How to Password Protect ZIP Files (Mac/Windows) and Secure Alternatives to Password Sending (PPAP Countermeasures)

We explain the dangers of password-protected ZIPs (commonly known as PPAP), which were a standard in file exchange, the movement to abolish them, and the latest best practices for secure file sharing and transmission as alternatives.

Why Are Password-Protected ZIPs (PPAP) Prohibited?

The method of "sending a password-protected ZIP file by email and sending the password in a separate email immediately after" (commonly known as PPAP), which had long been a custom in the Japanese business scene, is now being completely abolished by the government and many large companies. The main reasons are as follows.

No security meaning: If the email route is wiretapped, both the ZIP file and the password email are stolen at the same time, making the defense level virtually zero.
Bypasses malware inspections: Encrypted ZIP files cannot be inspected by email servers' virus checking systems (anti-virus software), making them a breeding ground for malware infections like Emotet.

Goodbye PPAP! Modern Secure Alternatives for File Sharing

To deliver important data safely and efficiently, using the following methods instead of ZIP encryption is the current best practice.

Cloud storage link sharing: This method involves uploading the file to cloud storage such as Google Drive, OneDrive, or Box, and sending a shared link (URL) with an "expiration date" or "download permissions" set to the recipient. This is currently the most recommended.
Using a secure file transfer service: Use a dedicated file transfer service where the transmission route is encrypted and the file is automatically deleted after downloading.
Direct transmission via chat tools: Exchange files directly within a closed environment where communication is encrypted from the start and only authenticated users are present, such as Slack or Microsoft Teams.

Frequently Asked Questions

Q. If I absolutely must create a password-protected ZIP, how do I do it on a Mac?

A. You cannot create a password-protected ZIP using standard Mac features. You need to use the "zip -e" command from the Terminal or use a dedicated third-party app (such as Keka).

Q. Is it safe to communicate the password by phone or SMS instead of sending it in another email?

A. Yes, in terms of dispersing the routes (out-of-band communication), the security strength increases. However, since it increases the hassle for the recipient, migrating to cloud storage sharing is still recommended.