How do I check from cmdline if a *.7z archive is encrypted?

  • Thomas

    Thomas - 2013-07-30

    In a batch script I want to code a procedure similar to the following pseudocode:

    If <currentarchive>.7z is encrypted then
    echo "Current archive is enrypted. Please enter password"
    7z decrypt -p<usepw> <currentarchive>.7z

    How do I check from cmdline if a *.7z archive is encrypted or not?
    The result should be returned as "1" or "0"


    Last edit: Thomas 2013-07-30
  • fernando

    fernando - 2013-07-30

    if interactive, why not simply...

    7z x archive.7z


    7zg x archive.7z
    • Shell

      Shell - 2013-07-30

      LOL, I haven't thought this way...

  • Shell

    Shell - 2013-07-30

    You should parse 7-Zip's own output and search for the information about encryption. A command for Windows may look as follows:
    for /f "tokens=1*" %%a in ('7z l <currentarchive>.7z ...') do if %%a==Method for %%c in (%%b) do if %%c==7zAES (echo 1) else echo 0
    You may improve this command according to your needs. Note that you will need Windows NT's command line extensions to be enabled (which is usually so). Also, you may run that command directly from the command line if you replace double percent signs with single ones.

    ... is an arbitrary name that will rarely or never coincide with the names of real files in your archives. Its purpose is to minimize the listing and thus speed up the for loop.

    By the way, I have seen a similar topic elsewhere in 7-Zip forums. Perhaps you will find more advice there.

  • Thomas

    Thomas - 2013-08-04

    Hmm, neither fernandos nor Shells answer is working.

    When I enter code for example as suggested

    7z x archive.7z

    in a batch script and the archive IS encrypted then a CmdPrompt popup appears
    asking me for the password. This is not what I want. I want t just to test if the archive is encrypted or not.

    Furthermore assume I have a huge archive (like 1 GB size) and I perform a command like

    7z x archive.7z

    then the archive would be decrypted (=I don't want encryption!) and it would last for minutes until it finishes (=I don't want this as well).

    So the question is still unanswered.

    Can I test ONLY from commandline (in batch scipt) if an archive is encrypted or not
    (without being prompted for a password and no decryption)?

  • Igor Pavlov

    Igor Pavlov - 2013-08-04

    7z l a.7z * -x!* -prrrrrrr
    1) if encrypted headers, you will get:
    Error: a.7z: Can not open encrypted archive. Wrong password?
    3) if unencrypted headers, and encrypted files, you will get:
    Method = .... 7zAES

    Last edit: Igor Pavlov 2013-08-04
  • Shell

    Shell - 2013-08-04

    I have forgotten that the archive may have encrypted headers. Try the following code (thanks to Igor, -x is much better than the ellipsis):
    set enc=2
    for /f "tokens=1*" %%a in ('7z l -pblabla -x!* <currentarchive>.7z ...') do if %%a==Method for %%c in (%%b) do if %%c==7zAES (
     set enc=1
    ) else set enc=0
    if %enc%==2 (
     echo Archive has encrypted headers
    ) else if %enc%==1 (
     echo Archive has encrypted files
    ) else echo Archive is not encrypted... or blabla is its password

  • Thomas

    Thomas - 2013-08-06

    Ok, thank you all. We are approaching a solution.
    I have an archive hhh.7z which is encrypted (including the header) with password hhh

    If I run now the following batch file then I got an error

    set enc=2
    The syntax of the command is incorrect

    Why? There must be still an error.

    I coded:

    set enc=2
    for /f "tokens=1" %%a in ('7z l -phhh -x! hhh.7z') do if %%a==Method for %%c in (%%b) do
    if %%c==7zAES (set enc=1) else set enc=0

    echo before interpretation
    if %enc%==2 (
    echo Archive has encrypted headers
    ) else if %enc%==1 (
    echo Archive has encrypted files
    ) else echo Archive is not encrypted... or blabla is its password

  • Shell

    Shell - 2013-08-06

    What operating system are you running? The code I suggested should run on Windows 2000 or above with command extensions enabled. I have checked Windows XP and Windows Vista (both x86) - no errors.

    By the way, your post has some typos:
    1) the asterisks are missing - they are interpreted as formatting symbols;
    2) there should be no newline before if %%c.
    I think it was that newline that caused the error.

    If you don't like set, you can rewrite the script as follows (though the variant with set is better):
    echo Analyzing archive hhh.7z...
    for /f "tokens=1*" %%a in ('7z l -phhh -x!* hhh.7z') do if %%a==Method for %%c in (%%b) do if %%c==7zAES (
      echo it has encrypted files
    ) else echo it is either not encrypted or encrypted with password hhh
    echo if no message about encryption appeared above, it has encrypted headers

    Last edit: Shell 2013-08-06
  • Thomas

    Thomas - 2013-08-07

    Thank you the script is running without crash now. As you guessed the added newline before

    if %%c

    was the culprit. Asterisks were hidden when I cut & past from my 64bit Win7 machine.

    But one more question:

    enc=2 should be outputted when I have an archive which has not only files encrypted but also filename (=headers).
    That means if I create an archive (through 7zip GUI) and tick the checkbox "Encrypt file names" then the full header is encrypted. Am I right?

    I ask because I never get enc=2 case.

    Or is full archive PLUS header encryption only possible through 7z cmdline?

    Currently I can only detect encrypted yes or no


    Last edit: Thomas 2013-08-07
  • Shell

    Shell - 2013-08-07

    I think that you are still specifying a valid password in the script. I have constructed my echo's carefully - the last one accounts for that possibility. Actually, it should be more informative:
    echo Archive is either not encrypted, or it has encrypted headers and the password is <whatever is specified after -r>

    The idea is to specify a knowingly invalid password in the -r switch. If the archive's header is not encrypted, the password will be ignored, and the if you have mentioned would detect encryption by the 7zAES word. If the archive's header is encrypted, then 7-Zip will fail, and you will know that.

    If you do not want to depend on the password, you may add a second check with a different password in the script:
    ) else set enc=0
    if %enc%==0 for /f "tokens=1*" %%d in ('7z l -pblah ...
    if %enc%==2 (

    Last edit: Shell 2013-08-07
  • Thomas

    Thomas - 2013-08-08

    Ok, now I understand....and it works now :-)

    Specifying a wrong (!) password....tricky.

    But the necessity to code it like this is rather awkward and unhandy.

    @Igor: I suggest to introduce a new cmdline flag for that purpose in the next release. Something like:


    which replaces this unusual, non-intuitive trick from "Shell".

    Thank you all

    Last edit: Thomas 2013-08-08

Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:

No, thanks