Direct answer
WinRAR documents that RAR5 uses a PBKDF2 password-based key derivation process with HMAC-SHA256. RAR5 can encrypt file data with AES-256 and can hide archive names when header encryption is enabled.
What RAR5 adds
Password derivationPBKDF2 with HMAC-SHA256 makes password guessing more costly than simple legacy handling.
Password verificationA special verification value can detect wrong passwords without unpacking everything.
Header protectionThe “encrypt file names” option prevents casual viewing of the archive directory.
Compatibility costRecipients need software that understands RAR5 and its encryption options.
Password loss is data loss
Strong archive encryption has no safe backdoor. Keep an authorized recovery record and a protected backup before relying on an encrypted archive.
