How to open a password-protected RAR on a Mac

Someone sends you a .rar file with its password, you double-click it and your Mac has no idea what to do. Nothing is broken: macOS opens ZIP files by itself, but it has never shipped a tool for RAR, and a protected archive makes things a little harder still. You need the right app, the exact password and, above all, confidence that the archive comes from someone you trust.

Why your Mac can’t open RAR files

Archive Utility, the tool macOS uses when you double-click a ZIP, doesn’t handle the RAR format. RAR is a proprietary format owned by RARLAB, the company behind WinRAR: its compression can’t be built into other programs without a commercial licence, while reading and extracting are allowed. That’s why RAR files open on a Mac through third-party apps, and why no app other than RARLAB’s own can create new ones.

Protected doesn’t always mean the same thing

A RAR can be protected in two ways, and knowing which one you have explains how the app behaves.

1. Only the contents are encrypted. You can see the file list, names and sizes; the password is needed when you extract or open a file.
2. The names are encrypted too. This is WinRAR’s “Encrypt file names” option (-hp on the command line): without the password you can’t even see what’s inside, and you’re asked for it as soon as you open the archive.

The encryption is serious. RAR 5 archives, the format introduced with WinRAR 5.0, use AES-256 with a PBKDF2-based key derivation; older RAR 4 archives use AES-128. WinRAR’s documentation is blunt: if the password is lost, not even the program’s author can extract the files. Passwords are case-sensitive.

How to open it on a Mac with Archiva

Several free apps can read RAR files. Archiva, free on the Mac App Store, also opens protected ones, including those with encrypted names, and does everything on the Mac without connecting to the internet.

1. Open the archive. Drag it onto the window or the Dock icon. If the names are encrypted, Archiva asks for the password straight away; otherwise it shows the file list.
2. Look before you extract. You can browse folders, search and preview photos, PDFs and text without writing anything to disk.
3. Extract everything or just what you need. Select the files and choose a destination, or drag them into the Finder: for protected files the password is requested on drop.
4. If the archive comes in parts, open any of them. archive.part1.rar, archive.part2.rar or archive.rar, archive.r00: with permission for the folder, Archiva finds the other volumes by itself.

The password stays in memory while the window is open and is never saved to disk. If you’d rather keep the archive in a format the Mac can also create, Convert to Another Format… turns it into 7z or ZIP and offers the same password again. The details are in the guide to encrypted archives.

When the password doesn’t work

1. Capitals, keyboard and spaces. Passwords are case-sensitive; check Caps Lock and the keyboard layout, and watch out for spaces copied along with the text from an email or chat.
2. A missing part. If extraction stops halfway, a volume is often missing: all parts must sit in the same folder, with their original names.
3. A damaged archive. An interrupted download produces errors that look like password problems. File › Verify Integrity checks the archive in memory and lists damaged or truncated files.
4. A lost password. There’s no way to recover it: the only option is brute-forcing combinations, which with a long password and AES-256 won’t finish in a human lifetime. Better to ask the sender again.

When a protected archive is a red flag

Passwords have a less innocent use too. An encrypted archive can’t be analysed without the key, which is why malware distributors use them to slip past email filters: the password is written in the message, or sent by text or chat. According to a Cofense analysis reported by TechRadar, protected archives are a small share of malicious ones, but they often evade detection. The same happens with downloads: a film or album locked inside a password-protected archive is one of the classic signs of fake files on torrent networks.

Before extracting, look at what’s inside. If an archive that should hold documents or photos contains an app (.app), an installer package (.pkg), a disk image (.dmg) or a script, don’t open it. For an app inside the archive, Archiva shows its signature and Apple notarization before anything reaches the disk.

Tip: if you’re the one sending confidential files, create a 7z archive with encrypted names and a long password, and send the password through a different channel from the file: the archive by email, the password by phone or in a message. Anyone who intercepts one of the two gets nothing.

What to keep in mind

RAR is still widespread, especially in files that come from Windows, and the Mac will keep needing an app to open it. The technical side is simple: a suitable reader, every part of the archive and the exact password. The part that needs care is another one: a protected archive asks for trust, and before typing the password it’s worth knowing who sent it and what it contains.