We see this every week in remote sessions. Someone's sitting on a Python file locked inside a password-protected ZIP, the password is gone, and Windows just keeps throwing up a prompt that won't budge. ZIP password recovery isn't magic, but there is a proper order to attack it, and most people skip straight to the hard stuff when the answer was sitting in their inbox all along.

TL;DR

ZIP password recovery on Windows goes in three tiers: first try obvious passwords and check your email history, then use a dedicated recovery tool with a dictionary attack, and finally run a structured brute-force with John the Ripper or a Python script. There is no backdoor. If the password is truly random and long, recovery may not be possible without serious compute time.

⏳️ 13 min read ✅ 60% success rate (depends on password complexity) 📅 Updated July 2026

Key Takeaways

ZIP password recovery requires the correct password. There is no bypass or master key for properly encrypted archives.
Start with the obvious: check emails, message history, and ask the sender before running any cracking tools.
Python's zipfile module can test a known password but cannot crack one on its own without a wordlist loop.
Dictionary attacks succeed on human-chosen passwords. Brute-force on long random passwords is often impractical.
PKWARE SecureZIP archives need a licensed PKWARE tool. Standard Python and 7-Zip may not open them at all.
Store ZIP passwords in a password manager at creation time. Saves all of this pain later.

At a Glance

Difficulty: Medium to Hard
Time Required: 15 to 60+ mins
Success Rate: High for simple passwords, low for complex ones

What Causes ZIP Password Recovery Problems?

The most common reason people end up needing ZIP password recovery is embarrassingly simple: the password was set months or years ago, written nowhere, and now it's gone. That's it. No malware, no corruption, no Windows bug. Just a forgotten credential. But there are a few other situations worth knowing about because they change which approach you should take.

Sometimes the archive came from a colleague or vendor who set the password and assumed they'd pass it on. They didn't. Or they did, and it's buried in a three-year-old email thread. The ZIP might also have been created with a non-standard tool like PKWARE SecureZIP, which uses its own encryption layer on top of the standard ZIP format. When that happens, even 7-Zip and Python's zipfile module can't read it properly, and you'll need a licensed PKWARE product just to get started. That's a different problem entirely from a forgotten password on a normal archive.

There's also a subtler issue: people assume Windows Explorer or Python can somehow bypass the password. They can't. AES encryption, which modern ZIP tools use, is designed specifically so that without the key you're stuck. Windows Explorer just throws up a password prompt and refuses to go further. Python's zipfile module raises a RuntimeError with 'Bad password' if you get it wrong. Neither tool has a backdoor, and neither does any reputable third-party software.

One more edge case worth flagging: ZIP archives can contain a mix of encrypted and non-encrypted files. If the Python file itself is encrypted but there are other files in the archive that aren't, you might be able to pull out metadata or ancillary files without a password. 7-Zip will show you which entries are actually encrypted when you browse the archive. Worth checking before you spend an hour cracking.

So the root causes in plain terms: forgotten password, password set by someone else, old legacy archive, non-standard encryption tool, or a wrong assumption about what Windows can do. Each one points to a slightly different fix, which is why the tier approach below works better than jumping straight to brute-force.

ZIP Password Recovery Quick Fix

Before running any tools, spend five minutes on the obvious stuff. Seriously. About half the cases we handle in remote sessions get sorted here, and it saves everyone a lot of time.

Check the Source and Test Likely Passwords Easy

Search your email and messages
Search your inbox for the ZIP filename or the sender's name. Passwords are sent in plain text more often than you'd think, sometimes in the same email as the attachment, sometimes in a follow-up. Check Teams, Slack, and WhatsApp too if the file came through those.
Try common password patterns
Most people use predictable passwords for ZIPs: their name plus a year, a word with a capital and an exclamation mark, or the same password they use for everything. Try variations like Password1, Archive2024!, or the company name. Capitalisation and trailing digits are the most common additions.
Ask the sender directly
If the ZIP came from a vendor, colleague, or client, just ask. This sounds obvious but people skip it because they feel awkward. Don't. It's far quicker than cracking.
Test a candidate password with Python
If you have a strong guess, confirm it quickly with Python's standard library. Open a terminal and run:
```
import zipfile

zip_file = r"C:\path\to\archive.zip"
password = "YourGuessHere"

with zipfile.ZipFile(zip_file) as zf:
    zf.extractall(pwd=password.encode("utf-8"))
print("Extracted successfully")
```
If it runs without error, you're done. If it raises RuntimeError, the password is wrong (or the archive uses unsupported encryption).

Success: the Python file extracts to the same folder as the ZIP with no errors.

Windows Explorer sometimes says a ZIP is "corrupted" when the password is simply wrong or the encryption method isn't supported. Don't panic. Try 7-Zip before assuming the archive is damaged.

