I have to define a way for two parties to exchange a folder (files) securely. Encrypted zip format seems to be the most obvious but I have read some accounts of zip encryption being flawed. So I am trying to see if there are any other solutions out there.

My requirements are -

  1. It should be really easy (clicking the mouse and entering the key/passphrase).

  2. Need to be free software (should not mandate the either party to buy software as much as possible)

  3. Of course it has to be secure. If the encrypted file ends up in the wild the parties should be assured that its secure.

  4. The cross platform nature of it comes in because some of the users involved might use a Mac.

Is my only option to use gpg? I am averse to using it but I want to see if there is any other possibility. The only problem with gpg is I will then have to define a way to exchange the public keys and verifying the public keys are properly exchanged. I am looking for a solution where one party can send the file to the other and then get on the phone and say "double click on the file and enter this passphrase".

Thanks for your help!

  • Does the file itself need to be secure, or only the exchange? – Ignacio Vazquez-Abrams Jan 13 '12 at 23:59
  • @Ignacio - The file has to be secure not just the exchange. – user220201 Jan 14 '12 at 0:09
  • You do know how easy it is to wiretap phones, I hope. – user1686 Jan 14 '12 at 1:17
  • Just to understand it right: you need a person A to send some files to person B, and make sure that only person B will open the file? Send by email, etc, and not that they are in the same network ?And this encryption must run on windows and Mac ? – woliveirajr Jan 14 '12 at 1:30

I recently asked a very similar question, and wasn't able to find a truly simple, transparent, free, cross-platform solution. zip file encryption is no longer terrible, but Macs can't open encrypted zip files from the GUI (and worse, they give a misleading error that makes it sound like there's something wrong with the file).

Truecrypt is excellent, and isn't very difficult to use. However, it does require the user to install the software and learn what it means to mount an encrypted volume.

An additional advantage of truecrypt is that the files remain on the encrypted volume, and disappear off of the computer when the volume is unmounted. When you unzip an encrypted zip file, it creates a cleartext copy of the file on the hard drive, and the user has to remember to delete it themselves. This is the case for all file-level encryption that I'm aware of, and for that reason I'd recommend an encrypted partition system even if it's more complicated for your users.

  • I second the true crypt suggestions and raise you a SCP over SSH. SCP transfers are secure, there is a lot of free, easy to use software for mac and pc (macfusion/winscp) and it's not limited by email limits. And you can run an ssh server on windows with cywin for free. – skub Jan 14 '12 at 5:33

7-Zip supports 256 bit AES encryption.

7-Zip is a free and open source file archiver. 7-Zip operates with the 7z archive format, but can read and write several other archive formats. The program can be used from a command line interface, graphical user interface, or with Microsoft Windows shell integration.

enter image description here


You can use small truecrypt in-file-partition. You will have to install (free, opensource, multiplatform) truecrypt on each computer.

The benefit (compared to encrypted zip) is that you can operate on such secure filesystem in realtime (without decompressing/recomressing).

BTW, there is a nice easy to use GUI and it's really safe.

  • Seems like this answer is no longer appropriate as truecrypt is no longer considered safe. – uthomas Sep 17 '18 at 14:44

Is my only option to use gpg?

No. Second and better choice is to use S/MIME encrypted e-mailing

  • An where are the arguments proving that? – Tom Feb 20 '12 at 15:02
  • @Tom - symmetric vs asymmetric encryption, if it tells you something. From user-side - requirement to trusted exchange of public keys in case of PGP and no needs for it in case of S/MIME (nodes have just to exchange signed e-mails) – Lazy Badger Feb 20 '12 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.