How to Password Protect a ZIP File on Mac — the Safe Way
Almost every Mac guide tells you to use the Terminal's zip -e command. What they don't tell you: it applies encryption that's been crackable for decades. Here's the honest version — what's actually safe, and the fastest way to do it.
The fast, safe way: in your browser
- Open Password Protect ZIP in Safari, Chrome, or Firefox.
- Drag your files or a whole folder onto the page (an existing .zip works too).
- Type a password twice — or click Suggest a strong passphrase.
- Click Protect Files. A real AES-256 encrypted .zip downloads immediately.
Everything runs on your Mac — nothing is uploaded, and it works with Wi-Fi off. No Terminal, no install, no Gatekeeper prompts.
Password-protect a ZIP right now
Free, no signup, no install. Files never leave your Mac.
Open Password Protect ZIP →The Terminal method — and why we don't recommend it
The command everyone quotes:
zip -er archive.zip ~/Documents/MyFolder
It works, and it prompts for a password. The problem:
macOS's built-in zip uses legacy ZipCrypto encryption — the 1990s scheme that cracking tools defeat no matter how strong your password is. It keeps out a casual double-clicker; it does not keep out anyone who actually wants your files. Fine for "don't open the birthday plans," wrong for contracts, IDs, or financials.
The free-app way: Keka (AES-256)
If you prefer a native app, Keka (free from the website) does it properly:
- Open Keka, choose ZIP, and type a password.
- Tick AES-256 (leave "compatibility" unticked — that's ZipCrypto again).
- Drop your files onto the Keka window.
What about opening protected ZIPs on a Mac?
Double-clicking an AES-256 ZIP fails — macOS's built-in Archive Utility doesn't support it (you'll see an "unable to expand" error). Three ways that work:
- Bulk Archiver — drop the .zip in your browser, enter the password, done. No install.
- Keka or The Unarchiver — free apps, both handle AES-256.
- If someone sent you a vault (.html) file — just double-click it. It opens in your browser and asks for the password. Nothing to install.
Sending to someone who can't install apps?
That's what the vault file option is for: instead of a .zip, you get a single .html file. Your recipient opens it in any browser — Mac, Windows, iPhone, Android — types the password, and saves the files. No unzip app needed at either end, and it works offline.
FAQ
Is zip -e in Terminal secure?
Not meaningfully — it applies legacy ZipCrypto, which cracking tools defeat regardless of password strength. Use AES-256 via the browser tool above or Keka.
Can Archive Utility open password-protected ZIPs?
Legacy-encrypted ones, yes (it prompts for the password). AES-256 ones, no — use Keka, The Unarchiver, or our Bulk Archiver in the browser.
Can I password protect a folder without zipping it?
macOS can make an encrypted disk image via Disk Utility, but it's clunky for sharing and Windows recipients can't open it. For sending, an encrypted ZIP or vault file is the practical answer — see password protect a folder.
Does the browser tool upload my files?
No. Encryption runs entirely in your browser — disconnect from Wi-Fi after the page loads and it keeps working. Your password never leaves the Mac either.
On Windows? See How to password protect a ZIP on Windows 11 & 10.