How to remove Excel passwords (all 6 types)

There is nothing more frustrating than finding out a previous employee has used passwords to protect an Excel file, and it turns out nobody else knows the password. Or maybe it’s worse when it’s your file, your password and you’ve forgotten it. Either way… you’re stuffed! However, before you give in, let me share some ideas on how to remove Excel passwords with VBA.

By the way, if you’re not familiar with VBA or find these methods too difficult, you can try a simpler solution. Password-Find is a paid Excel password remover.

Table of Contents

Setting different types of passwords

• File open passwords
• File modify passwords
• Worksheet protection passwords
• Allow edit ranges passwords
• Workbook protection passwords
• VBA project passwords

Removing each type of password

• Crack the file open password (encrypted)
• Crack the modify file password
• Crack the allow edit ranges password
• Crack the worksheet and workbook passwords
• Remove XML passwords manually
• Remove XML passwords with VBA
• Crack the VBA project binary password with a macro

Conclusion

The download includes a free Excel password remover. Please see the sections below for full details on how to use the tool.

WARNING! – When messing around with password removal, it is easy to make files unreadable, so make sure you back up before doing anything. After all, there is no point in cracking a password, if the file can’t be viewed afterward.

Before we even start discussing how to remove passwords, we need to understand the different types of passwords within an Excel file. The removal approach will vary for each type.

Setting different types of passwords

There are six different passwords within Excel:

• File open
• File modify
• Workbook protection
• Worksheet protection
• Allow edit ranges
• VBA project

Each of them is applied differently and serves a different purpose. Let’s look at each in turn.

File open passwords

The file open password prevents an Excel workbook from opening until the password is entered.

To set a file open password in Excel:

1. Click File > Save As > More Options…
   
2. Next, in the Save As dialog box, click Tools > General Options…
3. The General Options dialog box appears. Enter a password in the password to open box, then click OK.
   .
4. In the Confirm Password window, re-enter the password and click OK.
   
5. Finally, enter a file name and click Save in the Save As dialog box.
   

The file open password has now been set. A user cannot open the workbook until the password has been entered.

Warning Message

Did you notice the warning message which appeared when setting the password?

Caution: If you lose or forget the password, it cannot be recovered. It is advisable to keep a list of passwords and their corresponding workbook and sheet names in a safe place. (Remember that passwords are case-sensitive.)

This is good advice for file open passwords as they cannot be easily recovered.

File modify passwords

The file modify password prevents the workbook from being changed until a password has been entered. Some of the steps are the same as the file open password, but they are repeated here for completeness.

1. Click File > Save As > More Options…
   
2. The Save As window appears, click Tools > General Options…
3. The General Options box appears. Enter a password in the password to modify box, then click OK.
4. In the Confirm Password window, re-enter the password and click OK.
   
5. Finally, click Save on the Save As dialog box.
   

The File Modify password has now been set. A user can open the workbook, but it is set as read-only unless they enter the password.

Warning Message

Did you notice the warning message this time?

Caution: Password to modify is not a secure feature. This document is protected from unintentional editing. However, the document is not encrypted. Malicious users can edit the file and remove the password.

Did you see the difference in tone of the warning message? Even Microsoft recognizes that this password is not secure. We will cover how to remove this password later in the post.

Worksheet protection passwords

Worksheet protection passwords prevent specific cells from being changed. A user can open and interact with the worksheet but is restricted in the activities they can do.

1. Start by setting the lock property of a cell or range of cells. Select some cells then click Home > Format > Format Cells from the ribbon (or the shortcut is Ctrl + 1)
2. The Format Cells dialog box opens. Select the Protection tab, tick or untick the Locked option as required, then click OK.
   
3. To apply the protection, click Review > Protect Sheet.
4. The Protect Sheet window opens. Enter a password, and use the tick boxes to set the protection to be applied, then click OK.
5. In the Confirm Password window, re-enter the password and click OK again.
   

Done. The worksheet is now protected. If a user tries to make changes to a locked cell, an error message appears:

Warning Message

Depending on your version of Excel, there are different warning messages when setting the password.

