Excel worksheet protection is not encryption


Office for Mere Mortals
Your beginners guide to the secrets of Microsoft Office
Invalid email address
Tips and help for Word, Excel, PowerPoint and Outlook from Microsoft Office experts.  Give it a try. You can unsubscribe at any time.  Office for Mere Mortals has been running for over 20 years, we've never, ever revealed or sold subscriber details.  Privacy policy

Hiding and protecting an Excel worksheet is NOT the same as full encryption.  Protected workbooks can be encrypted and not available without the right password. Worksheets protected or hidden with a password are absurdly easy to view whether you have the password or not.

Excel has long had the ability to hide a worksheet (tab) from view and optionally require a password to unhide it.

Hide worksheet with password

Hide a worksheet by right-clicking on the tab and choosing Hide.  Fit more tabs across an Excel workbook

Then Protect the workbook structure from Review | Protect | Protect Workbook and protect the workbook for Structure. Add a password.

excel worksheet protection is not encryption microsoft excel 37704 - Excel worksheet protection is not encryption

(there’s also a VeryHidden worksheet option, only available via VBA).

Password doesn’t mean encryption

Even though the worksheet tab is hidden away and needs a password to be made visible does NOT mean the contents of that tab are encrypted.

All the worksheet contents are saved in the XLSX/XLSM file normally with no encryption.

How do we know?

We made an Excel file with a hidden worksheet and password protected the structure. Then opened up the XLSX file to look at the XML contents (all modern Office documents are ZIP files with a bundle of XML files inside).

Here’s the hidden & password protected worksheet file \xl\worksheets\sheet2.xml.  The single cell contents ‘5678’ is there for all to see despite the password protection.

excel worksheet protection is not encryption microsoft 365 37705 - Excel worksheet protection is not encryption

/xl/workbook.xml controls the visibility of the worksheets, note the ‘ state=”hidden” ‘ setting for one <sheet ….

excel worksheet protection is not encryption microsoft 365 37706 - Excel worksheet protection is not encryption

The password appears to be in the same file and is the only part that is encrypted, using SHA-512.

Unprotecting a worksheet without the password is quite easy. There are free tools to do it like Password Protection Remover Pro or you can ‘DIY’ by opening up the XLXS/XLXM file and editing the workbook.xml file directly.

Compare that to a fully protected Excel workbook which can’t be opened without a password. The entire file is encrypted.

Protecting a workbook is different from protecting a sheet/tab

To be fair to Microsoft, there’s nothing in their documentation to suggest that Protecting a worksheet with a password is encrypting it.

However, many people would assume that using a password in modern Office apps meant some level of encryption.

After all, Protecting a whole workbook is Encryption to a high level (Microsoft 365 uses AES-256).  But Protecting a worksheet is not encrypted at all.

A good rule of thumb is whether the password is optional or not.  If the password is optional (e.g. Protecting a worksheet) there’s no encryption.

subs profile e1563205311409 - Excel worksheet protection is not encryption
Latest news & secrets of Microsoft Office

Microsoft Office experts give you tips and help for Word, Excel, PowerPoint and Outlook.

Give it a try. You can unsubscribe at any time.  Office Watch has been running for over 20 years, we've never, ever revealed or sold subscriber details.  Privacy policy
Invalid email address