How to Unzip a Password Protected ZIP File in Linux (and Create One with zip or 7-Zip AES)

Updated: 10 October 2026 · Applies to: Info-ZIP UnZip 6.0 and Zip 3.0, 7-Zip 23.01 to 26.04 and bsdtar 3.7 on Debian 13, Ubuntu 24.04 and 26.04, AlmaLinux and Rocky Linux 9 and 10, Fedora 44

To unzip a password-protected ZIP file in Linux, run unzip file.zip and type the password when it asks. If unzip answers need PK compat. v5.1 (can do v4.6), the file uses AES encryption, which unzip cannot open: extract it with 7z x file.zip instead.

unzip secret.zip                    # classic ZIP encryption: asks for the password
unzip secret.zip -d /tmp/restore    # same, into another folder
7z x secret.zip                     # AES-encrypted ZIP files (and classic ones)

We tested every command below in containers on Debian 13. The versions above are what the package managers installed on the other systems.

1. Install the tools

sudo apt install unzip 7zip                                  # Debian, Ubuntu
sudo dnf install unzip                                       # AlmaLinux, Rocky Linux, RHEL, Fedora
sudo dnf install epel-release && sudo dnf install 7zip      # 7-Zip on AlmaLinux, Rocky Linux (Fedora: dnf install 7zip)

2. Unzip a file with a password

1. Run unzip and type the password at the prompt. Nothing appears while you type:

   $ unzip secret.zip -d /tmp/out
   Archive:  secret.zip
   [secret.zip] report.pdf password:
    extracting: /tmp/out/report.pdf
      creating: /tmp/out/folder/
    extracting: /tmp/out/folder/a.txt
    extracting: /tmp/out/folder/b.txt

   Leave out -d /tmp/out to extract into the current folder. unzip asks once and uses the same password for the other files.

2. If the password is wrong, unzip asks again. Press Enter on an empty prompt to give up on that file:

   [only.zip] report.pdf password:
   password incorrect--reenter:
      skipping: report.pdf              incorrect password

3. To see what is inside first, run unzip -l secret.zip. It lists the names without a password, because ZIP encryption protects only the contents.

Avoid unzip -P password. It works, but both the unzip and zip manuals call it insecure: other users on the server can see the password in the process list, and it stays in your shell history.

3. Fix "need PK compat. v5.1 (can do v4.6)"

This is what unzip prints for a ZIP file encrypted with AES-256 (made with 7-Zip, WinZip and similar tools):

$ unzip aes.zip
Archive:  aes.zip
   skipping: folder/a.txt            need PK compat. v5.1 (can do v4.6)
   skipping: folder/b.txt            need PK compat. v5.1 (can do v4.6)
   skipping: report.pdf              need PK compat. v5.1 (can do v4.6)

unzip does not even ask for the password: UnZip 6.0 only supports the classic ZIP encryption. Use 7-Zip (output shortened):

$ 7z x aes.zip -o/tmp/out
Extracting archive: aes.zip
Enter password (will not be echoed):
Everything is Ok

Folders: 1
Files: 2

A wrong password in 7-Zip gives ERROR: Wrong password : report.pdf. bsdtar -xf aes.zip (package libarchive-tools on Debian and Ubuntu) also worked in our test: it asked Enter passphrase: and extracted the AES file.

To check which encryption a ZIP file uses, list it with 7-Zip:

$ 7z l -slt aes.zip | grep Method
Method = Store
Method = AES-256 Store
Method = AES-256 Store

ZipCrypto means classic encryption (unzip can open it); AES-256 means you need 7-Zip or bsdtar. In zipinfo, AES files show the method u099.

4. Create a password-protected ZIP file

With zip (works everywhere, weak):

$ zip -er secret.zip report.pdf folder
Enter password:
Verify password:
  adding: report.pdf (stored 0%)
  adding: folder/ (stored 0%)
  adding: folder/a.txt (stored 0%)
  adding: folder/b.txt (stored 0%)

-e asks for the password twice and -r adds folders. Any unzip tool can open the result, but the zip manual describes this standard encryption as relatively weak. Use it to keep casual readers out, not for sensitive data.

With 7-Zip and AES-256 (recommended):

7z a -tzip -p -mem=AES256 secret.zip report.pdf folder

7-Zip asks for the password. The recipient needs a tool with AES support, such as 7-Zip or bsdtar; the plain unzip command gives the error from step 3.

Hide the file names too: ZIP always shows names. The 7z format can encrypt them:

7z a -p -mhe=on secret.7z report.pdf folder

Without the right password, even listing this archive fails with Cannot open encrypted archive. Wrong password?.

Other options and tips

• gpg encrypts a single file with a password: gpg -c --cipher-algo AES256 backup.tar.gz creates backup.tar.gz.gpg, and gpg -d backup.tar.gz.gpg > backup.tar.gz decrypts it (GnuPG 2.4.7 in our test).
• Send the password by a different channel than the file, for example by phone or messenger when the file goes by email.
• There is no way to remove or reset a ZIP password: without it, ask the person who made the file for a new copy.
• For everyday zip and unzip commands, see how to zip and unzip files in Linux, and for all 7-Zip commands how to use 7-Zip on Linux.

Official documentation: 7-Zip, unzip manual page and zip manual page.