Security

Strong where it counts.

Every format uses AES-256 encryption. The numbers below come from measurements on this build, and each claim says how it was reached.

How the three formats compare

All figures use the same password for every format, so the only difference is how the format protects it.

Format	Encryption	Cost to test one password guess	Our claim
Original ZIP (ZipCrypto)	Legacy stream cipher	About 170 nanoseconds, roughly 6 million guesses per second on one processor core	Baseline
ZIP by SuperZip	AES-256, WinZip method	About 1.1 milliseconds, roughly 900 guesses per second	Thousands of times stronger security than original ZIP
7z by SuperZip	AES-256, SHA-256 key derivation, 2¹⁹ rounds	About 0.05 to 0.09 seconds	Same security as 7-Zip
SuperZip package	AES-256-GCM with Argon2id (64 MiB memory, 3 passes)	About 0.35 seconds, roughly 3 guesses per second	Millions of times stronger security than ZIP. Dozens to hundreds of times stronger security than 7z.

Measured on one desktop processor core. Original ZIP protection can also be broken from about 12 known bytes of file content, a method published in 1994. AES ZIP, 7z and SuperZip have no such shortcut.

About the 7z comparison. On an ordinary processor a SuperZip password takes 4 to 7 times longer to test than a 7z password. The advantage grows on graphics cards, because Argon2id needs a large block of memory for each guess. The "dozens to hundreds of times" claim is calculated from published 7-Zip cracking speeds and awaits a graphics-card benchmark.

What SuperZip packages add

Every password needed, in any order
A random key protects the files, and each password locks a share of it
Hidden file names
A new random salt for every package
Tamper detection: a package changed by one byte is rejected

Tests run on every build

Argon2id matches the reference implementation on official test vectors
Create and reopen in every format with exact byte recovery
Wrong passwords rejected, in every order of entry
7z files open in an independent tool
Packages near the 1 GB limit created and opened
Older package versions still open

What to know

Passwords and identities

SuperZip checks passwords and never identities or roles. A person holding every password can open a package alone.

Opening windows

Start and end times are enforced by the app using the drand public time network. Other tools or modified software can bypass them. Sharing the password only after the event gives a real seal.

Public covers

The cover text, pictures and videos are visible to anyone who has the file. Keep private information inside the protected files.

Password strength

Beyond any known computer, supercomputer, quantum computer.*

*Applies to the 20-character password SuperZip generates for you. Copy it with one tap or download all passwords.

Lost passwords

Passwords are never stored in a package or by the app, so a lost password cannot be recovered.

See it for yourself.

Create a free AES-256 ZIP or 7z file, or try SuperZip packages free for three days.

Get it on Google Play Questions? Visit support