Older versions:

Caution: If you lose or forget the password, it cannot be recovered.  It is advisable to keep a list of passwords and their corresponding workbook and sheet names in a safe place. (Remember that passwords are case-sensitive.)

Newer versions:

Sheet protection helps protect accidental edits.

Previously the message was the same as the file open password. However, this has been changed to a softer warning message. Since these passwords can easily be removed, the softer message is more accurate.

Allow edit ranges passwords

Allow edit ranges enables defined ranges to be edited by specific uses or where a password is provided.

To set up an allow edit range:

Click Review > Allow Edit Ranges.

This launches the Allow Edit Ranges dialog box.

Click New to launch the New Range dialog box

In here, we can set the title, range and password for the range, then click OK.

In the Confirm Password box, re-enter the password, and click OK again.

The password is not yet applied to the range. The protection is only applied when the worksheet protection is active.

When trying to edit a value in the Allow Edit Range on a protected worksheet, we see the box to enter the password.

Warning Message

The warning message is the same as the file open password.

Caution: If you lose or forget the password, it cannot be recovered. It is advisable to keep a list of passwords and their corresponding workbook and sheet names in a safe place. (Remember that passwords are case-sensitive.)

However, this password can easily be removed as we will see later in this post.

Workbook protection passwords

Workbook protection is applied in a similar way to worksheet protection, but with fewer options. It prevents users from changing the structure of a workbook, such as creating or renaming worksheets.

1. Click Review > Protect Workbook from the ribbon.
   
2. The Protect Structure dialog box opens. Enter a password, then click OK.
   
   Note: Prior to Excel 2013, both the Structure and Window options were available. Due to the Single Document Interface introduced in Excel 2013, the Windows option is no longer relevant and greyed out.
3. In the Confirm Password window, re-enter the password and click OK.
   

The workbook structure is now protected.

Warning Message

The warning message when re-entering the password is the same as the file open password.

Caution: If you lose or forget the password, it cannot be recovered. It is advisable to keep a list of passwords and their corresponding workbook and sheet names in a safe place. (Remember that passwords are case-sensitive.)

This message implies it has high security. However, this just isn’t true. As we will see later in this post, we can easily remove this password (it’s not as secure as Microsoft make it seem).

VBA project passwords

VBA project passwords prevent users from viewing or changing the code of a VBA Project.

1. In the Visual Basic Editor window, click Tools > VBA Project Properties…
2. The VBA Project – Project Properties window opens. Select the Protection tab, tick the Lock project for viewing, enter and confirm a password, then click OK.

The VBA project is now protected. Close and re-open the workbook. When expanding the VBA project, the user is presented with a box to enter the password.

Removing each type of password

Whilst we have considered six different types of passwords, a standard Excel file format handles these in only three ways:

• XML file code – This means the file is built using mostly code written in an XML structure. All you need is bit of knowledge we can edit XML code ourselves; as easy as editing text.
• Encryption – From Excel 2007, Microsoft’s level of protection for opening files increased significantly. When saving a file with the file open password, Excel applies encryption to the code.
• VBA Project binary – VBA Projects are stored as binary files within the Excel file format structure. The passwords, or the encrypted versions of those passwords are stored within the VBA binary file.

The remainder of this post only covers the XML based file types which are the .xlsx, .xlsm and .xlam files.

Since the passwords are stored in different ways, the method of removing them is also different.

Crack the file open password (encrypted)

For this first password method, it’s bad news. The only way I know to open one of these files is through a brute-force attack. This means trying every combination of every letter until the password is identified.

Just using numbers, uppercase and lowercase letters, an 8-digit password has 218,340,105,584,896 possible character combinations. Therefore, to speed things up, any software that uses this approach tends to focus on known patterns and word combinations. The more complex the password, the longer it takes to crack.

If you’re looking for an Excel password cracker to deal with these types of passwords, then you will likely require third-party software tools and services that can perform a brute-force attack at high speed. 

I have tried one of these services in they past, and had good results, try them out: https://www.password-find.com. They claim to be able to find 80% of passwords, which is pretty good going.

