shouldiuse.io

Categories

VERDICT

7-Zip Review

Worth it

Should I use 7-Zip?

Free, open-source Windows file archiver - 7-zip.org

· 1 day ago

If you just need a free, powerful Windows archiver, 7-Zip is still the default answer — keep it updated and download only from 7-zip.org. Skip it if you need vendor support, security SLAs, or strong archive encryption.

Confidence

Medium. Based on 20+ public sources including security advisories, Reddit threads, and vendor pages.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo formal support evidence found
  • Security posture

Pricing

Free

7-Zip

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Windows power users
  • Zero-budget IT teams
  • Bulk file archiving
  • Anyone ditching WinRAR

Not for

  • Anyone encrypting sensitive archives — 7z crypto is weak
  • Orgs needing vendor security pages, SLAs, or accountability
  • Security-strict enterprises that audit supplier posture
  • People who won't verify downloads against

Gotchas - check before you buy

high

Fake mirrors like spread backdoors — download only from.

high

Don't use 7z encryption for secrets; security communities call the crypto weak.

medium

Bundled copies age badly: Dell shipped an iDRAC module carrying an unpatched 7-Zip CVE.

low

No Windows 11 context-menu integration by default; users switch to NanaZip for that.

Pros and cons

Pros

  • Completely free — no paid tiers, ever.
  • Open source with a long track record.
  • Handles many formats, even unpacking .EXE and Flash files.
  • Standard free replacement for WinRAR among Windows users.
  • Widely trusted enough to appear in certified voting-system builds.

Cons

  • Multiple critical CVEs since 2024, some actively exploited.
  • 7z format's own encryption is considered weak.
  • No product security page — returns 404.
  • Community questions developer's security-response approach.
  • Lookalike download sites distribute malware.

Sources & method

- 11 sources - Active attack target: multiple critical CVEs since 2024 including exploited zero-days; no official security page (404).

official x2review x4security x5
  • CVE-2025-0411 Mark-of-the-Web bypass, Crafted archives bypassed Windows MotW protections.
  • Exploited zero-day deploying Smokeloader, Zero-day used in the wild to deploy Smokeloader malware (Feb 2025).
  • CVE-2024-11477 arbitrary code execution, Tracked Nov 2024 as allowing arbitrary code execution.
  • Symlink path traversal / RCE flaws, Critical symlink vulnerabilities enabled path traversal and remote code execution (Oct 2025).
  • CVE-2026-48095 heap buffer overflow, High-severity heap buffer overflow in versions 26.00 and prior (Jun 2026).

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 11

    Sources

  • Analyzed

  • Value for money: 5/5. Completely free, open source, no upsells
  • Ease of use: 4/5. Decades-standard Windows tool; Win11 context-menu friction
  • Feature depth: 4/5. Wide format support, even unpacks EXE files
  • Support quality. No formal support evidence found
  • Security posture: 2/5. Repeated exploited CVEs; no security page
  • 4.5/5 Capterra rating encryption software directory
  • $0 Price no paid tiers exist
  • Yes Free tier entire product is free and open source
  • 25+ years Age Guess: first released 1999

Pricing

7-Zip

Free

  • Full compression and extraction
  • Open source, all formats

Security

Active attack target: multiple critical CVEs since 2024 including exploited zero-days; no official security page (404).

  • CVE-2025-0411 Mark-of-the-Web bypassCrafted archives bypassed Windows MotW protections.⁴
  • Exploited zero-day deploying SmokeloaderZero-day used in the wild to deploy Smokeloader malware (Feb 2025).³
  • CVE-2024-11477 arbitrary code executionTracked Nov 2024 as allowing arbitrary code execution.
  • Symlink path traversal / RCE flawsCritical symlink vulnerabilities enabled path traversal and remote code execution (Oct 2025).⁵
  • CVE-2026-48095 heap buffer overflowHigh-severity heap buffer overflow in versions 26.00 and prior (Jun 2026).

What users say

Users treat 7-Zip as the free Windows archiving standard but criticize its weak 7z encryption and a low-trust developer posture.

“7-zip always seemed really shady, almost intentionally so”
Hacker News
“The 7-zip format has a (really) weak crypto implementation”
Reddit, r/security
“7-Zip is free of charge”
TrustRadius

Companies that use it

  • Dominion Voting Systems⁹
  • Dell10
Full analysis

Based on 20+ public sources including security advisories, Reddit threads, and vendor pages.

Free, excellent Windows archiver — but recurring exploited CVEs and fake download sites mean patch fast, download carefully.

Methodology

Based on 20+ public sources including security advisories, Reddit threads, and vendor pages.

Read how a report is made.

Sources

  1. 7-Zip vs Datto SIRIStrustradius.com
    review
  2. 7-Zip Trends — PC Maticpcmatic.com
    review
  3. Hackers Exploiting 7-Zip Zero-Day to Deploy Smokeloadercybersecuritynews.com
    security
  4. oss-security: 7-Zip Mark-of-the-Web Bypassopenwall.com
    security
  5. Critical 7-Zip symlink vulnerabilities1898advisories.burnsmcd.com
    security
  6. Reddit: weak 7z cryptoreddit.com
    review
  7. Reddit: 7-zip.ca spoof sitereddit.com
    security
  8. 7-Zip product security page (404)7-zip.org
    official
  9. EAC Dominion D-Suite test reporteac.gov
    official
  10. Dell iDRAC 7-Zip vulnerability advisorydell.com
    security
  11. How-To Geek: NanaZip alternativehowtogeek.com
    review

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.