Lock a ZIP with a password, and know what it hides.

Make the locked ZIP.

Open Password protect a ZIP and drop files or folders on it. Type a password, then type it again, so a slip of a finger does not lock you out. Then press Make the locked ZIP.

Everything happens in your browser. The files and the password are never sent anywhere, and the ZIP is written on your device.

• Password protect a ZIP
• Guide: zip files and folders without uploading

AES-256: strong, opened by fewer programs.

AES-256 is the lock the page uses unless you choose otherwise. It follows WinZip's AES specification, which 7-Zip, WinZip, WinRAR and Keka read. A long password that is hard to guess makes it, in practice, impossible to open without it.

The programs built into computers often cannot open it. Microsoft's help says Windows does not support operations on encrypted archives and points to programs such as 7-Zip or WinRAR. In our tests, the Mac's Archive Utility and the unzip that comes with macOS did not open AES-256, and nor does Python's zipfile. Before you send one, make sure the person has such a program; the Zip and archive tool opens it in any browser too.

• Guide: open a password-protected ZIP
• Open the Zip and archive tool

ZipCrypto: opens almost everywhere, easily broken.

ZipCrypto is the original ZIP password. Almost every program opens it, File Explorer often included. It is weak: a known-plaintext attack against it was published in 1994. It keeps a file from a casual glance, not from someone determined to read it.

Choose it under More options, in Kind of lock, when the person can only use what their computer came with. Letters outside English in a ZipCrypto password are written as UTF-8, as today's programs read them; plain letters and digits are safest for old ones.

What a password does not hide.

In every ZIP, the password locks what is in the files. Their names, sizes and dates, and the folders, are not locked: anyone can list them without the password. If a name gives too much away, rename the file before you lock it, or put the files in a ZIP first and lock that ZIP inside another.

• Guide: see what is inside a ZIP

The password is never kept.

The password stays in its field while the page is open and is used only to make the ZIP. It is not saved in the browser or anywhere else, and KeepSimp has no copy. If it is lost, the files cannot be got back, by you or by anyone.

Send the password another way than the ZIP: tell it, text it, or send it in a separate message, so that one lost email does not give away both.

• What KeepSimp keeps, and where