I received a zip with an encrypted file inside.

How do I determine which encryption method was used on it in WinZip 9.0? I've cruised all the menus and options and see no easy way to tell this information.

  • 1
    Maybe from the file header in a hex viewer?
    – user3463
    Sep 12, 2011 at 22:36
  • 1
    The format of a ZIP file is published by PKWARE, e.g. at http://www.pkware.com/documents/casestudies/APPNOTE.TXT and this document gives the location and content of the encryption header(s).
    – mas
    Sep 13, 2011 at 14:11
  • It's sad that encryption method isn't shown in the GUI. I'll be happy with an answer that gives a program that DOES show the encryption method, without having to resort to a byte-by-byte analysis to discover it. Such a thing is not beyond my capabilities, but far, far beyond my desires. You may as well market a courier service that uses both clear & opaque envelopes, but takes letter contents out just before delivery. How is the recipient to know if his letter could have been viewed in transit?
    – ErikE
    Dec 13, 2011 at 2:36

2 Answers 2


WinZip 16 has a Tools 'menu/tab'. Open a zip file, select a file from the list, click on the Properties dropdown, and choose 'Selected File'. A popup dialog will appear that has an Encryption Method entry.


In Winzip 9 with an archive open, get File > Properties, then click the Details button. This shows all the details about the zip file and the compressed files within, including encryption.

Each file can be encrypted differently, so you must examine the encryption method for each file to understand the encryption of the archive as a whole. Under each "Local directory entry" section (one per file), pay attention to "filename:" and then the values "Encryption Tag Version" (e.g., AE-2) and "Encryption Key Bits" (e.g., 256).

Here is an example entry:

Current Location part 1 offset 249
Central directory entry PK0102 (4+42): #1
    part number in which file begins (0000):        1
    relative offset of local header:                0 (0x00000000) bytes
    version made by operating system (00):          MS-DOS, OS/2, NT FAT
    version made by zip software (20):              2.0
    operat. system version needed to extract (00):  MS-DOS, OS/2, NT FAT
    unzip software version needed to extract (20):  2.0
    general purpose bit flag (0x0001) (bit 15..0):  0000.0000 0000.0001
      file security status  (bit 0):                encrypted
      extended local header (bit 3):                no
    compression method (99):                        AES encryption
    file last modified on (0x0000337d 0x000068a4):  2005-11-29 13:05:08
    32-bit CRC value:                               0x00000000
    compressed size:                                28 bytes
    uncompressed size:                              0 bytes
    length of filename:                             12 characters
    length of extra field:                          11 bytes
    length of file comment:                         0 characters
    internal file attributes:                       0x0001
      apparent file type:                           text
    external file attributes:                       0x00000020
      non-MSDOS external file attributes:           0x000000
      MS-DOS file attributes (0x20):                arc
Current Location part 1 offset 295
Current Location part 1 offset 307
    extra field 0x9901 (AES Encryption Tag), 4 header and 7 data bytes:
    02 00 41 45 03 00 00                            ..AE...
      Encryption Tag Version:           AE-2
      Encryption Key Bits:              256
      Compression Method (00):          none (stored)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .