Zip and RAR Password Recovery in 2026: Tools and Practical Techniques
Zip and RAR archives are among the most widely used containers for storing and moving large amounts of data in compressed form. The convenience, security, and reliability they offer in password-protected mode are exactly why so many people rely on them to keep confidential information. And, as life goes, sometimes you forget the password to an archive. There are plenty of reasons a password gets lost, but here is the good news: you can try to recover your Zip or RAR password, succeed, and get your packed data back.
In this post I will explain how recovery of forgotten Zip/RAR passwords works and show you a few useful tricks that actually get results.
What Zip and RAR archives are and how they differ
Zip is a container file format, an archive, that packs and stores many user files in one. It is widely used by archiving programs across operating systems. On Windows the Zip extractor is even built into the OS. The main advantage of Zip is that it is the most popular archive type. The classic Zip format, though, lacks some important capabilities found in other formats, such as RAR.
RAR is a proprietary format used by the WinRAR archiver. It works much like Zip: both are data containers for compressing many files. Compared to classic Zip, however, RAR has more advanced features. One of them is stronger password encryption.
How secure is RAR or Zip encryption?
For example, here is the raw brute-force speed on an AMD RX6800 GPU in Passcovery Suite (passwords per second):
- classic Zip: 20,086,232,566
- WinZip AES: 5,842,617
- RAR3: 173,320
So you could say that a RAR archive's password protection is roughly 115,891 times tougher than a Zip archive with classic encryption, and about 3,437 times tougher than one with WinZip AES.
Password encryption is a must-have for restricting access to the data inside an archive, and most archivers implement it well, for Zip and for RAR alike. To reach the data in an encrypted archive, the user then has to enter the password and decrypt the files.
So let us look at a few of the best programs for recovering Zip and RAR passwords and pick up some tricks to shorten the job.
Accent ZIP Password Recovery for Zip/Zipx archives
Passcovery's program has a name that says it all, and it does a great job recovering (or, to put it bluntly, cracking) lost passwords for Zip archives. It offers three ways to find a password:
- a brute-force attack
- a brute-force attack with an extended (positional) mask
- a dictionary attack
The program supports archives with classic and WinZip AES encryption from various archivers, shows excellent brute-force speed, and runs GPU acceleration on NVIDIA, AMD and Intel Arc graphics cards.
Quick start with Accent ZIP Password Recovery
1. Download and install the latest AccentZPR. Nothing tricky here: it is a Windows distribution and the setup is the usual routine. You do not need to worry about your computer or your data. Passcovery's site and all of the company's distributions carry a digital certificate, a verified signature, and a clean rating on VirusTotal.com.
2. Launch the Zip password cracker and open the zip/zipx archive whose password you lost, the same way you would in Windows (from the menu, the toolbar button, or Ctrl+O). Accent ZIP Password Recovery will tell you about the protection it finds:
3. On the next step, pick a ready-made script for an automatic search or one of the three password attacks:
👊 a brute-force attack, when you know nothing about the password. It runs through the whole range you set. Here you choose the alphabet and character sets, limit the password length, and set a simple mask for the parts you do know:
🔥 a brute-force attack with an extended (positional) mask, when you know the password's structure. The search targets a smaller set of values. The extended mask lets you describe character sets individually for each position of the password:
💣 a dictionary attack, when the password might be a common phrase. The search is limited to a ready-made list of passwords, the dictionary. In Passcovery recovery tools you can connect up to 4 dictionaries at once:
4. Once the attack is chosen and set up, launch it on the forgotten password. Just click "Finish". The program starts the search and keeps you posted on its status, the speed, and the time needed to cover the whole range.
The registered version saves the search state every five minutes. Handy: you can pause anytime and pick up where you left off. In the demo version this feature is off.
5. Accent ZIP Password Recovery shows the found password as a hyperlink. Click it to copy the password to the clipboard and open the locked Zip archive.
Accent RAR Password Recovery for RAR/WinRAR archives
Accent RAR Password Recovery is a Windows program for unlocking passwords of RAR archives made in WinRAR 2.90 and later. It has three attack methods for a forgotten password: brute force, positional mask, and dictionaries. It is professionally optimized for multi-core CPUs and accelerates on NVIDIA, AMD and Intel Arc graphics cards. All of this delivers the highest possible speed against a format as tough and resistant as RAR.
