7-Zip Open Discussion: How long to brute force a .7z password (2024)

.zip encryption in 7-zip is not too secure.
.7z encryption in 7-zip is secure (It uses AES-256 and SHA-256).

From 7-Zip help about .7z encryption:

We will estimate time of exhaustive password search attack, when password is random sequence of small Latin letters.

We suppose that one user can check 10 passwords per second and organization (with budget about $1 billion) can check 10 billions passwords per second. We also suppose that each 2 years processor doubles it's performance, so each additional Latin letter of long password adds about 9 years against exhaustive key search attack.

So we have such estimated time for attack:

Password Length / Single User Attack / Organization Attack
1 2 s 1 s
2 1 min 1 s
3 30 min 1 s
4 12 hours 1 s
5 14 days 1 s
6 1 year 1 s
7 10 years 1 s
8 19 years 20 s
9 26 years 9 min
10 37 years 4 hours
11 46 years 4 days
12 55 years 4 months
13 64 years 4 years
14 73 years 13 years
15 82 years 22 years
16 91 years 31 years
17 100 years 40 years

Thanks for the info, I am aware that the .ZIP file format uses a very weak password encryption, in fact I've just finished my results on testing, these figures assume the newest/fastest Intel cpu (almost 4ghz dual core /w hyperthreading).

The time to crack a classic .ZIP file...

A. If you use a password found in a dictionary, even with numbers at the beginning and/or end:
Less than 24hrs despite length of password

B. If you just use numbers and only upper or only lower case:
2005 Summer
5 chars long: 2 secs
6 chars long: 2 mins
7 chars long: 1 hrs
8 chars long: 1 days
9 chars long: 50 days
10 chars long: 6 yr

C. If you use numbers, upper and lower case:
2005 Summer
5 chars long: 30 secs
6 chars long: 30 mins
7 chars long: 6 hrs
8 chars long: 3 yrs
9 chars long: 25 yrs
10 chars long: 1,350 yrs

D. If you use numbers, upper and lower case and use a keyboard character (the symbols above the number keys and such)
2005 Summer
5 chars: 1 mins
6 chars: 1 hour
7 chars: 3 days
8 chars: 1 yrs
9 chars: 50 yrs
10 chars: 3,400yrs

E. If you use numbers, lower & upper case, keyboard characters and insert ASCII codes by holding down ALT and typing in numbers
2005 Summer
5 chars: 5 mins
6 chars: 17 hrs
7 chars: 35 days
8 chars: 10 yrs
9 chars: 1,000 yrs
10 chars: 100,000 yrs

By the way, those calculations for .7z passwords after 7 characters look funny, either those calculations are VERY incorrect or the encryption .7z is using has tons of duplicate hashes after the 7 char mark.

Obviously the longer the password, the dynamically longer it takes to crack it.

Can anybody comment on those bizarre figures for .7z?

Here are some real world numbers using Advanced Zip Password Recovery on my machine, an AMD 3000+. My machine can check 11,000,000 passwords per second.

Assuming the character set (a-z A-Z 09) which is 62 characters

05 = 1.39 Minutes
06 = 1.43 Hours
07 = 3.71 Days
08 = 229.73 Days
09 = 39.02 Years
10 = 2419.46 Years

The math is as follows:

Total_passwords_to_check = (characters_in_char_set) POWER (password_length)
Time = Total_passwords_to_check / (passwords per second)

Char set (a-z A-Z 09) = 62 characters_in_char_set

password_length = 5
Total_passwords_to_check = 62 ^ 5 = 916,132,832
Time = 916,132,832 / (11,000,000 p/s) = 83.28 seconds

password_length = 6
Total_passwords_to_check = 62 ^ 6 = 56,800,235,584
Time = 56,800,235,584 / (11,000,000 p/s) = 5,163.66 seconds = 1.43 Hours

"The calculations for .7z passwords after 7 characters are linear because processor speed grows exponentially. It is assumed that every two years you can buy a computer that is two times faster than the computer you bought 2 years ago."

Nice to know.

CPU speed DID GROW exponentially in recent 40 years.

But are you SURE that it wil also do in next 40 years ???

"and forgot the pasword :("

Is it poor ???

Up to cca 6 chars all UPPER or all lower CaSe ?

Last I saw, WinZip doesn't support RAR nor ACE.

I'm dead sold on 7Zip because of it's simplicity and it's wide file support.