Why Windows will not open your AES-encrypted zip

The file is not corrupt and your password is not wrong. Windows File Explorer can only decrypt one of the two encryption schemes a zip is allowed to use, and it is the old broken one. Your zip uses the other — AES — which Explorer has never supported and still does not, including on Windows 11. Open it in STRONGBOX, which reads AES-256 zips in the browser tab and saves what is inside to your disk, or install 7-Zip. Nothing is uploaded either way.

What it looks like when it happens

Windows does not say "this uses encryption I cannot read", which is the one sentence that would end the confusion. It says one of these instead, and each sends you looking in the wrong place:

• "The compressed (zipped) folder is invalid." The zip is fine. Explorer reached a field it did not understand and gave up on the whole file.
• It asks for the password, you type the correct one, and it asks again. Explorer is trying to check your password against the old scheme's one-byte verifier, which is not what is in the file.
• "Windows cannot complete the extraction. The destination file could not be created." Also nothing to do with the destination.
• The file list opens but every file inside is 0 bytes, or extracting produces unreadable rubbish. This is the worst one, because it looks like data loss rather than a format it cannot read.

The tell that it is this problem and not a damaged download: the names of the files inside are visible. A zip never encrypts its own table of contents, so if you can see the names, the archive's structure is intact and only the contents are locked.

Two encryption schemes, one file extension

"Password-protected zip" describes two completely different things, and which one you have was decided by whatever made the file.

ZipCrypto is the one Explorer implements, and it was broken in 1994 by Eli Biham and Paul Kocher: given a few hundred bytes of any file in the archive whose contents you can guess — and the first bytes of a JPEG, a PDF or an Office document are entirely guessable — the key falls out in seconds on an ordinary laptop. It is not a weak password problem. A strong passphrase does not save a ZipCrypto archive.

AES is the one everything modern writes. WinZip published the specification in 2003, 7-Zip and WinRAR and every serious archiver implement it, and it is the reason a zip made in the last twenty years usually cannot be opened by the tool built into the operating system that invented the format.

Did Windows 11 not fix this?

No, and it is a reasonable thing to expect. Windows 11 did gain real archive support — File Explorer can now read 7z, TAR, RAR and more, through the libarchive library — and a lot of coverage described that as Windows finally taking archives seriously. It was about formats, not encryption. An AES-encrypted zip still fails in Explorer on a fully updated Windows 11.

You can confirm it on your own machine in one step rather than taking anybody's word: make a small AES zip in STRONGBOX, save it, and double-click it in Explorer. Whatever it does is the answer for your build.

Telling which one you have

Three ways, in order of how much you have to install.

• Try to open it. Explorer opens it and asks for a password that works: ZipCrypto. Any of the failures above: AES. Crude, and usually enough.
• Ask 7-Zip. 7z l -slt archive.zip prints a Method line per file: ZipCrypto Deflate or AES-256 Deflate.
• Look at the bytes. An AES entry carries an extra field with header ID 0x9901, and its compression method is recorded as 99 with the real method moved inside that field. That is the actual definition — everything above is a consequence of it — and it is what a reader has to check to get this right.

Opening it

1. In this tab. STRONGBOX lists the names inside before you type anything, then takes the passphrase and saves one file or all of them. It reads AES-256 as WinZip and 7-Zip write it. The archive is read by your browser on your machine and is not uploaded, which matters for a file somebody encrypted for a reason.
2. 7-Zip. Free, open source, and the answer if you handle archives often enough to want a right-click menu. Right-click the zip → 7-Zip → Extract here.
3. PeaZip, WinRAR, The Unarchiver. All read AES zips. WinRAR is paid after its trial; the other two are not.

On macOS, Archive Utility has the same limitation and fails the same quiet way; Keka and The Unarchiver do not. On Linux, the unzip that ships with most distributions is Info-ZIP, which does not do AES — 7z x or p7zip does, which is why a file that opens on a colleague's Ubuntu box may not open on yours.

If you are the one making the zip

The instinct after this is to make the next one with ZipCrypto so the recipient can just double-click it. Do not. A zip anybody can open in Explorer is a zip anybody can open, full stop, and the thirty-year-old attack is a download away.

Do this instead:

• Use AES and tell them how to open it. One sentence — "Windows can't open this one on its own; use 7-Zip, or open it at obscuraos.com/strongbox" — saves the exchange you are currently on the other end of.
• Send the passphrase by a different route than the file. A password in the same email as the archive protects against nothing that matters.
• Remember what the zip still shows. Encrypting the contents does not encrypt the file names, the folder structure, the sizes, or the modification dates — all of those sit in the archive's central directory in the clear, and employment-tribunal/witness-statement-final.docx tells a reader most of what they wanted before any password is typed. What a password-protected zip still gives away goes through the whole list, and CAPSULE is the way round it when the names themselves are the sensitive part.