When you research zip password recovery topics on the Internet you get loads of commercial products, but barely any free products that are updated regularly. There may be some deeply hidden on the web but those that you find on the first pages of the search results are usually commercial programs.

Two programs that I found are FCrackZip which was last updated in 2008, and RarCrack which was last updated in 2011. FCrackZip is offered for multiple operating systems including Windows, RarCrack only for Linux.

The second program has the advantage that it can not only recovery zip passwords but also rar and 7z passwords.

Both programs are command line utilities that use brute forcing to try all possible character combinations until they find the correct password.

It needs to be noted that it is not reasonable to try and recover a password with more than six characters. Why? Because it could take years on a single computer system until the password is recovered. That said, if you fail to include a particular character used in the password in the recovery attempt you may not succeed with the recovery even if you let it run months or even years.

FCrackZip

Download and unpack the Windows version of the program. You find information about all command line parameters at the developer homepage.

You need to open the command line first to run the program. Use the keyboard shortcut Windows-r to bring up the run box. Enter cmd and hit the return key afterwards. I suggest you place the zip with a password in the same directory as the recovery tool for easy of use. Navigate to that folder and use a command like

fcrackzip -c a -p aaaaaa sample.zip

to start the recovery process. This command will try all lowercase six letter passwords on the zip file sample.zip. Commands are available to specify a minimum or maximum password length, include character sets like digits, special characters or custom characters or use a dictionary method to recover the password.

The Windows version does not support all commands of the Linux version. It is for instance not possible to run a benchmark.

Rarcrack

This is a Linux tool, a readme file is included with the program. The program supports multiple threads to speed up the recovery. How does it work? The basic command is

rarcrack sample.zip –threads –type

Rarcrack uses an XML file that displays the characters used in the brute force attempt. There are not any options currently to limit the length of the passwords to try, but you can modify the currently tested password to start for instance with four characters immediately.

The XML file is created after the first run, so run it to generate the file and then edit it to suit your needs.

0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
1111

Closing Words

The chance of success is slim, and it decreases with every additional character of the password up to a point where it does not make sense anymore to try and recover the password. It can however be extremely helpful if you remember part of the password, or a length range.

Possible scenarios are that you forgot the password of a previously created rar archive or that a former employee protected files with a rar password. Whatever it is the rar password cracker will aid the user. The tool utilizes password lists, also called dictionary files, to test against the rar password.

Rar Pass Finder is a portable lightweight tool. The interface is only available in German language but since it consists of only two buttons it does not really make a different. The user should start loading a rar password list using the Passwortliste button.

Rar archives can then be loaded using the Rar-Archiv button or drag and drop. The rar password cracker supports multiple volumes and can also be run from the command line to load an archive automatically into the application. The last loaded password list will automatically be used to find the rar password.