How does Microsoft Excel password recovery work?

Microsoft Excel documents can utilize three passwords:

Password to open
Password to modify
Protect sheet or Protect workbook

Password to open

The Password to open requires a user to enter a password to view the document.

When the user sets a Password to open, the entire Microsoft Excel document is encrypted with the RC4 stream cipher.

Password to modify

The Password to modify requires a user to enter a password to make changes to the document.

When a user sets a Password to modify, the password is stored inside the Microsoft Excel document. The password can be viewed or changed with a hex editor.

Protect sheet or Protect workbook

The Protect sheet or Protect workbook password requires the user to enter a password to unprotect the either the worksheet or the workbook.

When a user sets a Protect sheet or Protect workbook password, the 32-bit password hash is stored in the document. The password hash can be viewed or changed with a hex editor.

Applying passwords in Microsoft Excel

To apply a Password to open or a Password to modify to a Microsoft Excel document, click <File>, <Save As>, <Tools>, <General Options>.

If you select <Advanced> you can select which encryption algorithm you wish to use and what key length you wish to use with that algorithm.

Supported algorithms are:

Weak Encryption (XOR)
Office 97/2000 Compatible
RC4, Microsoft Base Cryptographic Provider v1.0
RC4, Microsoft Base DSS and Diffie-Hellman Cryptographic Provider
RC4, Microsoft DH SChannel Cryptographic Provider
RC4, Microsoft Enhanced Cryptographic Provider v1.0
RC4, Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider
RC4, Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)
RC4, Microsoft RSA SChannel Cryptographic Provider
RC4, Microsoft Strong Cryptographic Provider

The default is "Office 97/2000 Compatible" -- however even Microsoft states that this is not recommended!

To apply a Protect sheet or Protect workbook password to a Microsoft Excel document, click <Tools>, <Protection>.

Microsoft Excel Password Recovery

It is possible simply to edit the Password to modify with a hex editor. It is also possible to edit the hash of the Protect sheet or Protect workbook password.

The Password to open can be attacked with a dictionary attack or a brute force attack.

Several programs, with widely varying capabilities, are available to help you recover a lost Microsoft Excel password: