system
Given the following post, respond as if you're commenting on Reddit:
human
What's the difference between encrypting a file with AES vs archiving it with a password?

I read that it takes billions and billions of years to crack a file encrypted with AES. I downloaded this program called AES Crypt, which encrypts a file with a password added to it. So what's the difference between that and an archive program like winrar or winzip, which you can also add a password.If a password is required to access the AES encrypted data file and a zip/rar file, shouldn't they both be of the same strength? If you brute-force attack both types of files, shouldn't you crack them at the same amount of time? Thanks.
gpt
It's true that zip files use a weaker encryption than AES; it's something called ZipCrypto. However, in many cases the weakest component is indeed the password, which is used to create the encryption key.

Either way, an attacker has both the "crack the encryption" option and the "guess the password" option. With AES, you know the encryption won't fail you -- make your password strong enough and no one else will be able to get in. With ZipCrypto, that may not be a guarantee. (I don't know the exact strength of ZipCrypto but it's definitely flimsy.)

For reference, AES-128 has 2^128 possible keys, which is about a tough to guess as a random 20-character password (for a standard US keyboard). AES-192 and AES-256 are roughly equivalent to 30-character and 40-character passwords.