How to Create a Password-Protected ZIP File on macOS

macOS on its own cannot produce a password-protected ZIP with usable strength. Finder’s “Compress” has no password option at all, and the Terminal’s zip -e uses the obsolete, weak PKZip 2.0 scheme.

Here is the conclusion up front. What you should use depends on who receives the file.

This article was published in 2025 and completely rewritten in September 2026. The original said that “zip -er solves the problem”, which was wrong. The correction below includes what I verified on my own Mac.

Correction: zip -e and zip -er have identical encryption strength

The original article treated zip -e as weak and zip -er as the correct answer. There is no basis for that distinction.

-r is simply the option that includes the contents of folders recursively. It has nothing to do with the encryption scheme.

-e   encrypt with a password (this is what selects the encryption)
-r   include subfolders (unrelated to encryption)

And the command itself labels that encryption “weak” in its own help output.

zip -h2

Encryption:
  -e        use standard (weak) PKZip 2.0 encryption, prompt for password
  -P pswd   use standard encryption, password is pswd

“standard (weak) PKZip 2.0 encryption” is what the stock macOS zip uses. It is not AES-256.

Inspecting the files it produces confirms it: compression method 99, which signals AES, never appears. The binary shipped with macOS is Info-ZIP’s Zip 3.0, which has no AES support in the first place.

PKZip 2.0 (ZipCrypto) has well-known weaknesses — with a known plaintext fragment it can be broken far faster than brute force. File names inside a ZIP are never encrypted either, so guessing the contents is easy.

Finder’s “Compress” cannot set a password

Right-clicking in Finder and choosing “Compress” produces a ZIP, but there is no screen for entering a password. It only bundles the files.

If your goal is protection, Finder’s compression is not a candidate at all.

Option 1: an encrypted disk image (built in, AES-256)

This is the only way to get AES-256 with nothing extra installed. hdiutil ships with macOS, and its own help lists “AES-256 – 256-bit AES encryption (recommended)”.

From the Terminal

hdiutil create -encryption AES-256 -stdinpass \
  -srcfolder ~/Desktop/secret-folder \
  -volname "Secret" \
  ~/Desktop/secret.dmg

Running it prompts for the password.

Do not type the password directly on the command line. It is stored in plain text in your shell history (~/.zsh_history). -stdinpass keeps it out.

From the GUI

There is a way that avoids the Terminal entirely.

• Open Disk Utility
• Choose File > New Image > Image from Folder
• Select the folder
• Set Encryption to “256-bit AES encryption”
• Set Image Format to “read-only” or “compressed”

The limitation

.dmg is macOS-only. Windows and Android cannot open it without extra software. If you do not know the recipient’s environment, use the next option.

Option 2: an AES-256 ZIP with 7-Zip

To stay in ZIP format with AES-256, install 7-Zip.

brew install sevenzip

The command is 7zz.

# Encrypt a folder as ZIP with AES-256
7zz a -tzip -mem=AES256 -p secret.zip secret-folder/

Without -mem=AES256 you get ZipCrypto. Using 7-Zip does not save you if you forget the flag.

To hide the file names too, use 7z format

ZIP never encrypts file names, even with AES-256. The names alone can reveal what is inside.

To hide them, use 7z format.

# 7z format, with file names encrypted as well
7zz a -t7z -m0=lzma2 -mhe=on -p secret.7z secret-folder/

-mhe=on encrypts the header, which is where the file list lives. Note that 7z format requires the recipient to have extraction software, so choose according to the situation.

Which one should you pick?

That last row matters most. If the information genuinely needs protecting, a share link on storage with real access control beats emailing a password-protected ZIP.

Things to watch when you use this

Send the password through a different channel

Putting the password in the same email as the ZIP defeats the encryption. If the email leaks, both leak. Use another channel — chat, or in person.

Do not put information in the file names

As noted above, ZIP does not encrypt file names. Something like FY2026_executive_compensation.xlsx gives away the contents without being opened.

Keep the password out of your shell history

# the password ends up in history
zip -er -P mypassword secret.zip folder

# interactive entry leaves nothing behind
zip -er secret.zip folder

The -P option exposes the password in both the shell history and the process list. Avoid it outside of scripts.

Before worrying about strength, reconsider the delivery

Emailing a password-protected ZIP and then emailing the password separately has been widely criticized as providing no real protection, because both messages travel the same route.

If you still use ZIP, at minimum use AES-256 and deliver the password out of band.

Summary

• Finder’s “Compress” has no password option
• zip -e and zip -er encrypt identically. -r is the recursion flag and is unrelated
• The stock macOS zip uses PKZip 2.0, which the command itself labels “weak”, and has no AES support
• Mac to Mac: hdiutil -encryption AES-256, the only built-in route to AES-256
• ZIP required: brew install sevenzip then 7zz a -tzip -mem=AES256 -p
• Forgetting -mem=AES256 leaves you on the weak scheme even with 7-Zip
• ZIP does not encrypt file names. Use 7z with -mhe=on if that matters
• -P writes the password to history in plain text. Use interactive entry
• Always deliver the password through a separate channel

The most dangerous state is feeling safe simply because a password was set. Confirm which scheme is actually protecting the file before you rely on it.