What compression can achieve
ZIP uses DEFLATE, which combines a sliding-window search for repeated byte sequences with Huffman coding that assigns shorter codes to more frequent symbols. Both mechanisms exploit redundancy, so the compression you get depends almost entirely on how repetitive the data is.
Text, source code, logs, CSV and XML compress extremely well — often to 20 or 30 percent of their original size, because natural language and structured markup are highly repetitive. Uncompressed images such as BMP, and raw audio such as WAV, also compress meaningfully.
Already-compressed data does not. JPEG, PNG, MP3, MP4 and PDF have had their redundancy removed by their own encoders, so zipping them typically saves one or two percent and occasionally produces a slightly larger file, because the archive adds its own headers. Zipping a folder of photographs to save space is effort spent for nothing — the useful reason to zip them is bundling many files into one, which is a separate benefit.
ZIP encryption, and why the old kind is worthless
ZIP supports two encryption schemes and they are not comparable. The original ZipCrypto, from the late 1980s, is cryptographically broken: a known-plaintext attack recovers the key given a few hundred bytes of known content, and since archives frequently contain files with predictable headers, that condition is often met. Password recovery tools crack it in seconds regardless of password strength.
AES-256, supported by modern archivers, is sound, and with a strong password an AES-encrypted ZIP is genuinely protected. The problem is compatibility — some built-in extraction tools do not support it, so recipients may be unable to open the file.
In both cases, filenames and the directory structure remain readable without the password. A ZIP called redundancies-final.zip containing severance-letter-J-Smith.pdf discloses a great deal before anyone decrypts anything. If the names matter, nest the sensitive archive inside a second one.
Archive hazards worth knowing
Two attacks make handling untrusted archives risky. A zip bomb is a small archive that expands enormously — the classic example is 42 kilobytes expanding to petabytes through nested layers — exhausting disk or memory on whatever extracts it. Checking the reported uncompressed size before extracting is the basic defence.
Path traversal, sometimes called Zip Slip, exploits archives containing entries with paths like ../../etc/passwd. A naive extractor writes outside the target directory, potentially overwriting system files. Any code extracting untrusted archives must validate that each resolved path stays within the destination — this has produced vulnerabilities in a long list of widely used libraries.
More mundanely, ZIP's original filename encoding is ambiguous, so archives created on one system with non-ASCII filenames often extract with mangled names on another. Modern tools set a UTF-8 flag, but older ones do not, and there is no reliable way to detect the intended encoding afterwards.