Crack the modify file password

The truth is, we don’t even need an Excel password remover for the file modify password. The password can be removed by re-saving the file with a new name.

That’s it. It pretty much serves no security purpose. Nice and simple.

Crack the allow edit ranges password

The allow edit ranges password is only applied when the worksheet is protected. If the worksheet is unprotected we can manually delete each range.

Therefore, provided we can crack the worksheet protection, we are able to remove this.

Crack the worksheet and workbook passwords

As noted above, Excel files are just text files that are written in a specific format, which Excel can interpret. So, if we can edit the text, we can remove the password.

Excel does not store the password itself within the file. Instead, it uses an algorithm to create an adjusted code; then it stores the adjusted code within the file.

Any password we enter is processed through the same algorithm. If that algorithm creates the same result, then it follows that it must be the same password, and Excel allows us to edit the worksheet or workbook.

Thankfully, we do not have to try a brute-force attack. As noted above, we can simply edit the code.

Crack the workbook and worksheet passwords manually

If you think that you need software to remove Excel passwords, you will be surprised by this method. All it needs is a text editor, like Notepad.

I keep talking about the XML file and the file structure; let’s have a look at it. You’ll see it’s not too scary.

This method can corrupt a file. So, before trying this, make sure you back up the file.

1. Make sure the file extensions are visible on your computer. On any Windows folder, click View > Options.
2. In the Folder Options dialog box, click the View tab, remove the tick from hide extensions for known file types, then click OK.
   
3. It is now possible to see the .xlsx file extension. Rename the file to include the .zip extension.
   
4. Open the zip file, then navigate to the \xl\workbooks.xml file. The highlighted section below shows where the modify and workbook protection passwords are coded:
5. 
6. The file modify password starts with <fileSharing and ends with the next />
   The workbook protection password starts with <workbookProtection and ends with the next />
   Next, navigate to \xl\worksheets\sheet1.xml file in the zip file. The highlighted section below shows where the allow edit ranges and worksheet protection password are coded:
   
   The worksheet protection password starts with <sheetProtection and ends with the next />
   The allow edit ranges passwords start with <protectedRanges> and end with </protectedRanges>
   There will be a separate .xml file for each sheet.
7. Save the sheets and workbook XML files outside of the zip folder.
8. Open the files with a text editor. Then find and remove the sections of code highlighted above.
9. Save the XML files, then copy them back into the zip folders in the same locations.
10. Rename the file to restore the original the .xlsx, .xlsm or .xlam file extension.

Note: For this to work. We need to adjust the XML files, then insert them, back into the zip folder in the same location. Don’t unzip the folder completely, as the zipping and unzipping process can make the Excel file unusable.

If you open the workbook, the passwords we removed will no longer exist.

Crack the workbook, worksheet and modify passwords with a macro

The manual method, might take a bit of practice. Alternatively, we can use a macro to perform the same steps automatically.

The following is my VBA code for cracking Excel passwords. It may not be the best tool available, but based on feedback I’ve received, it has successfully helped thousands of users.

The download file already includes this macro and can be used to remove Excel passwords for workbook, worksheet, allow edit ranges and modify scenarios.

Close the file with the password to be removed.

Open a new Excel workbook and copy the following code into a standard module within the Visual Basic Editor.

Sub RemoveProtection()

Dim dialogBox As FileDialog
Dim sourceFullName As String
Dim sourceFilePath As String
Dim sourceFileName As String
Dim sourceFileType As String
Dim newFileName As Variant
Dim tempFileName As String
Dim zipFilePath As Variant
Dim oApp As Object
Dim FSO As Object
Dim xmlSheetFile As String
Dim xmlFile As Integer
Dim xmlFileContent As String
Dim xmlStartProtectionCode As Double
Dim xmlEndProtectionCode As Double
Dim xmlProtectionString As String

'Open dialog box to select a file
Set dialogBox = Application.FileDialog(msoFileDialogFilePicker)
dialogBox.AllowMultiSelect = False
dialogBox.Title = "Select file to remove protection from"

