Archive Encryption Detector
Check if your ZIP, RAR, 7z, PDF, or Office documents are encrypted with our free online Archive Encryption Detector. The Archive Encryption Detector analyzes file headers and structural metadata to determine encryption status, identify the encryption method (AES-256, ZIP 2.0 Legacy, RC4-128, or RC4-40), detect filename encryption, and provide a security strength rating - all without needing the password. Upload any ZIP, RAR, 7z, PDF, DOCX, XLSX, or PPTX file to get an instant encryption report with detailed information about the protection applied to each entry. The tool checks for WinZip AES-256 encryption, PKWARE strong encryption, RAR AES-128/256, 7z AES-256 with header encryption, PDF /Encrypt dictionaries with revision detection, and Office Open XML Agile Encryption via the EncryptionInfo stream. All processing happens locally in your browser. No signup required.
Detect Archive Encryption
Upload an archive file (ZIP, RAR, 7z), PDF, or Office document to detect if it is encrypted and identify the encryption method and strength. All analysis runs locally in your browser.
Drop an archive file here or click to browse
Supports ZIP, RAR, 7z, PDF, DOCX, XLSX, PPTX
Why Use Our Archive Encryption Detector?
Instant Encryption Detection
Upload any archive and instantly detect whether it is encrypted. Our archive encryption detector reads file headers and magic bytes to identify encryption markers across ZIP, RAR, 7z, PDF, and Office Open XML formats - no need to enter passwords or extract files. Get results in milliseconds with detailed information about the encryption method used.
Multi-Format Encryption Analysis
Detect encryption across 10+ archive and document formats. The archive encryption detector identifies ZIP 2.0 legacy encryption, WinZip AES-256, RAR AES-128/256, 7z AES-256, PDF RC4/AES encryption (all revisions), and Office Open XML Agile Encryption. Each detection includes the algorithm name, key size, and a security strength rating.
Filename Encryption Detection
Many encrypted archives also protect file names and metadata - the archive encryption detector tells you if filenames are encrypted too. This is critical for security audits and data classification, as filename encryption provides an additional layer of confidentiality by hiding the archive contents from casual inspection.
Security Strength Assessment
Each detected encryption method receives a security strength rating: Strong (AES-256), Medium (RC4-128), or Weak (ZIP 2.0, RC4-40). The archive encryption detector also flags known vulnerabilities and provides upgrade recommendations, helping you identify archives that need stronger encryption for compliance or security requirements.
Common Use Cases for Archive Encryption Detector
Security Compliance Audits
Use the archive encryption detector to verify that sensitive data meets encryption compliance requirements (GDPR, HIPAA, PCI-DSS). Upload archives from data transfers, backups, and document repositories to confirm they use strong encryption (AES-256) rather than weak legacy methods before approving them for storage or transmission.
Data Classification & Discovery
When processing large collections of archived data, the archive encryption detector helps classify files by their protection level. Identify which archives are encrypted, which use weak encryption that should be upgraded, and which are unencrypted and may expose sensitive information if accessed by unauthorized parties.
Forensic Investigation
During digital forensic investigations, detect encrypted archives that may contain relevant evidence. The archive encryption detector identifies encryption methods used by suspects, helping investigators determine whether they need to request passwords, seek alternative decryption methods, or understand what level of protection is applied to potential evidence.
Vendor & Third-Party Risk Assessment
Before accepting encrypted files from vendors, partners, or clients, use the archive encryption detector to verify they are using adequate encryption standards. Flag archives that use deprecated or weak encryption (like ZIP 2.0 or RC4-40) and request re-encryption with AES-256 for better security.
Incident Response & Breach Analysis
During security incident response, quickly assess encrypted archives found on compromised systems. The archive encryption detector helps determine if encryption was applied by legitimate tools or by ransomware, based on the encryption method and whether filenames are also encrypted - common characteristics of ransomware encryption.
Security Awareness & Training
Demonstrate the difference between strong and weak encryption to security teams or non-technical stakeholders. The archive encryption detector provides a visual comparison of encryption methods, strength ratings, and explanations that make it easy to understand why AES-256 is recommended over legacy ZIP encryption for protecting sensitive data.
Understanding Archive Encryption Detection
What is Archive Encryption Detection?
