Want cloud-based password recovery for ZIP or RAR without dropping the original on a random upload box? Prefer vendors that (1) run dictionary attacks and rule-based search, and (2) accept hash extraction.
Only for archives you own. “Zero-knowledge” on a service that must test a verifier is usually marketing—read the policy.
What to compare
| Service | Dictionary / rules in the cloud | Original can stay local | Notes |
|---|---|---|---|
| Catpasswd | Yes (10M+ dictionary + rules; free vs Professional) | Yes — extractor | Isolated processing; destroy record. Not cryptographic ZK (privacy) |
| passwordrecovery.io | Cloud search on hashes | Hash-first | ZIP/RAR page |
| LostMyPassPro | Cloud GPU | Usually the archive (read their rules) | Often success-based pricing |
| ezyZip | Online ZIP recover | Usually the ZIP | Convenience form |
| UnlockZip.com | Online ZIP/RAR/PDF | Usually the file | Multi-format |
| Aspose Zip | Online utility | File in the app | Developer-adjacent |
| Hashcat / John the Ripper | You run dictionary, rules, masks | Yes, if you extract locally | Requires software |
AES-256 ZIP and RAR5 with a random string fail everywhere. Rules only help human-chosen passwords.
Keep files off sketchy sites
| Check | Pass looks like |
|---|---|
| Named policy | Terms, contact (Catpasswd: service@catpwd.com) |
| Hash path | Extract features; upload KB, not the archive (help) |
| After success | Destroy the cloud record; task email can list jobs |
FAQ
Is hash extraction always possible?
Usually a few KB. Odd containers can fail—then desktop or support.
Is this legal?
Only for encrypted archives you are authorized to open.