Encrypt Files with 7-Zip and Hide Their Names

If you need to send files that should not be readable by someone who gets a copy, create a password-protected 7z archive in 7-Zip. Choose AES-256 and select Encrypt file names. Those are separate protections: the password encrypts file data, while the checkbox encrypts the archive header that lists what is inside.

This guide is pinned to 16 July 2024 and uses the labels in 7-Zip 24.07, released on 19 June 2024 . Keep your original files until you have tested the new archive; making an archive does not encrypt or remove the originals.

What the password protects

7-Zip's 7z format documentation says the format uses AES-256 and derives the encryption key from your password with SHA-256 and many iterations to raise the cost of exhaustive guessing. That does not make an easy password safe: someone with a copy of the archive can try guesses against it. Use a long, unique passphrase that you have not used for an account.

The 7-Zip Add to Archive documentation describes Encrypt file names as archive-header encryption, including file names. Choose 7z and select this option if you need the list hidden; a password without header encryption can leave the names readable.

Encrypting the header hides the names stored inside the archive. It does not hide the outer .7z filename or the archive file's size. If a name such as salary-review.7z would reveal too much, rename it to something neutral before sending.

Create an encrypted 7z archive

1. Open 7-Zip File Manager and browse to the files or folder you want to share. Select only the items that belong in the archive.
2. Choose Add to archive…. You can also use the 7-Zip entry in File Explorer's context menu. If the entry is not visible in Windows 11's short menu, use File Manager instead.
3. In Archive format, choose 7z. Set the destination and archive filename. The default compression settings are fine for ordinary documents; compression and encryption are different choices.
4. In Encryption, enter a long, unique passphrase twice. Confirm Encryption method is AES-256, then select Encrypt file names. If that option is missing, check that Archive format is set to 7z.
5. Leave Delete files after compression off so the originals remain in place. Select OK and wait for 7-Zip to finish.

A password stored beside the archive defeats much of the point. Keep it in a password manager or an approved secret store, and do not reuse a password from another service.

Test the archive before you send it

Close the archive window, then open the new .7z file again in 7-Zip. With header encryption enabled, 7-Zip should ask for the password before showing the file list. If you can browse the names without a password, recreate the archive and check Encrypt file names.

Next, use 7-Zip's Test command and enter the password when prompted. For a practical handoff check, also extract a copy of one or two files to a new temporary folder and open them. The archive may be intact on your PC while the recipient's software still cannot open it, so ask the recipient to use 7-Zip or another program that supports encrypted 7z archives.

Windows 11's October 2023 KB5031455 update added File Explorer support for reading .7z archives, but Microsoft's release notes say that it does not support password-encrypted files. Tell your recipient to use 7-Zip or another compatible archiver; do not assume the built-in extractor can open this archive.

Send the password separately

If you email the archive, send its password to the intended recipient over a different communication channel, such as a phone call or an agreed secure messaging app. The UK's Information Commissioner's Office advises sending the password over a separate channel , rather than in the same email as the encrypted attachment. Confirm the recipient can open the archive before relying on it as the only copy.

Know the limits

Archive encryption protects the copy inside the .7z; it does not encrypt the source folder, protect a computer that is already compromised, or let you revoke a copy after the recipient has it. The outer filename and file size remain visible, and the recipient can access the contents while they are extracted. For workplace or regulated information, follow your organisation's approved transfer process.

Use 7z + AES-256 + Encrypt file names, then verify the password prompt and test an extraction. That protects both the contents and the internal list while keeping the original files available until the handoff works.

Sources

• 7-Zip: 7z Format — AES-256 and password-derived key details.
• 7-Zip: Add to Archive Dialog Box, version 15.14 documentation and password switch documentation — dialog options and header encryption.
• 7-Zip: History of 7-Zip changes — 24.07 release date.
• Microsoft: October 31, 2023 update KB5031455 — File Explorer archive support and its password-encryption limit.
• UK Information Commissioner's Office: Encryption guidance, version 1.0.2 (17 October 2022) — testing encrypted attachments and sharing keys through a separate channel.