Encrypting an archive with AES-256 protects the contents against anyone without the password. It does not protect file names unless header encryption is enabled, and it does not protect you from a weak password.
What changed in recent builds
Modern releases derive the key with PBKDF2 using HMAC-SHA256, which makes brute-force attempts against a stolen archive far more expensive than the old SHA-1 based derivation. Archives created before the change still open, but consider recreating long-lived archives with the new defaults.
Header encryption
Without it, someone who intercepts the archive sees the folder tree and every file name. That is often enough to guess what matters. Enable header encryption for anything client-related, then confirm that the file list requires the password to display.
Password handling
- Do not put passwords directly in scripts or scheduled tasks.
- Never send the password in the same email as the archive.
- Prefer long passphrases over short complex strings; length beats symbol soup.
- Rotate the password when someone who knew it leaves the project.
Limits worth knowing
The archive is only as safe as the machine that created it. If malware runs with your user rights, it can read the password from memory. Encrypting an archive is protection in transit and at rest, not a substitute for an endpoint security baseline.