Archive encryption detection is the process of analyzing a file's binary headers and metadata to determine whether it is encrypted, what encryption algorithm was used, and how strong the protection is. Unlike trying to decrypt or open the file (which requires a password or key), our archive encryption detector reads file headers andstructural markers that encryption software writes when protecting an archive. For ZIP files, it checks the general-purpose bit flags and compression method in each local file header. For PDFs, it scans the document catalog for the /Encrypt dictionary. For Office documents, it looks for the EncryptionInfo stream in the OOXML package. This header-level analysis allows you to identify encryption without knowing the password.
How Our Archive Encryption Detector Works
- Upload an archive - Drag and drop any ZIP, RAR, 7z, PDF, DOCX, XLSX, or PPTX file into the archive encryption detector. The file is read entirely in your browser using the FileReader API - no data is sent to any server.
- Format identification & header scan - The tool identifies the file format by reading its magic bytes (file signature), then runs format-specific analysis. ZIP files are parsed entry-by-entry to check encryption flags and compression methods. PDFs are scanned for
/Encryptdictionary entries with filter, revision, and key-length parameters. Office documents are checked for the OOXMLEncryptionInfostream. RAR and 7z archives are analyzed through their header structures to detect encryption markers and header encryption flags. - Results & strength assessment - The archive encryption detector presents a comprehensive report showing encryption status per entry, the detected encryption method (AES-256, ZIP 2.0 Legacy, RC4-128, etc.), key size, and a security strength rating. Warnings highlight deprecated encryption methods, and the summary provides actionable recommendations.
Encryption Methods We Detect
- ZIP 2.0 Legacy Encryption: The original PKWARE encryption method using CRC-based key derivation. Rated Weak - vulnerable to known-plaintext attacks and can be broken in minutes with modern tools.
- WinZip AES-256: Strong AES encryption in Counter (CTR) mode with 256-bit keys. Used by WinZip, 7-Zip, and most modern archivers. Rated Strong - currently considered secure.
- RAR AES-128/256: RAR archives use AES encryption with 128-bit (v4) or 256-bit (v5) keys. RAR v5 also supports encrypted file headers that hide file names. Rated Strong.
- 7z AES-256: 7-Zip uses AES-256 encryption with SHA-256 key derivation. Supports header encryption (hide file names) or content-only encryption. Rated Strong.
- PDF RC4/AES: PDF supports multiple encryption revisions: RC4-40 (Rev 2, weak), RC4-128 (Rev 3, deprecated), AES-128 (Rev 4), and AES-256 (Rev 5-6, strong). Each revision is detected with its key length and algorithm.
- Office Open XML Agile Encryption: DOCX, XLSX, and PPTX files can be encrypted using the ECMA-376 Agile Encryption standard with AES-256 and SHA-512 key derivation. Detected via the
EncryptionInfostream in the OOXML package.
Privacy, Security & Limitations
100% Private: Our archive encryption detector processes everything locally in your browser using the FileReader API. Your files are never uploaded, transmitted, or stored on any server. You can verify this by checking your browser developer tools network tab - no requests are made when analyzing files. This makes the tool safe for inspecting sensitive archives, proprietary data, and legally protected documents.
Limitations: The archive encryption detector can identify that an archive is encrypted and how it was encrypted, but it cannot decrypt the archive or recover the password. For password-protected archives, you will need the original password or a dedicated password recovery tool. Additionally, the tool may not detect encryption on non-standard or proprietary archive formats that use custom header structures.
Related Tools
Related Tools
Steganography Detector
Upload an image to detect potential hidden data using LSB (Least Significant Bit) steganography analysis. Analyzes pixel-level modifications, shows a heatmap of altered pixels, detects statistical anomalies, and extracts hidden text messages if found. Compatible with standard LSB encoding and the STEG magic header format. All processing happens locally in your browser - free online steganography detector, no signup required.
Image File Size Analyzer
Upload any image to see a detailed binary-level breakdown of what contributes to its file size - pixel data, compression overhead, metadata (EXIF/IPTC/XMP), color profiles (ICC), and structural headers. Get prioritized optimization tips with estimated savings for web performance, mobile app optimization, and storage reduction. Supports JPEG, PNG, GIF, WebP, BMP, TIFF, AVIF, and HEIC - all processing runs locally in your browser, no server upload required. Free online image file size analyzer.
