shred -u secret.tar.gz # Overwrites and deletes Encryption protects contents , not metadata . An attacker can still see backup.tar.gz.enc exists, along with its file size and timestamps. If file size is sensitive, you can pad the archive with dummy data (advanced). 5. Windows Native Zip is Weak If you use Windows' built-in "Send to > Compressed folder" and add a password, it still uses the broken ZipCrypto (not AES). Always use 7-Zip, WinRAR, or the command line for real AES-256 on Windows. Advanced: Automating with Shell Scripts If you regularly need to password-protect tar.gz files, create a script secure-tar.sh :
Attempting to "protect" a tar.gz file by simply renaming it or hoping that compression obfuscates the data provides . Compression is about size, not secrecy. password protect tar.gz file
tar czf - "$SOURCE_DIR" | openssl enc -aes-256-cbc -salt -out "$OUTPUT_BASE.tar.gz.enc" shred -u secret