There is a whole industry selling software to protect data: full-disk encryption, rights management, key servers, the works. Almost none of it lives in an ordinary home or a two-person office. At home people protect a file the way the application in front of them allows. They type a password into WinRAR, or into Word, or into a PDF, and move on with the day. Here is the thing: none of those applications is a security product. WinRAR is a compression tool, Word is a word processor, Acrobat is a document viewer. They just happen to carry enough encryption to be used as a lock, and that is exactly why people use them. It is right there, it is free, and it needs no IT department.

RAR encryption has an unusual reputation: in more than twenty years there has been no practical attack against the cipher, no implementation flaw worth the name, and none of the shortcuts that collapsed certain other archive formats in minutes. Yet until recently, nobody could say how fast a RAR password could actually be attacked. The answer was always “it depends”, technically true but not something one could put in front of a client or plan a recovery job around.

The recent update to Elcomsoft Advanced Archive Password Recovery, our go-to tool for breaking passwords to encrypted archives, brought compatibility with RAR5 and 7Zip formats, and enabled multithreaded dictionary attacks. Which archive formats are the most secure, and which ones are the toughest to break? Read along to find out!