Password protect a file

How to Protect with a password

1. 1

   Add the files

   Up to twenty at once, any format. KMZ and KML are the usual reason people come here. One format is handled differently, and only because it can be: a PDF carries a password inside itself.

2. 2

   Type a password twice

   Eight characters or more. Typing it twice is not ceremony: a mistyped password here cannot be recovered from the archive afterwards.

3. 3

   Download the archive

   A PDF comes back as a PDF, locked with the password itself. Everything else comes back as one .zip with every entry encrypted: the recipient unpacks it with the password and gets the original file, byte for byte.

Why KMZ and KML get an archive rather than a password inside

A KML file is XML, and a KMZ is an ordinary ZIP with that XML inside it. Neither the OGC specification that defines them nor Google Earth itself has any notion of a password, so there is no field to put one in and no reader that would ask for one. It is technically possible to encrypt the entry inside a KMZ and keep the .kmz name, and the result would be worse than useless: the file would look exactly like a working map and fail silently the moment anyone opened it. So the file goes into an encrypted archive instead. Your recipient unpacks маршрут.kmz.zip with the password, gets маршрут.kmz back unchanged, and opens it in Google Earth the way they always have. The extension is kept deliberately, because Google Earth decides what a file is by looking at it. PDF is the one exception, and it is treated as one: that format does have a password of its own, so a PDF brought here is encrypted in place with AES-256 and downloads as a PDF, which any reader will open once the password is typed.

AES-256, not the old ZIP password

The password option in most ZIP tools from the 1990s uses a stream cipher that falls to a known-plaintext attack in seconds on an ordinary laptop; having a few bytes of a file whose format you can guess is enough, and for a KMZ the first bytes are always the same. This tool only writes WinZip AE-2 with AES-256: a 16-byte random salt per entry, the key stretched with PBKDF2, and an HMAC-SHA1 authentication code so that tampering is detected rather than decrypted into garbage. There is no dropdown offering something weaker, because an option that exists is an option somebody picks.

What the archive still reveals

ZIP encrypts the contents of each entry, never the catalogue that lists them. Anyone holding the archive can see the file names, their sizes and their modification dates without knowing the password — they just cannot read a single byte of what is inside. If the names themselves are the secret, rename the files before protecting them. Everything else is covered: the bytes are unreadable without the password, and there is no recovery route if the password is lost, including for us. Nothing is uploaded, so there is nothing to recover from.

Where it opens

AES-encrypted ZIP has been standard since 2003 and is read by 7-Zip, WinRAR, Keka, Ark, PeaZip, The Unarchiver, and by Windows 11's own Explorer. Two common tools do not read it: the Info-ZIP unzip command shipped with older Linux distributions, and Python's built-in zipfile module, both of which will list the archive correctly and then refuse to extract it. On macOS, Archive Utility handles it. If in doubt, 7-Zip is free and available everywhere, and our own extractor on this site reads it too.

Frequently asked questions