Why does my Samsung export ask for a password?
Samsung sent your data as a set of zip files, and nothing will open them. Samsung's own My Files app refuses with a message about the file being password protected, and the built-in unzipper on Windows or a Mac either asks for a password that does not work or fails outright.
Can you get it back?
Yes, and nothing is damaged. Your export is complete and intact. It is encrypted, you have the password somewhere, and you need a tool that understands the particular kind of encryption Samsung used.
What actually happened
Every entry in every archive Samsung sends is encrypted, and the password arrives separately from the download rather than with it. Most of the archives use WinZip AES-256, which is a later addition to the zip format that plenty of unzippers still do not implement. At least one service still uses the older, weaker ZipCrypto.
That combination is why the error messages are so unhelpful. A tool that cannot do AES-256 often cannot even tell you that is the problem, so it reports the file as broken or simply refuses. Nothing is broken.
A Samsung service that holds nothing about you produces no archive at all, rather than an empty one. So an export with six archives in it when you selected twenty services has not failed and is not still coming. There is simply nothing in the other fourteen. This is the single most confusing thing about a Samsung export, and Samsung does not mention it anywhere.
How to fix it
Any unzipper that implements AES-256 will open these. Two free ones:
- 7-Zip on Windows
- Right-click the archive, choose 7-Zip, then Extract here, and give it the password when asked. 7-Zip has handled WinZip AES for years. The Windows built-in zip handler does not.
- Keka on macOS
- The Finder's own Archive Utility does not do AES-256. Keka does, it is free, and it will prompt for the password.
- If you cannot find the password
- It is in a separate message from Samsung, sent around the same time as the download link rather than in the same email. Search your inbox for messages from Samsung on the day the export arrived, including the spam folder. It cannot be recovered or reset from the archive itself, so if it is genuinely gone the only route is to request the export again.
How Muletto does it
Muletto opens encrypted Samsung archives directly, both the AES-256 ones and the legacy ZipCrypto one, and asks for the password when it meets the first locked entry. There is no unpacking step. It also shows which services produced an archive and which produced nothing, so you can see the shape of what Samsung actually sent.
Stopping it happening again
Save the password message somewhere before you download the archives. It is easy to file the download link and lose the mail with the password in it, and the two arrive separately.
Measured across a real export of nine archives and 57 entries, every one of them encrypted. All 57 were decrypted and read.