How does Microsoft PowerPoint password recovery work?

Microsoft PowerPoint documents can utilize two passwords:

Password to open
Password to modify

Password to open

The Password to open requires a user to enter a password to view the document.

When the user sets a Password to open, the entire Microsoft PowerPoint document is encrypted with the RC4 stream cipher.

Password to modify

The Password to modify requires a user to enter a password to make changes to the document.

When a user sets a Password to modify, the password is stored inside the Microsoft PowerPoint document. The password can be viewed or changed with a hex editor.

Applying passwords in Microsoft PowerPoint

To apply a Password to open or a Password to modify to a Microsoft PowerPoint document, click <File>, <Save As>, <Tools>, <Security Options>.

If you select <Advanced Options> you can select which encryption algorithm you wish to use and what key length you wish to use with that algorithm.

Encryption algorithms supported by Microsoft PowerPoint are:

Weak Encryption (XOR)
Office 97/2000 Compatible
RC4, Microsoft Base Cryptographic Provider v1.0
RC4, Microsoft Base DSS and Diffie-Hellman Cryptographic Provider
RC4, Microsoft DH SChannel Cryptographic Provider
RC4, Microsoft Enhanced Cryptographic Provider v1.0
RC4, Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider
RC4, Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)
RC4, Microsoft RSA SChannel Cryptographic Provider
RC4, Microsoft Strong Cryptographic Provider

The default is "Office 97/2000 Compatible" -- however even Microsoft states that this is not recommended!

Microsoft PowerPoint Password Recovery

It is possible simply to edit the Password to modify with a hex editor.

The Password to open can be attacked with a dictionary attack or a brute force attack.

Elcomsoft Advanced Office XP Password Recovery is the only program I know of which is available to help you recover a lost Microsoft PowerPoint password.