The 7Z file (.7z)

A 7z file is an archive: one file that holds other files and folders, compressed. It's the native format of 7-Zip, the free, open-source archiver Igor Pavlov first released in 1999. People use 7z to ship large downloads, game mods, backups and software, because it usually makes smaller files than ZIP.

Compression is lossless: every file comes out exactly as it went in, checked with CRC-32. The gain over ZIP comes from three things:

• Better algorithms. LZMA and LZMA2 search a much larger window for repeated data than ZIP's Deflate, which only looks back 32 KB.
• Solid compression. Many files can be compressed as one stream, so repeats between files count too.
• Filters. BCJ2 and similar filters rearrange program code before compression, so .exe and .dll files shrink more.

7z also supports AES-256 encryption that can hide the file names, not just the contents. The cost is compatibility: Windows only opens 7z files by itself in recent versions of Windows 11, and Macs and phones usually need an app.

LZMA (Lempel–Ziv–Markov chain algorithm) is Igor Pavlov's own method. It finds repeated sequences, like Deflate, but in a dictionary that can be up to 4 GB, then encodes the result with a range coder that adapts to the data. It compresses slowly and decompresses quickly, and decompression needs little memory beyond the dictionary.

LZMA2 wraps LZMA in chunks. Chunks that don't compress are stored as they are, and large inputs can be split across CPU threads. Current 7-Zip uses LZMA2 by default; 7zz l -slt shows it as LZMA2: followed by the dictionary size.

In a solid archive, files are joined end to end and compressed as one stream, called a block. When files look alike, such as logs, source code or documents in the same template, the compressor finds repeats across them and the archive gets much smaller. 7-Zip makes solid archives by default.

The trade-offs:

• Extracting one file is slower. To reach a file near the end of a block, 7-Zip has to decompress everything before it in that block.
• Damage spreads. A corrupted byte early in a block can make every later file in that block unrecoverable.
• Updating is slower. Adding or deleting a file means recompressing the block.

7-Zip limits the damage by starting a new block every so often: the -ms switch sets the block size or the number of files per block, and -ms=off turns solid mode off. tar files compressed as a whole (.tar.gz, .tar.xz) are effectively one big solid block.

7z encrypts with AES-256. The key comes from your password run through SHA-256 many times: our samples show 7zAES:19, meaning 2^19 (524,288) rounds, which makes each password guess slow. Two settings matter:

Header encryption works because the whole table of contents is a stream like any other: 7-Zip compresses it, then encrypts it. In 7-Zip's Windows app it's the Encrypt file names box in the Add to Archive window. ZIP has no widely supported way to hide names, which is one reason people choose 7z for sensitive files.

Use ZIP when you don't know what the recipient has. Use 7z when size matters, or you want names hidden, and the recipient can install 7-Zip. RAR does similar things but can only be created with paid software. For backups on Linux or macOS, prefer tar with xz or gzip: 7z doesn't record file owners and groups.

• Windows 11: double-click to browse it, then Extract all. Support arrived in an update in late 2023, and version 24H2 added Compress to → 7z File. The built-in tool can't open password-protected archives; use 7-Zip for those, and for Windows 10.
• macOS: use a free app such as Keka or The Unarchiver, or the official command-line 7zz from 7-zip.org.
• Linux: 7z x archive.7z or 7zz x archive.7z to extract, 7z l to list, 7z a archive.7z folder to create, from your distribution's 7zip or p7zip package. Desktop archive managers such as File Roller and Ark open 7z files too.
• Phone: use an archive app, such as ZArchiver on Android or an unarchiver app from the App Store on iPhone and iPad.
• Programming: Python's py7zr and Java's Apache Commons Compress read and write 7z; libarchive reads it; Igor Pavlov's LZMA SDK has the LZMA code and a 7z decoder in C.

Useful 7-Zip switches: -mx=9 for maximum compression, -p to set a password, -mhe=on to encrypt names, -ms=off for a non-solid archive, -v100m to split into 100 MB parts (.7z.001, .7z.002 …).

• "Cannot open the file as archive" or "Unexpected end of data": usually an incomplete download. Unlike ZIP, the table of contents is at the end, so a cut-off 7z can't even be listed. Download it again and compare the size.
• Windows asks for a password it won't accept, or says the archive is invalid: the built-in tool doesn't support encrypted 7z files. Open it with 7-Zip.
• Only .7z.001 opens, or nothing does: it's a split archive. Put all parts in one folder and open the .001 file with 7-Zip; every part must be present.
• Extracting one small file takes ages: the archive is solid and the file sits late in a big block. Nothing is wrong; recreate it with smaller blocks if you do this often.
• "Unsupported method": the archive uses a method or filter your tool doesn't know, often from a newer 7-Zip. Update 7-Zip, or ask for a ZIP.

7z files carry the same risks as any archive. Listing one is safe; the risk is in what's inside and in how it's extracted.

• Malware past filters. Attackers like encrypted 7z files, especially with hidden names: a mail scanner can't see inside, and can't even see that there's an .exe.
• Path traversal. An entry named with ../ or an absolute path can write outside the target folder. Mainstream extractors strip or refuse such names; your own extraction code must check them, as with ZIP.
• Decompression bombs. A small 7z can expand to a huge size, and solid LZMA2 compresses repetitive data extremely well. Cap the output size when extracting untrusted archives.
• Bugs in the extractor. 7-Zip has had security flaws. CVE-2025-0411, fixed in 7-Zip 24.09 (November 2024), let files from an archive nested inside another skip Windows' Mark-of-the-Web warning, and was used in real attacks. CVE-2025-11001, fixed in 25.00, let crafted ZIP files with symbolic links write outside the target folder. Keep 7-Zip updated: most releases since 2024 list fixes.