
  • It’s better than the alternative discussed here.
    – Jonathan
    Commented Jun 2, 2018 at 0:02
  • Whether or not send.firefox.com was ever a good idea or not, it has now been permanently closed. Commented Dec 4, 2020 at 11:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .