Skip to content
RareExplorerRAR & ZIP knowledge base

RAR Files

What Is RAR Encryption?

RAR encryption scrambles the contents of an archive using AES, unlockable only with the correct password. For the extraction-focused version of this topic, see [password-protected RAR files](/password-protected-rar-files).

RareExplorer Editorial TeamPublished September 3, 2026

When you set a password while creating a RAR archive, WinRAR encrypts the file data using AES, a widely used and well-vetted encryption standard. RAR5 archives use AES-256; RAR4 archives use AES-128. See RAR5 vs RAR4 for how the two formats compare more broadly.

Encrypting file names

By default, setting a password encrypts the contents of the files but may leave the list of file names inside the archive readable without a password. WinRAR has a separate checkbox, usually labeled "Encrypt file names," that also scrambles the archive's internal file listing so nobody can see what's inside without entering the password first — not even the names.

Password only vs password + encrypted file names
OptionFile contentsFile names visible without password?
Password set, file names not encryptedEncryptedYes
Password set, "Encrypt file names" checkedEncryptedNo

Password vs the archive header

The password protects the encrypted data itself; it's checked against the archive when you try to extract. There's no way to recover a forgotten password from the archive, since the whole point of AES encryption is that it can't feasibly be reversed without the correct key. WinRAR does not store the password anywhere retrievable, and there's no vendor-side password reset.

What encryption does not protect

  • The archive's file size and the fact that a RAR file exists at all — these are visible to anyone with file access, encrypted or not.
  • Metadata outside the archive, such as the file name of the .rar file itself, its creation date, or where it's stored.
  • Data once it has been extracted and decrypted — encryption only protects the file while it remains inside the archive.
  • Against a weak, guessable password — AES strength doesn't help if the password itself is easy to guess.

For setting or entering a password on a real archive, see password-protected RAR files. If extraction is failing on a password-protected archive for reasons unrelated to the password itself, check RAR extraction fails.

Frequently asked questions

Is RAR encryption actually secure?

AES-256 (RAR5) and AES-128 (RAR4) are both strong, standard encryption algorithms. Security in practice depends heavily on choosing a strong, non-guessable password.

Does setting a password automatically hide the file names?

Not necessarily — you need to separately enable "Encrypt file names" when setting the password, or the file listing may remain visible.

Can WinRAR recover a forgotten archive password?

No. There is no built-in password recovery, since the encryption is designed specifically to prevent that without the correct password.

Does encrypting a RAR file hide that it exists?

No. The file itself, its name, size, and location remain visible to anyone with access to where it's stored; only the contents (and optionally file names inside it) are encrypted.

Is RAR encryption different from ZIP encryption?

Yes, in strength and implementation. Many ZIP tools use weaker legacy encryption by default, while RAR (especially RAR5) uses full AES. See [ZIP vs RAR](/zip-vs-rar) for a broader comparison.

WinRAR is a trademark of its respective owner. RareExplorer is an independent resource and is not affiliated with or endorsed by RARLAB or win.rar GmbH. Read our editorial policy to see how this page was researched.