What Encryption Algorithm Does 7-Zip Use?

When securing compressed archives, 7-Zip relies on industry-standard cryptographic protocols to safeguard data. By default, 7-Zip uses the Advanced Encryption Standard with a 256-bit key length (AES-256) to encrypt files stored in its native .7z archive format. This overview explores how 7-Zip implements AES-256, the role of key derivation, header encryption capabilities, and the difference between encrypting .7z and .zip archives.

The Default Algorithm: AES-256

7-Zip uses AES-256 as its standard encryption algorithm for all .7z archives. AES is an internationally recognized symmetric block cipher approved by the U.S. National Institute of Standards and Technology (NIST).

In AES-256:

  • Key Length: The cipher operates with a 256-bit cryptographic key, providing \(2^{256}\) potential key combinations.
  • Security Level: There are currently no known practical cryptographic attacks capable of breaking AES-256 through mathematical weaknesses; properly implemented, it is considered virtually immune to brute-force decryption using modern computing power.

Key Derivation and Hashing

When you set a password in 7-Zip, the software does not use your raw password text as the encryption key. Instead, it utilizes an intensive key derivation function to convert the plaintext password into a 256-bit cryptographic key.

7-Zip generates this key using repeated cycles of the SHA-256 hashing algorithm. It performs up to hundreds of thousands of hashing iterations to stretch the key. This deliberate computational delay makes brute-force attacks and dictionary attacks significantly slower and computationally expensive for unauthorized third parties attempting to guess the password.

Header Encryption

A notable security feature available in the .7z format is the "Encrypt file names" option, also known as header encryption.

  • Standard Encryption: Encrypts only the data streams of the files inside the archive. File names, directory structures, and file sizes remain visible without entering a password.
  • Header Encryption: Encrypts the entire metadata block using AES-256 alongside the file contents. When enabled, a user must provide the password before viewing any directory names, file names, or archive contents.

Encryption in .7z vs. .zip Archives

While AES-256 is the mandatory default for .7z archives, 7-Zip behaves differently when compressing to standard .zip files:

  1. ZipCrypto: This is the legacy encryption method historically used by the ZIP format. It is cryptographically weak, vulnerable to known-plaintext attacks, and should be avoided for sensitive data.
  2. AES-256 for ZIP: 7-Zip permits AES-256 encryption within standard .zip containers as well, but users must manually select this option in the compression dialog if they are not using .7z.

Summary

For native .7z archives, 7-Zip always utilizes AES-256 encryption reinforced by SHA-256 key stretching. When combined with header encryption and a sufficiently long, complex password, it provides robust, enterprise-grade protection for sensitive files.