Try 7-Zip for Better Compatibility Easy

Install 7-Zip
Download from 7-zip.org. It's free, lightweight, and handles far more ZIP variants than Windows Explorer, including some AES-256 encrypted archives that Explorer just refuses to open properly.
Open the archive
Right-click the ZIP file, hover over 7-Zip in the context menu, and choose Extract Files. Enter your suspected password when prompted.
Check which files are encrypted
If you're not sure what's inside, use Open archive instead. 7-Zip shows a padlock icon next to encrypted entries. Non-encrypted files can be extracted freely even without the password.

Success: 7-Zip extracts the Python file without errors. If it fails with a wrong password message, the password is incorrect or the archive uses PKWARE SecureZIP format.

If neither of those quick approaches works, you're into actual ZIP password recovery territory. The next section covers dedicated tools. This is where dedicated data recovery software earns its keep, because manual guessing has a ceiling and Python alone isn't fast enough for anything beyond a tiny wordlist.

More ZIP Password Recovery Solutions

This tier is for when you genuinely don't know the password but have reason to think it's a human-chosen word or phrase rather than a random string. Dictionary attacks work well here. Brute-force on truly random passwords is a different story, covered in the advanced section below.

Use a Dedicated ZIP Password Recovery Tool Medium

Choose a recovery tool
Several Windows GUI tools handle ZIP password recovery. Look for one that supports dictionary attacks, brute-force with configurable character sets, and AES-encrypted ZIPs. Read reviews and check that it explicitly lists support for the ZIP encryption standard your archive uses.
Load the archive
Open the tool, browse to your ZIP file, and load it. The tool will read the archive header to confirm it's encrypted and identify the encryption method.
Choose attack type
Start with a dictionary attack. It's faster and works well for human-chosen passwords. If you have a rough idea of the password structure (starts with a capital, ends in two digits), use the mask or rule-based attack mode if the tool supports it. Brute-force over all combinations is a last resort.
Get a good wordlist
The quality of your wordlist matters enormously. The rockyou.txt wordlist (widely available from security research repositories) contains over 14 million real passwords leaked from breaches and is a solid starting point for dictionary attacks.
Start the attack and monitor
Let it run. For short or common passwords, you'll often get a result in minutes. For longer ones, it could take hours. The tool will display the password when found.

Success: the tool displays the recovered password. Use it to extract the archive with 7-Zip or Python.

Only use ZIP password recovery tools on archives you own or are explicitly authorised to access. Running cracking tools on someone else's files without permission is illegal under the Computer Misuse Act 1990 in the UK.

Python Dictionary Attack Script Medium

Get a wordlist
Download a wordlist file. rockyou.txt is the standard choice. Save it somewhere accessible, e.g. C:\wordlists\rockyou.txt.

Run the script
Open a terminal and run the following. It reads each line from the wordlist, encodes it as UTF-8, and tries it against the archive:

import zipfile

filename = r"C:\path\to\archive.zip"
wordlist = r"C:\wordlists\rockyou.txt"

with zipfile.ZipFile(filename) as zf, open(wordlist, "r", encoding="utf-8", errors="ignore") as f:
    for line in f:
        pwd = line.strip()
        try:
            zf.extractall(pwd=pwd.encode("utf-8"))
            print("Password found:", pwd)
            break
        except:
            continue
    else:
        print("Password not found in wordlist")

What to expect
This is slow compared to dedicated tools because Python's zipfile module isn't optimised for cracking. On a modern machine you'll get roughly 50 to 200 attempts per second. For a 14-million-entry wordlist, that's hours. But it works, and it costs nothing.

Success: the script prints the password and extracts the files. If it prints "Password not found in wordlist", the password isn't in your list. Move to the advanced section.

This kind of scenario, where you're digging through old archives trying to recover important files, isn't unique to ZIPs. If you've had similar headaches with documents saved to cloud storage that got corrupted or lost, our guide on Word crash Dropbox recovery covers a related set of problems with a similar tiered approach.

Advanced ZIP Password Recovery Fixes

Right. If you're here, the quick fixes didn't work and the dictionary attack came up empty. That means either the password is genuinely complex, or the archive uses a non-standard encryption method. Both are solvable, but one of them has a realistic ceiling based on your hardware.