If dialogBox.Show = -1 Then
    sourceFullName = dialogBox.SelectedItems(1)
Else
    Exit Sub
End If

'Get folder path, file type and file name from the sourceFullName
sourceFilePath = Left(sourceFullName, InStrRev(sourceFullName, "\"))
sourceFileType = Mid(sourceFullName, InStrRev(sourceFullName, ".") + 1)
sourceFileName = Mid(sourceFullName, Len(sourceFilePath) + 1)
sourceFileName = Left(sourceFileName, InStrRev(sourceFileName, ".") - 1)

'Use the date and time to create a unique file name
tempFileName = "Temp" & Format(Now, " dd-mmm-yy h-mm-ss")

'Copy and rename original file to a zip file with a unique name
newFileName = sourceFilePath & tempFileName & ".zip"
On Error Resume Next
FileCopy sourceFullName, newFileName

If Err.Number <> 0 Then
    MsgBox "Unable to copy " & sourceFullName & vbNewLine _
        & "Check the file is closed and try again"
    Exit Sub
End If
On Error GoTo 0

'Create folder to unzip to
zipFilePath = sourceFilePath & tempFileName & "\"
MkDir zipFilePath

'Extract the files into the newly created folder
Set oApp = CreateObject("Shell.Application")
oApp.Namespace(zipFilePath).CopyHere oApp.Namespace(newFileName).items

'loop through each file in the \xl\worksheets folder of the unzipped file
xmlSheetFile = Dir(zipFilePath & "\xl\worksheets\*.xml*")
Do While xmlSheetFile <> ""

    'Read text of the file to a variable
    xmlFile = FreeFile
    Open zipFilePath & "xl\worksheets\" & xmlSheetFile For Input As xmlFile
    xmlFileContent = Input(LOF(xmlFile), xmlFile)
    Close xmlFile

    'Manipulate the text in the file
    xmlStartProtectionCode = 0
    xmlStartProtectionCode = InStr(1, xmlFileContent, "<sheetProtection")

    If xmlStartProtectionCode > 0 Then

        xmlEndProtectionCode = InStr(xmlStartProtectionCode, _
            xmlFileContent, "/>") + 2 '"/>" is 2 characters long
        xmlProtectionString = Mid(xmlFileContent, xmlStartProtectionCode, _
            xmlEndProtectionCode - xmlStartProtectionCode)
        xmlFileContent = Replace(xmlFileContent, xmlProtectionString, "")

    End If

    'Remove Range Protection
    xmlStartProtectionCode = 0
    xmlStartProtectionCode = InStr(1, xmlFileContent, "<protectedRanges")

    If xmlStartProtectionCode > 0 Then

        xmlEndProtectionCode = InStr(xmlStartProtectionCode, _
            xmlFileContent, "</protectedRanges>") + 18 '"</protectedRanges>" is 18 characters long
        xmlProtectionString = Mid(xmlFileContent, xmlStartProtectionCode, _
            xmlEndProtectionCode - xmlStartProtectionCode)
        xmlFileContent = Replace(xmlFileContent, xmlProtectionString, "")

    End If

    'Output the text of the variable to the file
    xmlFile = FreeFile
    Open zipFilePath & "xl\worksheets\" & xmlSheetFile For Output As xmlFile
    Print #xmlFile, xmlFileContent
    Close xmlFile

    'Loop to next xmlFile in directory
    xmlSheetFile = Dir

Loop

'Read text of the xl\workbook.xml file to a variable
xmlFile = FreeFile
Open zipFilePath & "xl\workbook.xml" For Input As xmlFile
xmlFileContent = Input(LOF(xmlFile), xmlFile)
Close xmlFile

'Manipulate the text in the file to remove the workbook protection
xmlStartProtectionCode = 0
xmlStartProtectionCode = InStr(1, xmlFileContent, "<workbookProtection")
If xmlStartProtectionCode > 0 Then

    xmlEndProtectionCode = InStr(xmlStartProtectionCode, _
        xmlFileContent, "/>") + 2 ''"/>" is 2 characters long
    xmlProtectionString = Mid(xmlFileContent, xmlStartProtectionCode, _
        xmlEndProtectionCode - xmlStartProtectionCode)
    xmlFileContent = Replace(xmlFileContent, xmlProtectionString, "")