Direct, clear, and fast like the autobahn, the recovery interface is a Password Recovery Wizard with a few tabs: general info about the protection in the file, the choice of attack type, and that attack's settings.
Quick start with Accent RAR Password Recovery
Getting started takes just a few simple steps:
- Open the password-protected RAR file
- Choose the right attack (one of three)
- Configure the attack
- Finally, click "Finish" and start the process
Accent RAR Password Recovery does not support ZIP archives
Accent RAR Password Recovery supports only RAR3/RAR5 archives and does not support Zip archives.
Passcovery Suite for Zip/RAR archives and other popular formats
Supported formats
Passcovery Suite is a professional tool for recovering passwords across many file formats:
- Zip/WinZip and RAR/WinRAR archives
- Microsoft Office, OpenOffice/LibreOffice, Adobe PDF documents
- Apple iOS and BlackBerry OS backups
- TrueCrypt volumes
- WPA/WPA2 handshakes
Features
It shares the unified Passcovery interface and capabilities:
- instant recovery of simple Microsoft Office and Adobe PDF passwords
- three attack types: brute force, positional mask, and dictionary
- attack scripts that check different ranges in sequence
- asm-optimized brute-force speed
- GPU acceleration on NVIDIA, AMD and Intel Arc graphics cards
- automatic saving of the search status
Passcovery Suite is the answer when you cannot open a Zip or RAR archive because you forgot or lost the password. Support for extra formats spares you the hassle of choosing the right tool next time. Flexible search-range settings and high speed help you unlock the password and get back to your encrypted data as quickly as possible.
Two factors decide ZIP/RAR recovery: search-range size and verification speed
RAR and WinZIP archives are protected with genuinely complex, resistant encryption algorithms, with no backdoors and no shortcuts. The only way to recover a password for them is to try candidates until you hit the right one. That is how every password-recovery program works: you set the search range, and it checks every value in it, one password after another.
So the success of cracking a tough password comes down to two factors:
1. skillful control of the search range: the smaller and more precise it is, the faster it gets checked
2. verification speed: the faster it runs, the less time cracking takes
Editing a ZIP/RAR archive in Notepad does not remove the password
Online you will find false claims that you can strip an archive's password by swapping a few bytes in Notepad (in Notepad, Carl! 😂). Supposedly you open the file, replace "Ûtà" with "5^3tà’" and "‘IžCO" with "IžCO", the password vanishes, the data probably decrypts, and rainbows and pink ponies show up outside. No. It is all nonsense. With Zip and with RAR alike, it is brute force or nothing.
A positional mask narrows the brute force (example: ~3 years → ~3 hours)
No matter how fast the program or how souped-up the computer, checking every password in a row would take years, centuries, millennia.
To bring the search time down to something reasonable, there is the positional mask. It lets you set character sets individually for each position of the generated password. It is still a brute-force attack, just with a narrower, more precise set of values to check.
Say you know the password starts with uppercase consonants. Then there is no point checking other letters in the first position. Next come strictly lowercase vowels. Great, we cut every other symbol from the set. At the end there is either a digit or a special character. We keep only those. As a result, instead of 75+ trillion passwords to check, only 11+ billion remain. And the full brute-force time drops from almost three years to a little over three hours.
The positional mask is a powerful, strongly recommended feature for successfully finding archive passwords.
More detailed examples and instructions are here.
Merge up to 4 dictionaries and apply 20+ mutation rules
Fact: people often use words, or tweaks of words, as passwords. That is why there are dictionaries, lists of such word-passwords (this one, for example), and a dictionary attack is sometimes the only reasonable way to try a tough password.
To grow the check list smartly, with only similar clones, Passcovery products have dictionary merging and mutation. You can combine up to four dictionaries, build one shared password from their contents, and then change it however you like. There are now more than 20 base directives for changing a password. Combined, they produce an unlimited number of variations.
