How To Send Encrypted Attachments That Recipients Can Open

The easiest solution is sending password-protected ZIP archives—all operating systems natively support creating and opening encrypted ZIPs without additional software. On macOS, use zip -e to create an encrypted archive; on Windows, right-click and select “Send to → Compressed (Zipped) folder” then set a password; on Linux, use the zip -e command. Share the password through a separate, secure channel, and the recipient can open it immediately using their built-in file manager.

The Problem with Traditional Encryption

PGP encryption has been the standard for decades, but it requires recipients to install software like Gpg4win, GPGTools, or browser extensions. For sending documents to lawyers, clients, family members, or colleagues who aren’t cryptography experts, this approach often fails. Recipients either lack the technical knowledge to set up encryption or simply refuse to install new software.

Modern alternatives like Signal or encrypted messaging apps solve this for text and small files, but they impose size limits and create metadata. You need solutions that work with any file size, don’t require account creation, and use tools the recipient already possesses.

Method 1: Password-Protected ZIP Archives

The most universally accessible approach uses password-protected ZIP archives. Every major operating system includes native support for creating and opening encrypted ZIP files:

Creating Encrypted ZIP on macOS

zip -e --password-archive secure documents.zip sensitive_file.pdf

The -e flag prompts for password entry interactively. For scripting:

zip -P "your-secure-password" -r documents.zip folder/

Creating Encrypted ZIP on Linux

zip -e -r documents.zip folder/
# or with a password in the command (less secure)
zip -P "password" -r documents.zip folder/

Creating Encrypted ZIP on Windows

PowerShell doesn’t have built-in ZIP encryption, but you can use 7-Zip which is commonly pre-installed or easily available:

# Using 7-Zip via command line
7z a -p"your-password" -mhe=on secure.zip sensitive_file.pdf

The -mhe=on flag encrypts filenames too, adding an extra layer of privacy.

Opening Password-Protected ZIP

Recipients simply double-click the ZIP file—Windows Explorer, macOS Finder, and most Android file managers automatically prompt for the password. iOS users can use the built-in Files app or any free ZIP utility.

Strengths:

Native support across all platforms
No software installation required for recipients
Handles large files efficiently
Widely understood format

Limitations:

ZIP encryption uses weaker algorithms (ZIPCrypto or AES-256 depending on tool)
Password must be communicated through a separate channel
No built-in key recovery or expiration

Method 2: Browser-Based Client-Side Encryption

Services like PrivateBin, Pastebin.run, or secure file sharing platforms encrypt files entirely in the browser before transmission. The server never sees the decryption key—it’s generated locally and typically shared via the URL fragment.

Using PrivateBin for Text Content

PrivateBin allows you to paste sensitive text, encrypt it client-side, and generate a link the recipient can open in any browser:

Visit a PrivateBin instance
Paste your sensitive content
Set a password if desired
Click “Send”
Share the generated URL

The recipient opens the link, enters the password if set, and views the decrypted content. No account, no software, no installation.

Browser-Based File Encryption Tools

Several services provide browser-based file encryption without server-side key exposure:

Firefox Send (self-hosted alternative): Though Mozilla discontinued the public service, you can self-host a similar solution using ` PrivateBin with file support or tools like Bitwarden Send`.

Python-based solution for developers:

# encrypt_file.py - Browser-decryptable HTML
from cryptography.fernet import Fernet
import base64

def create_decryptable_html(filename, data, password):
    key = base64.urlsafe_b64encode(password.ljust(32)[:32].encode())
    f = Fernet(key)
    encrypted = f.encrypt(data)

    html = f'''<!DOCTYPE html>
<html><head><title>{filename}</title></head>
<body>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js"></script>
<script>
function decrypt() {{
    const encrypted = "{encrypted.decode()}";
    const key = CryptoJS.enc.Utf8.parse("{password.ljust(32)[:32]}".padEnd(32, "0"));
    const decrypted = CryptoJS.AES.decrypt(encrypted, key);
    const blob = new Blob([decrypted.toString(CryptoJS.enc.Utf8)], {{type: "application/octet-stream"}});
    const url = URL.createObjectURL(blob);
    const a = document.createElement("a");
    a.href = url;
    a.download = "{filename}";
    a.click();
}}
</script>
<button onclick="decrypt()">Download File</button>
</body></html>'''
    return html

This generates a self-contained HTML file the recipient opens in any browser. They click a button to decrypt and download—no software installation needed.

Method 3: Self-Decrypting Archives

For Windows recipients, you can create self-decrypting executables using 7-Zip. The recipient runs the .exe, enters the password, and the contents extract automatically:

7z a -p"password" -sfx secure.exe folder/

Note: This method requires the recipient to run an executable, which raises security concerns in corporate environments. Only use this for trusted recipients.

Method 4: Cloud Storage with Client-Side Encryption

Services like Proton Drive, Tresorit, or Cryptomator provide zero-knowledge encryption where files encrypt locally before upload. Recipients access through browser or mobile apps:

# Using Cryptomator-style encryption concept
from cryptography.fernet import Fernet
import os

def encrypt_for_sharing(filepath, password):
    with open(filepath, 'rb') as f:
        data = f.read()

    key = Fernet.generate_key()
    f = Fernet(key)
    encrypted = f.encrypt(data)

    # Save encrypted file
    with open(filepath + '.encrypted', 'wb') as f:
        f.write(encrypted)

    # Save key separately (send through different channel)
    with open(filepath + '.key', 'w') as f:
        f.write(password)

The recipient uses the same service’s client to decrypt, which handles key management automatically.

Best Practices for Recipient-Friendly Encryption

Use Separate Channels for Passwords

Never send the encryption password through the same channel as the encrypted file. If emailing a ZIP, call the recipient with the password or use Signal. This prevents compromise of a single channel from exposing everything.

Choose Strong Passwords

For ZIP encryption, use passwords with sufficient entropy:

# Generate secure password
pwgen -s 20 1
# or with special characters
openssl rand -base64 24

Verify File Integrity

Include a checksum for verification:

sha256sum sensitive_file.zip > checksums.txt

Set Expiration When Possible

If using browser-based services, configure link expiration to prevent long-term exposure.

Comparison of Methods

Method	Recipient Needs	File Size	Security Level
Password ZIP	Native OS support	Unlimited	Moderate
Browser encryption	Browser only	Varies	High (client-side)
Self-decrypting EXE	Windows + trust	Unlimited	Moderate
Cloud encryption	Service app	Limited by service	High

Built by theluckystrike — More at zovo.one