Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I would like to know how to extract contents of the password protected winrar file without the password. I have downloaded that WinRar file from a file hosting website. I only found out that it was password protected after I have download. And brute force attacking take ages. I would like to know is there any way to make it not a password protected file. One thing is that I found out that brute force attacking try every combination of words from the wordlist. I want to know is it possible to brute force attack the file with one by one password, not the whole combination, I mean one alphabet, or one number or one symbol at a time. And when one password is correct then only try another password. Can you understand it? Forgive me for my bad English.

share|improve this question
add comment

1 Answer

Why can't you simply ask the person who made that file to tell you the password?

No one knows how to decode an AES-encrypted file, such as password-protected WinRar files, without knowing the password.

As far as we know, the only way to decode AES-encrypted files is to somehow obtain the right password, and then use that password to decrypt the file.

In the movies, sometimes you see people "cracking" a password. They try all possibilities for the first letter, and then when they get the first letter right, they try all the possibilities for the second letter, etc. Eventually all the letters fill in, and the then the actor has the whole password.

It doesn't work like the movies with AES. AES passwords are all-or-nothing. If you get all-but-one of the letters right when typing in your password, you get exactly the same "failed" message as if you typed in a completely wrong password. (It's not possible to distinguish the random-looking gibberish from decoding with an almost-correct key from other random-looking gibberish from decoding with a completely wrong key). It's not possible to tell if one guess is "closer" to the right password than another guess.

(There are various "timing attacks" that, with some systems, can tell a researcher if one guess is "closer" to the right password than another, but they don't work on AES-encrypted files).

There are various "password unlocker" programs that will try one guess at a time until they stumble on the correct WinRar password. If the person who made the password-protected WinRar file picked a "strong" password -- for example, a passphrase of 8 words randomly chosen using dice from a short dictionary -- we expect that it will take more than a thousand years to stumble across the correct password. If that person picked a "very weak" password -- such as a single word in the dictionary, or a single dictionary word followed by a single digit, or a single word repeated 8 times, or a sequence of 5 completely random characters -- we expect that it will take less than a day for that program to run through all those very weak passwords and find the correct one.

EDIT: According to Wikipedia: WinRAR, the "method of encryption" used by WinRAR is the AES (Advanced Encryption Standard) with a 128-bit key.

I agree with Thomas. It's probably hopeless trying to crack it without knowing anything about the password. If you do find a way to crack AES, Bruce Schnier, the readers of crypto stackexchange, and every other cryptographer on the planet would be fascinated to find out, especially those cryptographers who work at the SVR, the NSA, and other intelligence agencies.

share|improve this answer
I just don't know the author who uploaded it. I found that file on a file hosting website and I downloaded it. The author is nowhere to be found. By the Way Could you explain me the methods of encryption of winrar files, Because my knowledge in cryptography is nearly zero. Thanks! –  Titan Zack Jul 19 '12 at 4:48
@TitanZack Sometimes hosting websites use their website name (e.g. www.foo.com) as passwords, for reasons I cannot fathom. You should look and see if there isn't any info on the website (or wherever you found the link to the file) about why the files are password-protected and what the password is before attempting a brute force that is probably hopeless. –  Thomas Jul 19 '12 at 8:14
The method of encryption is less important. The interesting part is what kind of KDF WinRAR uses, –  CodesInChaos Jul 21 '12 at 8:44
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.