How to Encrypt a File with a Password

To encrypt a file with a password, use a zip/7z, GPG, or an encrypted disk image with AES-256 and a long passphrase.

Need a fast, reliable way to lock a document, photo, or folder? This guide shows clear paths on Windows, macOS, and Linux, plus cross-platform picks that travel well. You’ll see when to choose a simple encrypted archive, when a disk image makes sense, and which settings matter most.

Encrypt A File With A Password — Safe Options By Platform

Different tasks call for different tools. A small PDF you plan to email may fit in a passphrase-protected 7z archive. A folder of tax scans may sit better inside a disk image you mount only when needed. The table below maps common needs to proven methods so you can pick fast.

Method	Type	Where It Fits
7-Zip (.7z)	Encrypted archive	Cross-platform sharing; strong AES-256 when set with a long passphrase.
ZIP with AES	Encrypted archive	Broad compatibility; good for single files sent by email or cloud.
macOS Disk Image	Encrypted disk image	Great for Mac users who want a mountable container for many files.
GnuPG (gpg -c)	Symmetric encryption	Scriptable on Linux/macOS; handy for automation and backups.
OpenSSL enc	File encryption	Command-line method; fine for quick tasks when options are chosen well.
VeraCrypt Container	Encrypted volume	Portable vault for many files; Windows/macOS/Linux.
Office File Protection	Built-in document lock	Quick for Word/Excel or PDF export; pick the strong encryption option.
Windows EFS	User-bound encryption	Ties decryption to your account; not ideal for sharing with a passphrase.

How to Encrypt a File with a Password: Fast, Safe Workflow

If you came here for how to encrypt a file with a password, start with 7-Zip on Windows, a disk image on macOS, or gpg on Linux. The steps below keep things tidy from setup to sharing.

Pick A Method That Matches Your Goal

Sending a single document to a colleague? A 7z or AES-ZIP is easy to open on most desktops. Locking a whole folder that you’ll use often on a Mac? A disk image mounts like a drive and stays locked when ejected. For scripts or servers, gpg is common on UNIX-like systems and works well in cron jobs.

Choose A Strong Passphrase

Skip short passwords. Go with a passphrase of 14+ characters, mixed words, or a sentence you can recall. A password manager makes storage simple. If the tool offers a memory-hard KDF or PBKDF2 iterations, turn the cost up until the prompt takes a brief moment on your device.

Test Before You Delete Originals

After encryption, try opening the result on another device or user account. Confirm your passphrase is requested and the file opens cleanly. Only then move, archive, or shred the source.

Windows: 7-Zip And AES-ZIP

7-Zip Graphical Steps

Install 7-Zip. Right-click the file or folder, pick “7-Zip → Add to archive…”.
Set “Archive format” to 7z. Under “Encryption,” pick AES-256.
Type your passphrase twice. Check “Encrypt file names.”
Click OK. You get a .7z file that prompts for the passphrase when opened.

7-Zip Command Line

7z a -t7z -p -mhe=on secure.7z "C:\path\to\file_or_folder"

The flag -p asks for a passphrase at runtime. The flag -mhe=on hides names inside the archive.

Windows ZIP With AES

Use 7-Zip or another tool that supports AES-encrypted ZIP, not legacy ZipCrypto.
Create the ZIP, pick AES-256, and set a strong passphrase.
Share the file and send the passphrase over a separate channel.

macOS: Encrypted Disk Images And Zip

Create An Encrypted Disk Image

Open Disk Utility → File → New Image → Blank Image.
Name it, set a size that fits your files, and choose APFS or HFS+ as needed.
From “Encryption,” choose 256-bit AES.
Enter a strong passphrase. Save the .dmg or .sparseimage.
Double-click the image to mount, copy files in, then eject.

Zip A File With A Passphrase (macOS)

zip -e secure.zip file_or_folder

The -e flag prompts for a passphrase and may use legacy ZipCrypto on some systems. To get AES-ZIP on macOS, use a third-party archiver (such as 7-Zip or Keka) and choose AES-256.

Linux And UNIX: GPG Or OpenSSL

GPG Symmetric Encryption

gpg -c --cipher-algo AES256 --output secret.gpg file_or_folder

This creates a passphrase-protected file with strong ciphers. To decrypt, run gpg --decrypt secret.gpg > restored.

OpenSSL Enc (Quick Tasks)

openssl enc -aes-256-cbc -pbkdf2 -iter 200000 -salt -in input -out output.enc

Use -pbkdf2 and a high -iter count. Avoid raw -k with a short password. To decrypt: openssl enc -d -aes-256-cbc -pbkdf2 -iter 200000 -in output.enc -out restored.

