📊 Recover Excel password · 2026 guide
Excel has complicated security history. Pre-2007 versions (XLS) are crackable in milliseconds. 2010-2013 versions (XLSX) are moderately hard. 2016+ versions (XLSX with SHA-512) are comparable to wallet.dat. This guide covers all scenarios and cases where professional recovery is worth it.
Excel versions and their algorithms
Excel 2007-2010 (XLSX): AES-128 with SHA-1 hashing. Crackable with wordlist in hours-days on GPU.
Excel 2013-2016 (XLSX): AES-128 with SHA-512 + 100,000 PBKDF2 iterations. Much more resistant.
Excel 2019+ (XLSX): AES-256 with SHA-512 + increased iterations. Comparable to wallet.dat in difficulty.
Excel 97-2003 (.xls): instant recovery
Using libreoffice headless or Python script with pyexcel:
# Python with msoffcrypto-tool
pip install msoffcrypto-tool
msoffcrypto-tool encrypted.xls decrypted.xls -p ""
For sheet protection ("sheet protection") in Excel, there's a trick: any Excel <2007 with sheet protection accepts password "password" or any value producing same 16-bit hash. There are online "empty hash collision" generators that give trivial password.
Excel 2010-2016 (.xlsx): hashcat viable
office2john.py file.xlsx > hash.txt
hashcat -m 9500 hash.txt rockyou.txt # Excel 2010-2013
hashcat -m 9600 hash.txt rockyou.txt # Excel 2016+
RTX 3090 throughput:
- Excel 2010 (-m 9500): ~600,000 a/sec
- Excel 2013/2016 (-m 9600): ~100,000 a/sec
- Excel 2019+ (strong PBKDF2): ~1,500 a/sec
For Excel 2019+, remembering pattern is CRITICAL. Without any hint, long random keys are infeasible.
Workbook vs Sheet protection vs File password
1) File password (full encryption): the most serious. Without it, you don't open the file. This guide applies here.
2) Workbook protection: prevents adding/deleting sheets. TRIVIAL to remove (manually edit internal XML). No real password.
3) Sheet protection: prevents editing cells. Same as workbook protection, removable editing .xlsx XML internals (which is internally a ZIP of XML files).
For workbook/sheet protection without real password, you don't need service — open source tools like excelpasswordrecovery.exe or python scripts do it in seconds.
ROI: when professional service worth it
- Corporate financial model (worth $$$ to recover)
- Spreadsheets with 10+ years of family business history
- Certified legal worksheets
- VBA macros with complex proprietary code
NOT worth it:
- Excel 97-2003 (free instant tools)
- Excel with sheet/workbook protection (not real file password)
- Simple model you can recreate from memory
Our GPU cluster processes Excel 2019 at ~7,500 a/sec combined. LATAM curated wordlists. USD 35 diagnostic.
Frequently asked questions
How do I know which Excel version I have?
Check extension: .xls = Excel 97-2003, easy. .xlsx = Excel 2007+, harder. For exact version inside XLSX: open with 7-Zip and check internal metadata.
Are Excel and Office passwords the same?
Office Word/PowerPoint use same algorithm as Excel of the same version. Hashcat -m 9500/9600/9700 handles all. Password may differ per file even if same Office.
Difference between Mac and Windows?
Algorithm is standard Office. Excel for Mac and Windows produce compatible files. Recovery applies the same.
Is VBA password also recoverable?
VBA project password in Excel pre-2007 was removable with hex editor (change 4 bytes). Excel 2007+ uses SHA-1, hashcat -m 9700 cracks it with wordlist.
Realistic time for Excel 2019 with 10-char password?
If key was "semi-random" like cat + year + symbol: 1-3 days in cluster. If genuinely random like Bitwarden gen: impossible single-cluster. Diagnostic tells which group.
Complex case? We can help
5×RTX 3090 GPU cluster + ML engineer. USD 35 diagnostic, USD 2000 AI Scan, success fee 30-40% only if we recover.
🔐 Wallet Recovery →