How to Create a Password-Protected ZIP on Mac

Use an encrypted ZIP when several files must travel together and only the right person should open them.

Email attachments, links to shared cloud folders and USB sticks all leave copies in places you don't control. A single encrypted ZIP keeps documents, photos and spreadsheets together under one password, and the person receiving it doesn't need a Mac to open it.

Finder's Compress command makes an ordinary ZIP with no password option. Terminal can add one: zip -er archive.zip folder asks for a password and encrypts the files.

The problem is the scheme. zip -e uses the traditional ZIP encryption often called ZipCrypto, which falls to known-plaintext attacks: if someone can guess part of one file, they can recover the contents without the password. Disk Utility can make an encrypted disk image with 128-bit or 256-bit AES instead, which works well between Macs, but a Windows PC can't open a .dmg without extra software.

File Acture's Create ZIP packs any mix of files and folders into one ZIP and, with Protect with a password turned on, encrypts every file with AES-256.

Under Archive, type an Archive name and choose a Compression level: Normal, Maximum or None (fastest). Turn on Protect with a password, then type the password in Password and Confirm password. The app reminds you that the archive opens with File Acture, 7-Zip, WinZip or Keka.

Folders keep their structure, including empty ones, and Mac clutter such as .DS_Store files and __MACOSX folders is left out. Symbolic links are skipped rather than followed, and very large files are stored in ZIP64 format. The ZIP is saved to Downloads › File Acture or the folder you choose, and it only appears once it's complete, so you never find a half-written archive.

Normal suits most archives, Maximum squeezes out a little more at the cost of time, and None (fastest) stores the files without compressing them.

Documents, spreadsheets and text shrink well in a ZIP. Photos, videos and PDFs are already compressed, so they barely change, and None (fastest) packs them quickly with exactly the same protection. The password and the AES-256 encryption work the same at every level.

An encrypted ZIP locks the contents of every file, but the file names inside stay readable to anyone who opens the archive, with or without the password.

• Rename sensitive files before zipping if the names themselves give something away.
• Use a long passphrase and send it separately from the ZIP, for example by text message.
• Check the recipient's app. AES-256 ZIPs open in File Acture, 7-Zip, WinZip and Keka; the unzip command that comes with macOS doesn't support AES.
• Clean photos first. Pictures in the ZIP still carry their GPS position, so remove location data before you pack them.
• One PDF? Protect the PDF itself with AES-256, so it opens in any PDF app with the password.

To open an AES-256 ZIP on a Mac, add it to File Acture's Extract Archive, type the password and click Extract.

Extract Archive also opens ZIPs protected with the older ZipCrypto scheme, as well as 7z and TAR archives. Each archive is unpacked into a new folder, and entries that try to write outside it are refused.

Online tools that add a password to a ZIP need your unencrypted files first, which defeats the purpose. File Acture encrypts on your Mac, so the files never leave it before they're locked. The free version takes up to 5 items per run, with 3 runs on each Mac; see pricing for Pro.