Share Secrets Safely

Send the encrypted file through your normal channel. Send the passphrase through a different channel, like a phone call or a text. Avoid reusing that passphrase across files. If reuse is unavoidable, add a tag word that changes per recipient.

Settings That Matter

AES Mode

AES-256 in GCM or CBC with an HMAC tag are common picks in mainstream tools. If a tool offers GCM, choose it. If it offers only CBC, make sure it adds an auth tag or a format that includes one, like 7z or GPG.

Key Derivation

Your passphrase must be stretched into a key. PBKDF2 with many iterations is common; memory-hard functions like Argon2 raise the cost for attackers. Choose the strongest option your tool offers and bump the cost until it feels slow but not painful on your device.

Metadata Protection

File names can leak info. In 7-Zip, turn on “Encrypt file names.” Disk images hide names when unmounted. Plain ZIP without that option may leak names and hints about contents.

Choosing Between Archive, Container, Or App Lock

Encrypted Archive (.7z Or AES-ZIP)

Pick this when you need a single file to send. It’s compact, easy to attach, and simple to open with free tools. Turn on name hiding in 7-Zip so the list of files stays secret until unlocked.

Encrypted Container (Disk Image Or VeraCrypt)

Pick this for ongoing work with many files. Mount the container when needed, work inside it, then eject. This keeps data locked at rest and cuts the risk of stray copies across folders.

App-Level Lock (Office Documents)

Quick and built in, handy when the file never leaves that format. Use the strong encryption option in the app’s Protect settings. If you plan to move the content into another tool later, store the source in an archive or container as well.

Reference Steps With Links

macOS can make encrypted disk images with a chosen cipher and passphrase. See Apple’s Disk Utility guide for the exact menu path. For background on password-based key derivation and safe settings, see NIST’s SP 800-132.

Command Cheat Sheet

Tool/OS	Command	Purpose
7-Zip (Windows)	`7z a -t7z -p -mhe=on secure.7z item`	Create AES-256 7z and hide names.
7-Zip AES-ZIP	`7z a -tzip -p -mem=AES256 secure.zip item`	Create a ZIP with AES-256.
macOS Zip	`zip -e secure.zip item`	Prompt for a passphrase; legacy crypto on some builds.
GPG	`gpg -c --cipher-algo AES256 -o out.gpg item`	Symmetric encryption with a passphrase.
OpenSSL	`openssl enc -aes-256-cbc -pbkdf2 -iter 200000 -in in -out out.enc`	File encryption with KDF and salt.
VeraCrypt	GUI wizard	Make a container; set a long passphrase.
Office (Word)	File → Info → Protect	Set a password for the document.

Shared Workflows And Team Use

Teams often mix platforms. A simple rule keeps work smooth: choose one method for shared work and write the steps in the project README. A 7z archive with AES-256 works on Windows and macOS with free tools. For long-term storage, a VeraCrypt container keeps many files under one passphrase.

Sharing With Non-technical Recipients

Pick fewer clicks. A 7z or AES-ZIP sent as an email attachment is easy to open with 7-Zip on Windows or Keka on macOS. Send the passphrase by phone or SMS. If needed, create a one-time link in your password manager and set it to expire.

Backups And Archiving

For archives, aim for repeatable steps. Script a gpg or 7z command with prompts. Store passphrases in a vault and rotate them on a schedule. Keep a printed recovery sheet in a safe place for a single point of access.

Threat Basics In Plain Words

Brute-force guessing targets the passphrase. Long, random strings raise the bar. Side-channel leaks target file names or previews. Hide names in the archive and avoid leaving unlocked copies. Phishing targets the user. Send passphrases through a separate channel and avoid reuse.

Troubleshooting

“The Recipient Can’t Open The Archive”

The tool may not read AES-ZIP or .7z. Suggest 7-Zip on Windows or Keka on macOS. As a fallback, make a standard ZIP with no encryption just to test transfer, then resend with the right mode.

“I Forgot The Passphrase”

There is no backdoor. Try a password manager history, a sealed paper note, or a recovery key if you set one. If the data is irreplaceable, keep the file and try again if the passphrase returns to you later.

“The File Size Grew A Lot”

Archives add headers and padding. Images or already-compressed files may not shrink. For many files, a disk image or a 7z archive with solid compression can help.

Why These Picks Work

The methods above are widely used and well tested. 7-Zip gives strong AES-256 and hides file names. GPG brings mature crypto with simple commands. Disk images on macOS mount and unmount cleanly, which keeps data locked while idle. Picking one shared method avoids guesswork across a team.

Last, the phrase you choose matters as much as the cipher. Long, random strings stand up to guessing far longer than short ones. If you want a quick reminder on how to encrypt a file with a password, think length first, then tool choice. A password manager helps you set and keep strong phrases without memorizing them.