zip-password-finder recovers an encrypted archive when the password is lost

Three attack modes, and the one that usually works

zip-password-finder is described as a tool to find the password of protected ZIP files, and the feature list gives three attack modes: brute force, dictionary, and mask attack.

Brute force is the default when no dictionary or mask is provided. It generates all passwords for a given charset and a password length range, and the README is explicit that the default charset preset is lud, lowercase plus uppercase plus digits, with the minimum length defaulting to 1 and the maximum to 6. The available presets are single characters for lowercase, uppercase, digits, lowercase hex, uppercase hex and symbols, and they can be combined. A custom charset file with a single line of characters can be supplied with --charset-file.

Dictionary mode tests passwords from a text file, one word per line, which is the mode that succeeds when the password is a real word rather than a random string.

Mask attack is the one with the best ratio of work to results. It generates passwords matching a pattern where each position has its own charset, and the README says it is useful when you know part of the password structure, for example that it starts with uppercase and ends with digits. The mask tokens cover lowercase, uppercase, digits, symbols, all printable characters, lowercase and uppercase hex, four custom charsets referenced as ?1 to ?4, and a literal question mark. Any other character in the mask is treated as a literal, so a known prefix like pass can be written directly into the pattern.

The custom charsets are themselves defined with tokens, so --custom-charset-1 "?l?d" defines lowercase letters plus digits, not just the literal characters you type.

Resuming, interrupting and the progress display

The ergonomics of a long search matter, and this is where the tool is better than a naive script.

Graceful interruption with Ctrl-C displays the last password tested, and the search can be resumed from a specific password with --starting-password, which skips ahead. So a search that is stopped at three in the morning can pick up where it left off rather than starting over, which is the difference between a search that finishes and one that never does.

The progress bar shows throughput and an ETA, and there is a --workers option to set the number of workers. The README says the tool is multi-threaded, using all physical CPU cores by default, and the Cargo manifest makes the mechanism explicit, with num_cpus 1.17.0 in the dependencies.

For a repository that is otherwise a small dependency set, the choices are worth noting. zip 9.0.1 handles the ZIP container, pbkdf2 0.13.0 handles the key derivation, and the comment next to it in the manifest says the parallel version did not help the performance. hmac and sha1 are there for the legacy ZipCrypto path, clap handles the command line, indicatif draws the progress bar, thiserror and either handle error and result plumbing, ctrlc implements the interrupt handling, humantime formats the ETA, and sevenz-rust2 0.24.0 with the aes256 and util features handles the 7z format.

The release profile sets lto to fat with codegen-units at 1, and the test profile raises opt-level to 3, with a comment in the manifest saying it is needed for fast execution.

Why 7z is a different problem from ZIP

The 7z support section is the most useful part of the documentation, because it explains why the tool behaves differently on the two formats and where its limits are.

7z archives are supported transparently. You point the tool at a .7z file and use any of the attack modes. Both content-encrypted archives and header-encrypted ones created with 7z a -mhe=on are handled, and the type is auto-detected from the file signature.

The caveats all stem from 7z's design rather than from the tool. Expect a much lower throughput than ZIP, because 7z derives its AES-256 key by iterating SHA-256 roughly 524,288 times per candidate, against 1,000 PBKDF2 rounds for ZIP-AES. The README is direct about the consequence: this makes brute force impractical for anything but very short passwords, and a dictionary or mask attack is the realistic approach.

Only AES-256 is supported, which is what every recent 7z build produces. Unlike ZIP, 7z has no cheap per-candidate verifier, so each password is fully decrypted and checked. The --file-number option is rejected for 7z, on the grounds that it selects an entry in a multi-file ZIP while for 7z any encrypted entry proves the password. Verification uses whichever entry is cheapest to decode, the smallest one for non-solid archives, to keep the check fast even when the archive holds a large file.

For ZIP there is a useful property the 7z side lacks: the tool can use a cheap verifier, and it automatically detects encrypted files within a multi-file archive so you can target the right entry.

Installing from a release, from crates.io, or from the AUR

Three install routes are documented, and they cover the usual cases.

The first is the provided binaries in the project's GitHub releases. The second is crates.io, using Cargo:

cargo install zip-password-finder

The third is the AUR, where the package is called zip-password-finder and is installed with an AUR helper, for example:

paru -S zip-password-finder

The Cargo manifest shows this is a modern Rust project. The edition is 2024, the version is 0.12.1, the licence is Apache-2.0, and the categories list it as a command-line-interface. The author is Arnaud Gourlay, and the keywords in the manifest are zip, archive, password, crack and brute-force.

The command line surface is shown in the README's usage section, and the shape is conventional clap. You pass the path to the zip or 7z input file as the positional argument, and the options cover the workers count, the password dictionary path, the charset presets, the charset file, the minimum and maximum password length, the file number in the zip archive, the starting password, the mask pattern, the four custom charsets, and the charset presets defaulting to lud.

The project also links two blog articles that describe the design in detail, one on brute forcing protected ZIP archives in Rust and a follow-up on cracking ZIP archives in Rust, and it asks for GitHub sponsorship if the tool helped you recover an archive.

The honest boundary: only archives you are allowed to open

A password finder for encrypted archives is a dual use tool, and the useful thing to say plainly is where its legitimate use ends.

The legitimate case is narrow and common. You encrypted a folder years ago, the password went into a password manager you no longer use, and the data inside is yours. That is what this tool solves, and it solves it well, because the mask mode lets you encode what you remember about the structure of the password rather than guessing blind.

The illegitimate case is opening an archive you do not own or have permission to open, which in most jurisdictions is a criminal offence regardless of the tooling. The tool does not verify ownership and does not care, and nothing in the documentation suggests it should be expected to.

There is a technical limit that partially overlaps with the ethical one. A well-chosen password is not recoverable by brute force, and the README says so for 7z explicitly. So the tool's effective range is short passwords, weak passwords, and passwords built from a structure you can describe. It is not a way to break encryption, and the ZIP-AES design with 1,000 PBKDF2 rounds is a reminder that the archive format was built with that in mind.

The repository includes a test-files/ directory and a benches/ directory with criterion benchmarks for the password generator and the password reader, which is a reasonable way to check the tool behaves before you point it at anything important.

Editorial conclusion

Adopt zip-password-finder if you have an archive you own or are authorised to open and have genuinely lost the password, since the mask and dictionary modes are the ones that actually work in practice, particularly for 7z. Do not adopt it as a general cracking tool or for archives you do not have the right to open. Before you start, work out whether you know the password's structure, because a mask attack with a known prefix turns an impossible search into a short one, and read the 7z caveats, since brute force against AES-256 is explicitly impractical there. Note the release picture, with v0.12.1 published on 2026-10-14 and the last push on 2026-10-21.

Frequently asked questions

Official sources

1. agourlay/zip-password-finder on GitHub
2. Issues
3. License: Apache-2.0
4. README
5. Releases