Microsoft Excel documents can utilize three passwords:
- Password to open
- Password to modify
- Protect sheet or Protect workbook
Password to Open
The Password to open requires a user to enter a password to view the document.
When the user sets a Password to open, the entire Microsoft Excel document is encrypted with the RC4 stream cipher.
Password to Modify
The Password to modify requires a user to enter a password to make changes to the document.
When a user sets a Password to modify, the password is stored inside the Microsoft Excel document. The password can be viewed or changed with a hex editor.
Protect Sheet or Protect workbook
The Protect sheet or Protect workbook password requires the user to enter a password to no longer protect the worksheet or the workbook.
When a user sets a Protect sheet or Protect workbook password, the 32-bit password hash is stored in the document. The password hash can be viewed or changed with a hex editor.
Applying Passwords in Microsoft Excel
To apply a Password to open or modify to a Microsoft Excel document, click click <File>, <Save As>, <Tools>, <General Options>. Then, select the desired encryption algorithm and the key length to use with that algorithm.
The supported algorithms are:
- Weak Encryption (XOR)
- Office 97/2000 Compatible
- RC4, Microsoft Base Cryptographic Provider v1.0
- RC4, Microsoft Base DSS and Diffie-Hellman Cryptographic Provider
- RC4, Microsoft DH SChannel Cryptographic Provider
- RC4, Microsoft Enhanced Cryptographic Provider v1.0
- RC4, Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider
- RC4, Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)
- RC4, Microsoft RSA SChannel Cryptographic Provider
- RC4, Microsoft Strong Cryptographic Provider
The default is “Office 97/2000 Compatible.” However, even Microsoft states that this is not recommended!
To apply a Protect sheet or Protect workbook password to a Microsoft Excel document, click <Tools>, <Protection>.
Microsoft Excel Password Recovery
It is possible simply to edit the Password to modify with a hex editor. It is also possible to edit the hash of the Protect sheet or Protect workbook password.
The Password to open can be attacked with a dictionary attack or a brute force attack.
Several programs, with widely varying capabilities, are available to help recover a lost Microsoft Excel password:
- Elcomsoft Advanced Office XP Password Recovery
- AccessData Password Recovery Toolkit
- AccentSoft Excel Password Recovery
- xlcrack
Denis Gladysh
Here are a few important remarks about Password to Open.
1. It’s not required to search for the password set for Excel 97-2003 (with 40-bit encryption key). The password complexity does not matter because the document can be decrypted online
using Rainbow Tables and it will take a few minutes.
2. Choose programs
supporting video cards to increase the speed of searching passwords set
for Excel 2007-2013. Searching for passwords on GPU can differ greatly.