7z TECHNICAL

7z AES-256 Key Derivation

7z derives encryption material from a password, salt, and parameters encoded in the archive. The design intentionally makes each candidate expensive, so archive-specific settings and password clues matter more than a single published speed number.

The parameters live in the archive

A 7z encoded header carries the information a compatible decoder needs to derive keys and initialize AES. The iteration or cycle setting is not a universal constant across every archive, so a tool should read it rather than assume a fixed value.

When headers are encrypted, even the file list is protected by the same password-derived material. That is why a utility can appear unable to list files while still handling a healthy archive.

Cipher

AES-256

Inputs

Password + salt + parameters

Cost

Archive-specific

Metadata

Headers may be hidden

What this means for recovery

A candidate verifier can test a focused dictionary or mask, but the candidate space must come from real evidence. A random long password remains impractical regardless of whether the hardware is local or remote.

If a candidate seems to work, extract several files and check their integrity. A listing or one successful entry does not rule out damage elsewhere in a solid archive.

Avoid universal benchmark claims

Throughput depends on the archive parameters, implementation, GPU, thermal state, and verification mode. Report a measured sample with its conditions, or describe the factors qualitatively; do not present one number as a promise for every 7z file.

Use the archive's own parameters

A technical page is useful when it improves diagnosis. Hardcoded iteration counts and success percentages can send a user down the wrong path.

Frequently asked questions

Does every 7z file use the same number of iterations?
No. The archive stores parameters that a compatible decoder reads. Typical settings are not a substitute for inspecting the actual file.
Does AES-256 make a 7z password impossible to recover?
It makes blind guessing expensive, but a human-created password may still be found in a focused candidate set. Strong random passwords remain impractical.
Why does a benchmark differ between two 7z files?
Parameters, implementation, hardware, and verification work can differ. Compare like-for-like measurements from the same archive and tool.

Need a second opinion on your archive?

Run the free local analyzer first. If the archive is healthy and you are authorized to recover it, you can compare the evidence with a specialist's supported workflow.

Related archive guides