MISSION 04 · ZIP · RAR · 7Z · PDF · LOCAL

museum@recovery:~$ ARCHIVE RECOVERY LAB

Your file. Your computer. Real recovery.

Recover supported encrypted ZIP, RAR4, RAR5, 7Z archives and password-protected PDFs. Every password attempt runs locally, followed by verified decrypted downloads.

01 / LIVE RECOVERY

What your computer is doing

Set up recovery ↓

READY

Choose an encrypted file below, select methods, then start the local search.

Selected fileNo file selected
Search modeBlind search
Selected methods
Current search phase—
    Confirmed attempts
    —
    Measured attempts / second
    —
    Confirmed search progress0%
    Active search time
    —
    Estimated remaining time
    —
    CPUReady · local Workers— / s
    MODEBlind search · chosen dictionaries
    File and search options ↓

    Only confirmed work counts. An estimate describes the configured search, never a promised finding time.

    All search phases and exact accounting
    Average attempts / second
    —
    Configured candidates
    —
    Search phaseConfirmed / totalStatus

    Counts reflect real cryptographic rejection checks and full integrity checks for plausible candidates. Unreported or aborted work is not counted. Preparation and pauses are excluded from rates. CPU workers can complete ranges in a different order.

    02 / FILE & SEARCH

    Set up your recovery

    1. Choose a file
    2. Choose methods
    3. Start and observe

    01 Your encrypted file

    Authorized use only

    Please confirm before choosing or dropping a file. Password recovery is only intended for files you are legally authorized to access. Everything is processed locally.

    ZIP · RAR4/5 · 7Z · PDF · ZIP ≤32 MiB, other formats ≤8 MiB

    Archive metadata and encryption

    02 Your search methods

    Search methods

    Case, leetspeak, years and numeric suffixes are included automatically.

    03 Optional prior knowledge

    Blind brute force enumerates all 95 printable ASCII characters, lengths 1–24. This enormous space is generally infeasible. No password length is inferred from the file.

    04 Local compute path

    1–4 workers. Lower counts keep more resources available for other apps.

    CPU · genuine format-specific checks. GPU / Hybrid is not implemented for archive or PDF recovery.

    Only select files you own or are explicitly authorized to access.

    03 / MAKE & RECOVER

    Create a real test ZIP

    A harmless sample, genuinely encrypted on your device. Its known demonstration password is never given to the recovery engine. Try “password” with the common dictionary, or a one-digit password with your own explicit hints.

    No sample created yet.

    CPU, WebGPU availability and local diagnostics

    ZIP, RAR4/RAR5, 7Z and PDF password recovery runs in real CPU Workers. New formats use locally bundled WebAssembly. No format-specific WebGPU verifier or Hybrid engine is implemented. SHA-256 GPU benchmarks from the other lab do not apply here.

    Local technical diagnostics
    

    04 / UNDERSTAND & INSPECT
    Understand the work
    Compression and encryption
    Compression saves space. Encryption controls access. A ZIP file can use both, and a visible filename does not mean its contents are readable.
    Why AES searches cost more
    ZipCrypto is an older, weak encryption scheme with a cheap password-header check. A header match alone is never accepted: the lab decrypts and checks CRC-32. ZIP-AES uses PBKDF2-HMAC-SHA-1 with 1,000 rounds to derive keys, then verifies the authentication tag. Key stretching makes every guess more expensive.
    Candidate order and password strength
    Dictionary searches benefit from familiar words, case changes, leetspeak and predictable years. Longer random passwords can create an impractical search space. An exhausted selected search only rules out those candidates; it does not prove a password is unbreakable.
    Supported formats and honest limits
    This release supports ZIP ZipCrypto, WinZip AES-128/192/256 AE-1/AE-2 (Stored/Deflate), tested header-encrypted RAR4/RAR5, 7Z AES-256 with encrypted headers and LZMA2, and PDF opening-password Security Handler revisions R2/RC4-40, R3/RC4-128, R4/AES-128 and R6/AES-256. Matching passwords are independently confirmed against actual content before downloads. RAR/7Z support covers verified variants only; multi-volume, unusual codecs, unverified PDF revisions and unsupported encryption may be rejected. ZIP input ≤32 MiB; other input ≤8 MiB. A search does not guarantee that a long random password can be recovered. PDF owner-only permissions are not treated as opening-password recovery. Candidate enumeration is currently ASCII-based.
    Privacy and resource limits
    Input: ZIP at most 32 MiB; RAR/7Z/PDF at most 8 MiB; 256 entries; 16 MiB per extracted file; 32 MiB total output; compression ratio at most 200:1. Unsafe paths, duplicate output names and symlinks are rejected. Archives inside an archive are downloaded as ordinary files and never recursively opened or executed. Reset terminates Workers and releases download URLs. JavaScript garbage collection cannot guarantee secure memory erasure. Nothing is saved to localStorage, IndexedDB or a service worker. Offline recovery works once the page and shared dictionary assets are loaded.
    Dependencies and dictionary sources
    zip.js 2.8.15 · BSD-3-Clause; 7z-wasm 1.2.0 · LGPL-2.1+ and unRAR restrictions (notice, LGPL, unRAR); qpdf WASM 1.1.1 · Apache-2.0 (license). Dictionary sources and licenses.