Skip to content

Excel worksheet protection is not encryption

Hiding and protecting an Excel worksheet is NOT the same as full encryption.  Protected workbooks can be encrypted and not available without the right password. Worksheets protected or hidden with a password are absurdly easy to view whether you have the password or not.

Excel has long had the ability to hide a worksheet (tab) from view and optionally require a password to unhide it.

Hide worksheet with password

Hide a worksheet by right-clicking on the tab and choosing Hide.  Fit more tabs across an Excel workbook

Then Protect the workbook structure from Review | Protect | Protect Workbook and protect the workbook for Structure. Add a password.

(there’s also a VeryHidden worksheet option, only available via VBA).

Password doesn’t mean encryption

Even though the worksheet tab is hidden away and needs a password to be made visible does NOT mean the contents of that tab are encrypted.

All the worksheet contents are saved in the XLSX/XLSM file normally with no encryption.

How do we know?

We made an Excel file with a hidden worksheet and password protected the structure. Then opened up the XLSX file to look at the XML contents (all modern Office documents are ZIP files with a bundle of XML files inside).

Here’s the hidden & password protected worksheet file \xl\worksheets\sheet2.xml.  The single cell contents ‘5678’ is there for all to see despite the password protection.

/xl/workbook.xml controls the visibility of the worksheets, note the ‘ state=”hidden” ‘ setting for one <sheet ….

The password appears to be in the same file and is the only part that is encrypted, using SHA-512.

Unprotecting a worksheet without the password is quite easy. There are free tools to do it like Password Protection Remover Pro or you can ‘DIY’ by opening up the XLXS/XLXM file and editing the workbook.xml file directly.

Compare that to a fully protected Excel workbook which can’t be opened without a password. The entire file is encrypted.

Protecting a workbook is different from protecting a sheet/tab

To be fair to Microsoft, there’s nothing in their documentation to suggest that Protecting a worksheet with a password is encrypting it.

However, many people would assume that using a password in modern Office apps meant some level of encryption.

After all, Protecting a whole workbook is Encryption to a high level (Microsoft 365 uses AES-256).  But Protecting a worksheet is not encrypted at all.

A good rule of thumb is whether the password is optional or not.  If the password is optional (e.g. Protecting a worksheet) there’s no encryption.

About this author

Office Watch is the independent source of Microsoft Office news, tips and help since 1996. Don't miss our famous free newsletter.