Microsoft Excel documents can utilize three passwords:

  • Password to open
  • Password to modify
  • Protect sheet or Protect workbook

Password to Open

The Password to open requires a user to enter a password to view the document.

When the user sets a Password to open, the entire Microsoft Excel document is encrypted with the RC4 stream cipher.

Password to Modify

The Password to modify requires a user to enter a password to make changes to the document.

When a user sets a Password to modify, the password is stored inside the Microsoft Excel document. The password can be viewed or changed with a hex editor.

Protect Sheet or Protect workbook

The Protect sheet or Protect workbook password requires the user to enter a password to no longer protect the worksheet or the workbook.

When a user sets a Protect sheet or Protect workbook password, the 32-bit password hash is stored in the document. The password hash can be viewed or changed with a hex editor.

Applying Passwords in Microsoft Excel

To apply a Password to open or modify to a Microsoft Excel document, click click <File>, <Save As>, <Tools>, <General Options>. Then, select the desired encryption algorithm and the key length to use with that algorithm.

The supported algorithms are:

  • Weak Encryption (XOR)
  • Office 97/2000 Compatible
  • RC4, Microsoft Base Cryptographic Provider v1.0
  • RC4, Microsoft Base DSS and Diffie-Hellman Cryptographic Provider
  • RC4, Microsoft DH SChannel Cryptographic Provider
  • RC4, Microsoft Enhanced Cryptographic Provider v1.0
  • RC4, Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider
  • RC4, Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)
  • RC4, Microsoft RSA SChannel Cryptographic Provider
  • RC4, Microsoft Strong Cryptographic Provider

The default is “Office 97/2000 Compatible.” However, even Microsoft states that this is not recommended!

To apply a Protect sheet or Protect workbook password to a Microsoft Excel document, click <Tools>, <Protection>.

Microsoft Excel Password Recovery

It is possible simply to edit the Password to modify with a hex editor. It is also possible to edit the hash of the Protect sheet or Protect workbook password.

The Password to open can be attacked with a dictionary attack or a brute force attack.

Several programs, with widely varying capabilities, are available to help recover a lost Microsoft Excel password:

Additional Reading on Excel Password Recovery