@@ -311,25 +311,23 @@ download_backup() {
 }
 
 _extract_archive() {
-    # Check if archive is a ZIP file (either unencrypted or testable without password)
-    if unzip -t "${TMP_ARCHIVE}" &>/dev/null; then
+    # Check if file is a ZIP archive (starts with PK magic bytes or passes unzip -t)
+    if [[ "$(head -c 2 "${TMP_ARCHIVE}" 2>/dev/null)" == "PK" ]] || unzip -t "${TMP_ARCHIVE}" < /dev/null &>/dev/null; then
+        local unzip_cmd=(unzip -o)
         if [[ -n "${BACKUP_PASS}" ]]; then
-            unzip -o -P "${BACKUP_PASS}" "${TMP_ARCHIVE}" -d /
-        else
-            unzip -o "${TMP_ARCHIVE}" -d /
+            unzip_cmd+=(-P "${BACKUP_PASS}")
         fi
-    # If unzip -t fails but password is provided, try extracting with password
-    elif [[ -n "${BACKUP_PASS}" ]] && unzip -o -P "${BACKUP_PASS}" -t "${TMP_ARCHIVE}" &>/dev/null; then
-        unzip -o -P "${BACKUP_PASS}" "${TMP_ARCHIVE}" -d /
-    # Check magic bytes for ZIP header (PK)
-    elif [[ "$(head -c 2 "${TMP_ARCHIVE}" 2>/dev/null)" == "PK" ]]; then
-        if [[ -n "${BACKUP_PASS}" ]]; then
-            unzip -o -P "${BACKUP_PASS}" "${TMP_ARCHIVE}" -d /
-        else
-            if ! unzip -o "${TMP_ARCHIVE}" -d /; then
-                echo "ZIP extraction failed. Password may be required (-p <password>)." >&2
-                return 1
+        unzip_cmd+=("${TMP_ARCHIVE}" -d /)
+
+        # Redirecting stdin from /dev/null ensures unzip never hangs waiting for password input
+        if ! "${unzip_cmd[@]}" < /dev/null; then
+            echo "ZIP extraction failed." >&2
+            if [[ -z "${BACKUP_PASS}" ]]; then
+                echo "The backup file appears to be password-protected. Please pass the password using: -p <password>" >&2
+            else
+                echo "The provided password (-p) may be incorrect." >&2
             fi
+            return 1
         fi
     else
         tar -xzpf "${TMP_ARCHIVE}" -C /