End If

'Manipulate the text in the file to remove the modify password
xmlStartProtectionCode = 0
xmlStartProtectionCode = InStr(1, xmlFileContent, "<fileSharing")
If xmlStartProtectionCode > 0 Then

    xmlEndProtectionCode = InStr(xmlStartProtectionCode, xmlFileContent, _
        "/>") + 2 '"/>" is 2 characters long
    xmlProtectionString = Mid(xmlFileContent, xmlStartProtectionCode, _
        xmlEndProtectionCode - xmlStartProtectionCode)
    xmlFileContent = Replace(xmlFileContent, xmlProtectionString, "")

End If

'Output the text of the variable to the file
xmlFile = FreeFile
Open zipFilePath & "xl\workbook.xml" & xmlSheetFile For Output As xmlFile
Print #xmlFile, xmlFileContent
Close xmlFile

'Create empty Zip File
Open sourceFilePath & tempFileName & ".zip" For Output As #1
Print #1, Chr$(80) & Chr$(75) & Chr$(5) & Chr$(6) & String(18, 0)
Close #1

'Move files into the zip file
oApp.Namespace(sourceFilePath & tempFileName & ".zip").CopyHere _
oApp.Namespace(zipFilePath).items
'Keep script waiting until Compressing is done
On Error Resume Next
Do Until oApp.Namespace(sourceFilePath & tempFileName & ".zip").items.Count = _
    oApp.Namespace(zipFilePath).items.Count
    Application.Wait (Now + TimeValue("0:00:01"))
Loop
On Error GoTo 0

'Delete the files & folders created during the sub
Set FSO = CreateObject("scripting.filesystemobject")
FSO.deletefolder sourceFilePath & tempFileName

'Rename the final file back to an xlsx file
Name sourceFilePath & tempFileName & ".zip" As sourceFilePath & sourceFileName _
& "_" & Format(Now, "dd-mmm-yy h-mm-ss") & "." & sourceFileType

'Show message box
MsgBox "The workbook and worksheet protection passwords have been removed.", _
vbInformation + vbOKOnly, Title:="Password protection"

End Sub

Run the macro above.

Navigate to and Select the file containing the password to be removed, then click OK.

The macro will create a new file with the protection passwords removed.

NOTE – The macro will not work on a Mac, only on a Windows PC.

Common error messages and solutions for this macro

If you get the following error messages, the reason could be one of the following:

Run-time error ’53’: file not found:

• The workbook is an .xlsb file type; the macro only works on the .xlsx, .xlsm and .xlam file types.

Run-time error ’76’: file not found:

• The workbook is an xls file type; the macro only works on the .xlsx, .xlsm or. xlam file types.
• The workbook has a file open password applied.

Run-time error ’91’: Object variable or With block variable not set:

• You are running the macro on a Mac, instead of a PC.

Run-time error ‘5’: Invalid function call on the xml read into the string

• Does not work with very large worksheets – The macro converts the XML file to a string. Therefore if the string is more than 2 billion characters, it will cause a VBA error.

Other tips to use this macro successfully:

• Ensure the workbook is saved on your local PC

Crack the VBA project binary password with a macro

Finally, we get to the VBA project binary passwords. Many tutorials suggest using a HEX editor to remove the password. But there is a better and simpler way.

There is an amazing macro that confuses the Visual Basic Editor and makes the code viewable.

I could not have coded this macro in a million years. I don’t claim to be the author of this code, I have compiled the code from a thread of Stack Overflow: https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project

If you are the copyright owner of the original code and wish me to remove the code below, please let me know.

Ensure the workbook containing the locked VBA project is open.

Create a new workbook and copy the code below into a standard VBA module, then run the VBAUnprotected macro.

The download file already includes this macro and can be used to remove the VBA password.