Say you know the password is a set of certain words in an unknown order and unknown case (maybe uppercase, maybe lowercase, maybe at the start, maybe not), and some letters were swapped for other characters (o for 0, e for 3, a for @, and so on). No problem: we build (or pick) the dictionary or dictionaries, write the rules for merging and mutating them, start the search, and bam, the forgotten Zip/RAR password is recovered.
Dictionary merging and mutation is another recommended feature when you know something about the password. Examples with all the instructions are here and here.
Verification speed. GPU acceleration on NVIDIA, AMD and Intel Arc graphics cards
Recovering Zip/RAR passwords can be sped up on NVIDIA, AMD or Intel Arc graphics cards.
The strength of modern GPUs is the number of stream processors that can run the same kind of task at once. By loading graphics cards with the needed calculations, password-recovery programs raise the search speed noticeably. And shorten the cracking time, of course.
To find out which graphics card suits password-recovery tasks best, see the graphics-card rating.
Bottom line: the right tool, knowledge of the password, and a powerful GPU improve your chances of recovery
The reliability of their data encryption is one reason Zip and RAR archives are so popular worldwide. The flip side: a lost or forgotten password can turn into a serious problem. But the right tool, smart use of what you know about the lost password, and modern hardware give you a solid chance of recovering it.
About the Author
Denis Gladysh, co-owner and head of Passcovery, a maker of high-speed, GPU-accelerated password recovery software for popular file formats. Denis wrote the first versions of Accent OFFICE Password Recovery back in 1999.
Frequently Asked Questions About ZIP/RAR Password Recovery
How to see a ZIP file password?
You cannot see a ZIP file password. ZIP archives do not store the password inside. The password is used only to derive the encryption key that protects the data. When you type the password, the archiver computes the key on the fly, for example via PBKDF2 (WinZip AES) or a CRC32 check (classic ZIP).
In other words, the ZIP password is not written or saved in the file. There is no field, string, or metadata to pull it from. So you cannot technically retrieve or display it.
How do you regain access?
The only option is to recover the password with specialized software. For example,
Accent ZIP Password Recovery uses brute force, mask, or dictionary attacks with GPU acceleration.
Learn more: Where Does ZIP Store the Password? How Does ZIP Validate It?
What is a dictionary attack?
A dictionary attack is a recovery method where the program checks not every possible character combination but a ready-made list of the most likely passwords: words, phrases, names, dates, and popular choices.
Unlike a full brute force, a dictionary attack is faster and targets real, human passwords.
Modern dictionary attacks in tools like Accent ZIP/RAR Password Recovery and Passcovery Suite let you:
- Combine up to 4 dictionaries to build complex passwords.
- Mutate dictionary entries with a set of rules (case changes, character swaps
o → 0,a → @, prefixes, suffixes, and so on). - Build custom dictionaries for specific patterns.
For example, if a password is two words plus digits, you can set separate dictionaries and mutation rules.
Learn more: Usage example | Dictionary attack for OpenOffice
How to remove a password from a 7-Zip file?
You cannot remove a password from a 7-Zip file directly. You have to recover the password, open the archive, and recreate it without protection.
Supported 7-Zip formats (for recovery):
- Classic ZIP and ZIP with WinZip AES are fully supported by Passcovery.
Not supported: the native 7z format.
How to remove the password:
- Recover the password with Accent ZIP Password Recovery or Passcovery Suite.
- Open the archive and re-save it without a password.
Passcovery supported formats: ZIP (classic and WinZip AES), RAR3, RAR5.
How to open a password-protected RAR file without the password?
You cannot open a RAR file without the password. RAR3 and RAR5 use AES-256 cryptography with no backdoors. The only way is to recover the correct password.
Why RAR is hard to crack: a strengthened KDF and AES-256 make the search far slower than for ZIP.
How to recover a RAR password (if you are the data owner):
- Positional mask: sharply reduces the search space.
- Dictionaries + mutation rules.
- GPU acceleration (NVIDIA/AMD/Intel).
Professional tools: Accent RAR Password Recovery and Passcovery Suite.
Bottom line: you cannot open RAR without the password, but smart narrowing of the range makes recovery realistic.
How to remove a password from an archive file?
