Make a ZIP file

What goes into the ZIP, and what compresses

Files are compressed with deflate, the method every ZIP reader has understood since 1993, so the result opens with nothing installed on every Windows, macOS and Linux machine made this century. Names are written flagged as UTF-8, which is what lets accented and non-Latin filenames survive unzipping on macOS and Linux rather than arriving as mojibake — a surprisingly common failure with archives made by older tools.

Not everything compresses, and it is worth knowing which half you have. Text, documents, source code, spreadsheets and uncompressed images shrink dramatically — often to a third or less. JPEGs, PNGs, MP3s, MP4s, PDFs and other ZIPs are already compressed, and running deflate over them gains a fraction of a per cent while costing time; those are stored as they are rather than pointlessly re-processed. So a ZIP of fifty photographs is essentially the size of fifty photographs, and that is the format working correctly rather than failing. The reason to zip them is to send one file instead of fifty.

Each file is compressed independently, which is what lets a reader pull one item out of a large archive without touching the rest, and also why ZIP compresses less well than a .tar.gz or a 7z: repetition between files cannot be exploited. For a folder of near-identical documents the difference is substantial. For a mixed folder it is marginal.

There is no password protection here, deliberately. ZIP has two encryption schemes: the original ZipCrypto, which is broken badly enough that recovery tools crack it in seconds and which is still what many "password protect your ZIP" tools quietly use, and AES, which is sound but which no permissively-licensed method available to this page implements. Offering the broken one would be worse than offering nothing, because it looks like protection.

When you want something else

For a password, use 7-Zip and choose AES-256 — and tick "encrypt file names", because a standard encrypted ZIP leaves its catalogue readable, so anyone holding the file can see exactly what is in it without the password. That distinction matters more than people expect: the names of the documents are often as revealing as their contents.

For large sets, or for anything preserving structure, a desktop tool is the right answer — everything here is built in memory, so the total size is bounded by what the tab can hold, while zip -r archive.zip folder/ streams to disk and keeps permissions and symbolic links that a browser cannot read at all. And if the recipient can handle it, tar -czf or a 7z will produce a noticeably smaller file from the same material.