Bandizip Password: AES-256 Encryption and Password Manager

Bandizip password dialog with AES-256 encryption option and saved password list

An encrypted archive is only as good as two decisions: which cipher, and whether the filenames are encrypted too. Bandizip exposes both, and the second one is the one people forget.

Setting a password properly

Select the files, choose Add to archive, and enter the password twice in the dialog. Bandizip uses AES-256, which is the same primitive every credible tool uses; there is no weaker "ZipCrypto" fallback offered in the UI, which is a good default because classic ZIP encryption is broken in ways that take minutes to exploit.

A password on a ZIP protects the contents. It does not hide the file list unless the format supports header encryption, and this is where the formats differ.

Filenames leak more than people expect

ZIP — the central directory is not encrypted. Anyone can list every filename, size and timestamp without the password. If a filename like redundancy-letter-draft-2.pdf is sensitive, the encryption has already failed.
7Z — supports header encryption as an explicit option. Turn it on and the archive looks like an unnamed blob until the password is entered.
RAR — supports it too, but only when the creator enabled it.

So the rule is: for anything where the names matter, use 7Z with header encryption, not ZIP. It costs a few seconds of compression and removes an entire class of leak.

The password manager

Professional edition adds a small vault for the passwords you reuse across archives — client deliverables, monthly backups, the shared password your team keeps retyping. It sits behind the main password prompt and fills the field on demand.

Treat it as a convenience, not as a second factor. It protects against shoulder-surfing and typos, not against someone with access to your Windows session. For anything that genuinely matters, store the password in a real password manager outside the archiver, because a vault that unlocks with your Windows login is only as strong as that login.

What recovery can and cannot do

Password Recovery, also Professional, runs an optimised search: dictionary attack first, then mask-based brute force, using all cores. On a modern CPU it can test on the order of hundreds of thousands of candidates per second against a ZIP.

Run the numbers before you get hopeful. An eight-character password mixing case, digits and symbols is roughly 3 × 10¹⁵ combinations. At a million tests per second that is about ninety years. Recovery is realistic for a forgotten four-to-six character password, a dictionary word with a digit appended, or a pattern you can describe with a mask. It is not realistic for anything a password manager generated.

There is no backdoor, no vendor recovery service, and no legitimate tool that promises otherwise. Sites claiming instant RAR password removal are either running the same brute force on better hardware or harvesting the file.

Practical hygiene for archives

Use 7Z with header encryption for anything leaving your machine.
Never reuse the archive password as your email or Windows password.
Send the password through a different channel than the archive — a message, not the same email.
Record the password somewhere durable. An unopenable backup is not a backup.
Test one file from a finished archive before deleting the originals.

Removing a password

There is no "unprotect" command. Extract with the password and create a new archive without one — which is also the honest answer for every other archiver. If the archive is large, do it in place: extract to a folder on the same volume, re-compress, verify, then delete.

For the encryption settings that apply to each edition, see the edition comparison. For the format-level differences that decide whether your filenames leak, see the three-way comparison.