The workbook and worksheet passwords can be easily cracked by a brute force attack on the hashed passwords stored in Excel using VBA code. You don't seem convinced? Well, protect a worksheet using the password test and then unprotect the same worksheet using the password zzyw, BBAb or pqpp. It works, as all 4 passwords (among many other) share the hash CBEB! In cryptographic terminology, it means that this poorly designed hashing algorithm allows numerous collissions. The length of the hash used until Office 2010 is just 16 bits.ĭue to the short length of the hash, a lot of different passwords share the same hash. The password hash algorithm is documented in chapter 4.18.4 of the OpenOffice technical documentation and in this link. For many years, sheet protection seemed geared towards preventing accidental editing than designed to protect sheet contents from malicious tampering. Until Office 2010, Excel used an outdated hashing algorithm to protect our passwords. However, it is impossible to recover your exact sheet or workbook structure passwords, even if your Excel files are hacked and the hash is revealed, as hashes cannot be reversed by design. If you have lost your password, the only alternative short of recreating the file, is to crack the hash. If the two hashes match, the sheet is unprotected. So when you attempt to unprotect a sheet, Excel computes the hash of the password entered against the hash of the original password stored inside the OpenXML file. Even a minor change in the source input results in a completely different output.

Hash algorithms are one-way functions that convert passwords to a fixed length text that cannot be reversed. To safeguard your original password against hacking, Excel does not save the user's real password inside the OpenXML file, but a cryptographic hash. As in previous Office versions, worksheets and the workbook's structure in Excel 2007 or later are protected using a password.

How to put a password on an excel sheet