File Magic Byte Detector
Upload any file to instantly detect its true file type by reading the magic bytes (file signature / header). The tool bypasses incorrect file extensions and reveals the real format. Shows hex dump with matching signature bytes highlighted, ASCII interpretation, MIME type, file category, and extension match analysis. Supports over 120 file signatures across 16 categories: images, audio, video, documents, archives, executables, fonts, certificates, disk images, and more. All processing runs locally in your browser - free online File Magic Byte Detector, no signup required.
Image Clone Detector
Detect copy-move forgeries in images using pixel-block matching. Upload any image to find cloned/copied regions, view heatmap overlays showing the location and intensity of detected clones, and get confidence scores with region details. Three sensitivity presets for different detection needs. 100% private browser-based processing - free online Image Clone Detector.
Frequently Asked Questions About Archive Encryption Detector
An archive encryption detector is a tool that analyzes file headers and structural metadata to determine whether an archive file (ZIP, RAR, 7z) or document (PDF, Office Open XML) is encrypted. It works by reading the file bytes and checking for format-specific encryption markers - ZIP entry flags, PDF /Encrypt dictionaries, RAR header encryption bits, 7z header encryption properties, and Office EncryptionInfo streams. No password or decryption is attempted; the analysis is purely structural and based on observable file metadata.
The archive encryption detector supports ZIP archives (including spanned and empty ZIPs), RAR v4 and v5 archives, 7z archives, PDF documents, and Office Open XML files (DOCX, XLSX, PPTX). For each format, it detects format-specific encryption markers and identifies the encryption algorithm used. GZIP, BZIP2, XZ, and TAR files are also detected but reported as not supporting native encryption.
No. The archive encryption detector analyzes only the file headers and structural metadata to determine if encryption is present and what method was used. It does not attempt to decrypt, crack, or bypass passwords. Decryption requires the original password or key, which this tool does not have. For password recovery, you would need a dedicated password recovery tool.
Absolutely. All file analysis is performed entirely within your browser using the FileReader API. Your files are never uploaded to any server, transmitted over the network, or stored in the cloud. You can verify this by checking your browser developer tools network tab - no requests are made when analyzing files. This makes the archive encryption detector safe for inspecting sensitive, proprietary, or legally protected data.
The tool can identify ZIP 2.0 Legacy (CRC-based, weak), WinZip AES-256 (strong), PKWARE Strong Encryption, RAR AES-128 (RAR v4), RAR AES-256 (RAR v5), 7z AES-256 with optional header encryption, PDF RC4-40 (Rev 2, weak), PDF RC4-128 (Rev 3, deprecated), PDF AES-128 (Rev 4), PDF AES-256 (Rev 5/6, strong), and Office Open XML Agile Encryption with AES-256. For each method, it reports the algorithm name, key size in bits, and a security strength rating.
The strength rating has three levels: Strong indicates modern, cryptographically sound encryption (AES-256) that is considered secure against current attacks. Medium indicates encryption that was once considered secure but is now deprecated (RC4-128) and should be upgraded. Weak indicates encryption that is trivially breakable with modern hardware (ZIP 2.0 Legacy, RC4-40) and offers little real protection against a determined attacker. The archive encryption detector provides upgrade recommendations for weak and medium ratings.
Filename encryption means that the names of files inside the archive are also encrypted, not just their contents. When filenames are encrypted, you cannot see what files are inside the archive without providing the password. This provides an additional layer of confidentiality. The archive encryption detector identifies whether filenames are encrypted for ZIP (via strong encryption flags), RAR (via header encryption), and 7z (via header encryption mode) archives.
Each format requires a different detection approach. ZIP files are parsed entry-by-entry using the JSZip library to check encryption flags and compression methods on every file. PDF documents are scanned as text for the /Encrypt dictionary entry, then parsed for Filter, R (revision), and Length parameters to determine the encryption algorithm and key size. RAR and 7z headers are analyzed byte-by-byte for encryption-specific bits and properties. Office documents are parsed as ZIP archives to check for the EncryptionInfo and EncryptedPackage streams that indicate ECMA-376 Agile Encryption.
Since the archive encryption detector processes files entirely in your browser, the practical limit depends on your device available memory. Most archives and documents up to several hundred megabytes can be analyzed without issues. For very large archives (500MB+), the tool may experience slower performance on devices with limited RAM. The ZIP parser processes entries sequentially, so very large ZIP files with thousands of entries may take longer to analyze.