How to Open a Password-Protected ZIP on a Phone - iPhone and Android Steps and Why It Fails
The short answer: three ways to open it
Quotes in Excel or PDF, photos in JPEG or HEIC from a school or studio: plenty of everyday files arrive wrapped in a password-protected ZIP. On a phone there are three ways to open one: the file manager that ships with the OS, a dedicated unzip app, or a tool that runs in the browser. On iPhone that means the Files app; on Android it means Files by Google or the file app from the phone maker. Neither Apple nor Google documents how these apps handle password-protected archives (checked October 2026), so the quickest route is to try the built-in app first and, if it fails, find out why before switching.
- Save the ZIP from Gmail, Outlook or a chat app to the device (the Downloads folder in the Files app on iPhone, the Downloads folder on Android)
- Open the ZIP in the built-in app and choose to uncompress or extract it
- When asked for a password, enter the one the sender gave you through a separate channel
- If no password prompt appears and the app fails, or a password you know is right gets rejected, work through the causes in "Why it will not open, and how to tell" from the top
Almost every failure comes down to one of four things: the encryption method (ZipCrypto or AES), a split archive, the characters used in the password, or a damaged file. Narrowing it down first saves you from installing app after app.
Opening it in the iPhone Files app
On iPhone, the built-in Files app handles both compressing and uncompressing ZIP files. The "Zip or unzip a file or folder" topic in Apple's iPhone User Guide for iOS 27 says to touch and hold the file and tap Uncompress.
- For an email attachment, open it and use the Share button to save it to Files. Anything downloaded in Safari is in Files under Browse, in the Downloads folder
- Touch and hold the ZIP icon, then tap Uncompress in the menu
The guide says nothing about a password step. With a password-protected ZIP, then, the outcome can vary with the iOS version and the encryption method: you may get a prompt and open it, or you may get an error. If it errors, skip the retries and go straight to the diagnosis in "Why it will not open, and how to tell".
The fallbacks are an unzip app from the App Store or a browser tool opened in Safari. When choosing an app, check that its description mentions AES-256 ZIP files and split ZIP files (the .z01 parts and so on). An app that does not say what it supports may trip over the same files as the built-in one.
Opening it on Android (Files by Google and maker apps)
The default file manager on Android differs from phone to phone, and Files by Google from Google is one of them. Google's help article "Unzip your files" states that Files by Google supports only .zip files.
- Open Files by Google and go to the folder with the ZIP (usually Downloads)
- Tap the ZIP to see its contents, then tap Extract
- The extracted files land in the same folder as the ZIP. Tick "Delete ZIP file" to remove the ZIP afterwards
That article does not mention password-protected ZIP files either. Some phone makers install their own file manager, and what each app supports varies. When looking for an unzip app on Google Play, use the same test as on iPhone: does it say it handles AES and split ZIP files?
Keep an eye on free storage too. Google's help notes that extraction can fail with an error when storage is full. During extraction the ZIP and its contents sit on the device side by side, and a ZIP of photos does not shrink much when compressed, so plan for a second ZIP-sized chunk of free space and clear out unneeded files first.
Why it will not open, and how to tell
The ZIP specification is published by PKWARE, the company that created the format, as APPNOTE.TXT (the final version as of October 2026 is 6.3.10, revised in November 2022). Most failures can be traced to which features of that specification were used to build the file.
| Symptom | Common cause | What to try |
|---|---|---|
| Error before any password prompt | AES encryption | An AES-capable app or a browser tool |
| Only part of the contents, or a "damaged" message | Only one part of a split ZIP was opened | Put every part, .z01 included, in one folder |
| The right password is rejected | Full-width or non-Latin characters typed differently | Use plain ASCII, or ask the sender |
| Stops partway, CRC error | The download was cut off | Download it again |
ZipCrypto and AES: ZIP encryption comes in two families. The original method, usually called ZipCrypto, is called weak by APPNOTE itself (version 6.3.10). The other uses AES: Appendix E of APPNOTE, based on a file encryption utility by Dr. Brian Gladman, specifies AES in CTR mode with HMAC-SHA1 for integrity and keys of 128 or 256 bits. An AES-encrypted entry carries the value 99 in its compression method field, with the real method stored elsewhere, so an app without AES support stops right there. As of 7-Zip 26.05 (released on 21 October 2026), 7-Zip can apply AES-256 to ZIP files, and archives made that way belong to this family.
Split ZIP files: a large archive can be written as .z01, .z02 and so on, with the final part named .zip (APPNOTE section 8.3). The central directory lives in that last .zip, so nothing opens until every part sits in the same folder. If the parts arrived in separate emails, save them all before opening the .zip.
Password encoding: Appendix D of APPNOTE states plainly that the UTF-8 flag for file names (bit 11) says nothing about the encoding of the password. The password is treated as a string of bytes with no defined character set, so a password containing Japanese characters, such as one mixing kanji with 2026, turns into different bytes when a Windows PC created it in Shift_JIS and the phone reads it as UTF-8. You can type it perfectly and it still will not match. Passwords limited to plain letters and digits (the ASCII range) never hit this problem; if a non-ASCII password from a Windows user fails, ask for the archive to be rebuilt with an ASCII-only password.
Damaged files: every file inside a ZIP carries a CRC-32 checksum. A download that was cut short fails the check at the end of extraction and stops. Downloading it again over a stable connection is the quickest fix.
Open it in the browser without sending the file anywhere
If you would rather not install an app, or your work phone does not allow it, a browser-based unzip tool will do. The catch is that some tools upload the file to a server before extracting it. Handing contents worth a password to a third party's server defeats much of the point of encrypting them.
The piclab ZIP extractor opens the ZIP entirely inside your browser. The contents, the file names and the password are never sent anywhere, and the password is not stored. It works the same in Safari on iPhone and in Chrome, Microsoft Edge or Firefox on Android. Besides password-protected ZIP files, it opens password-protected 7z and RAR archives and split ZIP sets starting at .z01.
- Open the tool and choose the ZIP (on iPhone you can pick files saved in the Files app; for a split ZIP, select every part at once)
- If the archive is protected, a password field appears; enter the password and tap Open
- From the list of contents, save the files you need one by one, or all of them with Save all
The browser route also suits phones that are short on space: save only the files you need instead of unpacking the whole archive. For where the format came from and how it works, see the glossary entry ZIP.
Stay safe: get the password through a separate channel
Japanese companies long followed a routine of emailing a ZIP and then sending its password to the same address in a second email (the practice known as PPAP). Anyone able to read that mail route gets both the ZIP and the password, so the routine protects nothing. The Cabinet Office and the Cabinet Secretariat of Japan abolished the practice of sending automatically encrypted ZIP files on 26 November 2020, and the minister in charge at the time said the password should be given through a separate channel.
- Receive the password by phone, SMS, or a chat app such as LINE, Slack or Microsoft Teams, never by the same email route
- Do not open password-protected ZIP files from senders you do not know. According to a 2022 alert from JPCERT/CC, the Emotet malware spread as macro-enabled Excel and Word files packed into password-protected ZIP attachments, and from April 2022 ZIP files containing shortcut (LNK) files were seen as well
- If the archive turns out to contain programs or shortcuts such as .exe, .js, .vbs or .lnk files, do not run them, and do not enable macros when an Office file asks you to
- For important documents, a cloud storage share limited to named people (Google Drive, iCloud Drive, OneDrive and the like) is often safer than a password-protected ZIP
Most ZIP files that refuse to open on a phone can be opened within minutes once you know the cause. Try the built-in app first; if that fails, match the symptom in the table in "Why it will not open, and how to tell" and move to a tool that supports AES and split archives.