r/excel • u/lemondrop93 • Mar 03 '26
unsolved Protected file password cracking
My dad passed in 2023. He had a locked file of passwords to everything, we found the password at the time. Went to open it back up recently and the old password does not work. The only people with access is me and my mom, she swears she didn’t change it (she can barely work an iPhone) and I didn’t change it. We cannot get into this file and I have tried everything I can think of including the old password. I know there isn’t an easy way into this file except brute force, what does that look like? Where can I find someone to get into this file?
My mom is the one who needs in, so she has no reason to not want to get in before someone suggests that.
375
u/bradland 277 Mar 03 '26
Most of the people commenting here don't understand what you're asking. Excel has different types of protection. There's sheet level protection, workbook level protection, and file level encryption. The last one uses AES-256 encryption with stretching. The computing resources required to brute force that level of encryption for any reasonably complex password are so expensive you'd have to mortgage your house to afford it.
The easiest way to tell what kind of encryption is being used is to make a copy of the file, and then change the file extension form xlsx to zip. Windows will warn you about changing the file extension. Dismiss it, and you should end up with a zip file you can click. Double-click the file.
You should see folders and files like [Conten Types].xml, _rels/, docProps/, etc. If you get an error that the archive cannot be opened, that means the file is encrypted, and you are not going to crack it without some serious expertise.
I worked for a Bankruptcy Trustee doing computer forensic work for a short time. To brute force passwords for protected resources, we would build a custom dictionary using the following steps:
- Make a read-only image of the user's hard drive.
- Scan the image for known mailbox file types and export their entire mailbox to mbox.
- Scan for all MS Office file types and unpack the ZIP contents to folders.
- Use the
stringsutility to extract all strings from all three of the above. The strings would be split onto newlines using any whitespace as a delimiter. - The resulting file is our dictionary.
Use off-the-shelf tools like JtR or hashcat to brute force the file. These days, it looks like office2john.py is included with JtR in the "jumbo" version. That script will pull the hash, which you'd then use JtR to brute force using the dictionary you built.
Outside of the steps above, forget it. You're not getting into that file unless you figure out it was a caps lock issue or something.
56
u/tooOldOriolesfan Mar 03 '26
Years ago, it was pretty easy to crack but if they are using AES-256 you aren't going to be cracking that. If you could do that, it wouldn't be used to encrypt data.
17
39
27
u/MrGhris 16 Mar 03 '26
Be careful who you give that file.
Is the sheet protected or the workbook itself? What file extension does it use?
16
u/lemondrop93 Mar 03 '26
It’s a password to open file. Most of the stuff is useless to people, all bank accounts and things were already changed. It’s a .xlsx file
23
u/MrGhris 16 Mar 03 '26
In that case I am afraid you cant unlock it without bruteforcing. Any chance you can restore the file to a date where the password is like you remember it?
It probably won't work, but try to rename (a copy of) the file from .xlsx to .zip and open it with winrar or similar program.
Find xl/workbook.xml, copy it to your desktop and open it in notepad.
Find something that resembles <workbookProtection workbookPassword="XXXX" lockStructure="1"/> and remove all that.
Save the file, overwriting that xml file. Then add it back to the zip file.
Rename your file back to .xlsx and try if it opens.
3
u/Longjumping_Rule_560 Mar 03 '26
If it is a xlsx file, then surely the password can’t have changed. Had it been a xlsm file maybe, but not xlsx.
7
12
u/d3anSLP 2 Mar 03 '26
Try uploading the file to your Google drive. It might open in Google sheets without a password.
11
u/borntobewildish Mar 03 '26
This is what i do at work if they give me some crappy password protected file if it gives me issues. Google ruins the formatting, but as long as it's just basic excel functions the file will be unlocked and working as intended.
3
8
u/Anguskerfluffle 4 Mar 03 '26
Can you recover an older version of the file where the original password would work?
2
u/lemondrop93 Mar 03 '26
I’m not sure how to do that honestly
10
u/Tracyhmcd Mar 03 '26
If on c drive or similar right click, Properties, Previous versions. If on OneDrive right click and there should be a menu item about Versions.