John the Ripper Brute-Force Attack Hard

Install John the Ripper for Windows
Download the Windows binary from openwall.com/john. Extract it to a folder like C:\john. The package includes zip2john, which you need first.
Extract the ZIP hash
Open a Command Prompt, navigate to C:\john\run, and run:
zip2john C:\path\to\archive.zip > C:\john\run\archive.hash
This pulls the password hash from the archive header into a file John can work with. You should see output confirming the file was processed.
Run a dictionary attack first
john --wordlist=C:\wordlists\rockyou.txt C:\john\run\archive.hash
John is significantly faster than the Python script. It uses optimised C code and can test tens of thousands of passwords per second on a modern CPU.
Add mutation rules
If the plain wordlist fails, add John's built-in rules:
john --wordlist=C:\wordlists\rockyou.txt --rules C:\john\run\archive.hash
Rules apply common mutations: capitalising the first letter, appending digits, substituting letters for numbers. This catches passwords like Password1 or archive2023! that aren't in the wordlist verbatim.
Full brute-force as a last resort
john --incremental C:\john\run\archive.hash
This tries every possible combination. For passwords up to 6 characters, it's feasible in hours to days. For 8 or more characters with mixed case and symbols, it may run for weeks and still not succeed on consumer hardware.
Check results
john --show C:\john\run\archive.hash
This displays any passwords John has cracked so far. Use the recovered password to extract the archive.

Success: John displays the cracked password. Extract the archive with 7-Zip or the Python zipfile snippet from Solution 1.

GPU-accelerated cracking tools like Hashcat can be dramatically faster than CPU-only John the Ripper for certain hash types. If you have a modern Nvidia GPU and are comfortable with command-line tools, Hashcat with the PKZIP attack mode is worth looking into for long-running recovery jobs.

Handling PKWARE SecureZIP Archives Hard

Identify the archive type
If 7-Zip opens the archive but shows an error about unsupported compression or encryption, or if Python raises an error that isn't a simple "Bad password", the archive may use PKWARE SecureZIP. This format uses Microsoft Crypto APIs and specific PKWARE algorithms that standard tools can't handle.
Get a licensed PKWARE tool
You'll need PKWARE's own software to open SecureZIP archives. There is no free workaround. Contact PKWARE directly or check whether your organisation has a licence. Even with the tool, you still need the correct password. It doesn't provide backdoor access.
Contact the archive creator
If you can't get a PKWARE licence, go back to the source. The person or system that created the archive is your best option. SecureZIP is often used in enterprise environments where IT departments manage credentials centrally.

Success: once you have the correct tool and password, extract normally. If you can't obtain either, recovery from a SecureZIP archive without the password is not feasible with standard methods.

Data loss from inaccessible files isn't always about encryption. If you're also dealing with storage issues on Windows 11, our SSD data recovery Windows 11 guide covers a different but equally frustrating set of scenarios where files become inaccessible due to drive problems rather than password protection.

Online ZIP password recovery services exist, but think carefully before uploading. If the archive contains source code, personal data, or anything commercially sensitive, uploading it to a third-party server creates a real privacy and legal risk. Only use these services for non-sensitive archives.

Preventing ZIP Password Recovery Headaches

Most of what's in this guide is avoidable. Here's what actually works, in order of importance.

Use a password manager. Store the ZIP password the moment you create the archive. Include the file name, the date, and where the file lives. Takes 30 seconds. Saves all of this later. Bitwarden and KeePass are both solid free options for Windows.

Consider whether you need ZIP encryption at all. For long-term storage of non-sensitive files, a password-protected ZIP is overkill and a future liability. Use Windows BitLocker for drive-level encryption instead. It's built in, it's transparent, and you manage it through your Windows account credentials rather than a separate password you'll forget.

For shared archives, document the password separately. If you're sending a password-protected ZIP to a colleague, send the password through a different channel (not the same email) and keep a copy in your team's internal documentation. A shared note in your project management tool works fine.

Test access immediately. When you receive a password-protected ZIP from someone else, try to open it straight away while the sender is still reachable. Don't leave it sitting in a folder for six months and then discover the password is wrong or missing.

And if you're working with important Python files or other code, think about whether a version control system like Git might serve you better than ZIP archives for backup purposes. Git repositories can be encrypted at the repository hosting level, and you never lose access because of a forgotten ZIP password. It's a bit more setup upfront but far more recoverable long-term. Similar thinking applies to documents: if you've ever lost a file because of a sync or crash issue, our article on SSD stuck in Recovery after migration shows how storage problems can compound access issues in ways that are hard to unpick after the fact.

ZIP Password Recovery Summary

ZIP password recovery on Windows is a three-tier problem. Start with the obvious: check your email, try common password patterns, and ask the sender. That solves more cases than people expect. If that fails, move to a dedicated recovery tool or a Python dictionary attack script with a proper wordlist like rockyou.txt. For stubborn cases, John the Ripper with mutation rules gives you the best shot at cracking a human-chosen password without specialist hardware. And if the archive turns out to be PKWARE SecureZIP, you'll need a licensed tool and the correct password regardless. There is no bypass for properly implemented ZIP encryption, full stop.

The real lesson from doing ZIP password recovery day in, day out is that it's almost always a documentation problem rather than a technical one. A password manager entry at creation time costs nothing. Recovering without it can cost hours. Sort that out and you won't be back here.