You cannot remove an archive password directly. You have to recover it, extract the data, and create a new archive without protection.
| Archive format | Encryption level | Recovery speed* | Optimal method | GPU |
|---|---|---|---|---|
| Classic ZIP | Low | ~10 billion/sec | Brute force / Mask | ✅ |
| WinZip AES | High | ~4.7 million/sec | Dictionary / Mask | ✅ |
| RAR3 | Very high | ~105 thousand/sec | Mask / Dictionary | ✅ |
| RAR5 | Very high | ~53 thousand/sec | Mask / Dictionary | ✅ |
| 7z | High | — | External tools | — |
| *Tested on NVIDIA GeForce RTX 4060, Passcovery Suite | ||||
How to remove the password:
- Recover the password.
- Open the archive and extract the files.
- Create a new archive without a password.
Recommended tools:
ZArchiver: how to recover a ZIP/RAR archive password?
ZArchiver itself will not recover the password. It is an Android archiver from ZDevs: it creates and opens archives, while the actual brute force of a forgotten password is handled by separate Windows programs.
It helps to know exactly what ZArchiver can do. It creates password-protected ZIP and 7z archives, and it only unpacks RAR. It does not make RAR itself, and that is not a bug but the norm: RAR is proprietary, and third-party archivers usually just read it.
Why not on the phone? Brute force is heavy computation, and a computer's graphics card handles it fastest. So the first step is simple: copy the archive to a PC and work with GPU acceleration.
From there it depends on which archive you actually have:
- ZIP from ZArchiver recovers without fuss. Run Accent ZIP Password Recovery or Passcovery Suite and pick brute force, a positional mask, or a dictionary. It works for classic ZIP (ZipCrypto) and for strong WinZip AES.
- A RAR opened in ZArchiver was actually built by another program, usually WinRAR. Its password is cracked by Accent RAR Password Recovery or Passcovery Suite, tuned for RAR3 and RAR5.
- 7z from ZArchiver is not something Passcovery tools handle yet. Here Hashcat or John the Ripper take over, as with any other 7z. There is a separate answer about that above.
In short, ZArchiver is about archives on your phone, and password recovery is about the desktop. Different jobs, different tools.
Lost your pass? ZIP/RAR recovery: online service or your own PC?
Short answer: for anything tougher than classic ZIP, you are better off on your own computer. In case you lost your pass, you will run into both online services and desktop tools, and the difference between them is not cosmetic.
First, and most important, is privacy. An online service is built so that you upload your archive to someone else's server. A desktop tool keeps the file where it belongs, on your own computer. For work documents or a personal archive, that is usually the deciding argument.
Second is control over the search range. The desktop gives you a positional mask and dictionary merging with mutations, and that is the very lever that makes a strong RAR or WinZip AES password recoverable in a reasonable time. Online usually leaves you few settings: upload the file and hope.
Third is hardware. The desktop runs on your own NVIDIA, AMD or Intel graphics card, and you decide how much to throw at it. Online runs on someone else's hardware, on their terms, with no speed guarantees.
The takeaway is simple. For anything tougher than classic ZIP, local control over the range is what turns impossible into doable. That is exactly what Accent ZIP Password Recovery, Accent RAR Password Recovery, and Passcovery Suite are built on.
How long does ZIP/RAR password recovery take?
Honest answer: from a couple of seconds to a few years. It depends on three things: the archive format, the password's length and complexity, and your hardware. A simple or dictionary password falls almost instantly, while a long random RAR5 can run for years.
Format plays the biggest role. On the same RTX 4060, classic ZIP runs at roughly 10 billion passwords per second, while RAR5 barely manages about 53 thousand. That is a difference of thousands of times, and it is not about a weak program but about encryption strength. Figures for all formats are in the comparison table above.
But speed is only half the story. The other half is the size of the range you set for the search. And that is where the real lever hides.
A positional mask cuts the time not by percentages but by orders. In the article's example, narrowing the range squeezed the search from almost three years down to a little over three hours. Same password, same hardware, the only difference is what you know about the password's structure.
So how realistic recovery is rests not on raw power but on what you remember about the password. The more precisely you describe the range with a mask or dictionaries, the shorter the road. Details are in the positional-mask section.