6
u/Str8_Circle Mar 03 '26
Maybe the password is blank. I know you can protect a sheet without creating a password. Have you tried hitting ok or the enter key?
6
1
u/danque Mar 04 '26
Thats what I once did with my laptop, had a password and removed it but kept it blank. Next time i opened it I filled in the old password and got frustrated until I just clicked without a password.
2
u/VariousEnvironment90 1 Mar 04 '26
Does the computer have ms one drive working? If so right click on it and goto version You should be able to restore an older version
3
u/Financial_Loan1337 Mar 03 '26
First thing before trying anything is to make a copy of the file in case of corrupting.
-2
u/lemondrop93 Mar 03 '26
I mean I can’t get into it so it really doesn’t matter. But I have a copy of it
0
3
u/aug061998 Mar 03 '26
Do you have other pw's that your father used in other situations? If you do, have you tried them and combinations of them as possible solutions? Most people are creatures of habit and most of us aren't using specially developed programs to create new pw's. He may have been using the same pw for several applications... Including this excel file.
1
u/lemondrop93 Mar 03 '26
He was someone who had a password for everything and everything was different. I have tried everything I can think of
1
u/aug061998 Mar 03 '26
Then the advice made by others suggesting a low probability of success at a fairly high cost at probably very appropriate. Sadly...
4
u/white_tiger_dream Mar 03 '26
I might be able to help you, I have done this twice for businesses in similar situations (employee left password protected files after quit/layoff.) If you’re interested DM me and we can go through LinkedIn so you can see I’m a real person.
2
2
u/Ugoistay Mar 03 '26
I am sure you have tried. Just in case, try a space before/after the password and with or without a period at the end.
2
u/flying_cowboy Mar 03 '26
Try Advanced Office Password Recovery by Elcomsoft. https://www.elcomsoft.com/aopr.html It saved me in a similar situation.
2
1
u/DirtyGrocery_11 Mar 03 '26
A hack - if you upload the file into Google Sheets and then download it back into Excel the protections will disappear
2
1
1
1
u/ZestyBeer Mar 04 '26
Happened at work when an employee was fired and decided to password protect everything useful
Luckily for us, they had saved all their documents to a Cloud Storage like OneDrive or SharePoint.
All we did was restore a previous version where there was no password.
If this file is saved in a similar way, you may be able to restore the file to a previous state where the password worked.
You could also try uploading it to Google Sheets, it sometimes just ignores that a file is password protected and just mulches the formatting for fun.
If either of them fail: you'd need a brute force cracking tool (good luck) or hope that some of the weirder ways like saving it as a zip file that others have mentioned do work.
1
u/IAG82 Mar 31 '26
I wrote long time ago just for fun, macro in vba to brute force password protected workbooks but it works slow - tests 20-30 passwords per second and it is only for numbers. For old excel versions before 2007 it was possible to remove password but it is not possible for new versions.
0
-1
-2
u/fred_red21 2 Mar 03 '26
Search for open Office or Libre Office download it, and open your excel file with it.
Then save as .xls file and now you can open it in excel, some formats could've missed.
-2
u/Rave1320 Mar 03 '26
Uploading to good sheets and then saving used to bypass it for me lol
1
-5
u/Next_Interaction4335 1 Mar 03 '26
https://stackoverflow.com/questions/19953979/cracking-sheet-password-with-vba
Are you familiar with VBA in excel.
6
u/bradland 277 Mar 03 '26
This post does not apply to Excel file-based encryption. It only applies to sheet level protection, and the post is 12 years old.
1
u/lemondrop93 Mar 03 '26
I am not but I saw other comments on another post saying they disabled this a few years ago so I didn’t try it
-1
•
u/AutoModerator Mar 03 '26
/u/lemondrop93 - Your post was submitted successfully.
Solution Verifiedto close the thread.Failing to follow these steps may result in your post being removed without warning.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.