Private Const PAGE_EXECUTE_READWRITE = &H40

Private Declare PtrSafe Sub MoveMemory Lib "kernel32" Alias "RtlMoveMemory" _
    (Destination As LongPtr, Source As LongPtr, ByVal Length As LongPtr)

Private Declare PtrSafe Function VirtualProtect Lib "kernel32" (lpAddress As LongPtr, _
    ByVal dwSize As LongPtr, ByVal flNewProtect As LongPtr, lpflOldProtect As LongPtr) As LongPtr

Private Declare PtrSafe Function GetModuleHandleA Lib "kernel32" (ByVal lpModuleName As String) As LongPtr

Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal hModule As LongPtr, _
    ByVal lpProcName As String) As LongPtr

Private Declare PtrSafe Function DialogBoxParam Lib "user32" Alias "DialogBoxParamA" (ByVal hInstance As LongPtr, _
    ByVal pTemplateName As LongPtr, ByVal hWndParent As LongPtr, _
    ByVal lpDialogFunc As LongPtr, ByVal dwInitParam As LongPtr) As Integer

Dim HookBytes(0 To 11) As Byte
Dim OriginBytes(0 To 11) As Byte
Dim pFunc As LongPtr
Dim Flag As Boolean

Private Function GetPtr(ByVal Value As LongPtr) As LongPtr
GetPtr = Value
End Function

Public Sub RecoverBytes()
If Flag Then MoveMemory ByVal pFunc, ByVal VarPtr(OriginBytes(0)), 12
End Sub

Public Function Hook() As Boolean

Dim TmpBytes(0 To 11) As Byte
Dim p As LongPtr, osi As Byte
Dim OriginProtect As LongPtr

Hook = False

#If Win64 Then
    osi = 1
#Else
    osi = 0
#End If

pFunc = GetProcAddress(GetModuleHandleA("user32.dll"), "DialogBoxParamA")

If VirtualProtect(ByVal pFunc, 12, PAGE_EXECUTE_READWRITE, OriginProtect) <> 0 Then

    MoveMemory ByVal VarPtr(TmpBytes(0)), ByVal pFunc, osi+1
    If TmpBytes(osi) <> &HB8 Then

        MoveMemory ByVal VarPtr(OriginBytes(0)), ByVal pFunc, 12

        p = GetPtr(AddressOf MyDialogBoxParam)

        If osi Then HookBytes(0) = &H48
        HookBytes(osi) = &HB8
        osi = osi + 1
        MoveMemory ByVal VarPtr(HookBytes(osi)), ByVal VarPtr(p), 4 * osi
        HookBytes(osi + 4 * osi) = &HFF
        HookBytes(osi + 4 * osi + 1) = &HE0

        MoveMemory ByVal pFunc, ByVal VarPtr(HookBytes(0)), 12
        Flag = True
        Hook = True
    End If
End If

End Function

Private Function MyDialogBoxParam(ByVal hInstance As LongPtr, _
    ByVal pTemplateName As LongPtr, ByVal hWndParent As LongPtr, _
    ByVal lpDialogFunc As LongPtr, ByVal dwInitParam As LongPtr) As Integer

If pTemplateName = 4070 Then
    MyDialogBoxParam = 1
Else
    RecoverBytes
    MyDialogBoxParam = DialogBoxParam(hInstance, pTemplateName, _
        hWndParent, lpDialogFunc, dwInitParam)
    Hook
End If

End Function


''''RUN THE CODE BELOW''''
Sub VBAUnprotected()

If Hook Then
    MsgBox "VBA Project is unprotected!", vbInformation, "*****"
End If

End Sub

This code does not remove the original password. To remove or change the password go into the VBA Project Properties settings to change the existing settings.

Please note, the macro only works with passwords created using Excel’s standard VBA password feature. VBA projects protected with Unviewable+ (or similar software) cannot be cracked.

Conclusion

There you have it, that’s how to crack Excel passwords with VBA.

For worksheet, allow edit ranges, workbook, modify and VBA projects, there is a solution.

If you were hoping to get instructions to crack the file open password, then I’m sorry, I don’t have an easy solution. Try investigating a brute force attack method from https://www.password-find.com

---

What next?

Discover how you can automate your work with our Excel courses and tools.