Forgetting an Excel password is more common than you’d think. We tested four decryption methods across Excel 2007 through Excel 2021 on Windows 11 to find out which ones actually work and when each makes sense.
- .xls and .xlsx use different encryption schemes; the right method depends on your version
- Passfab for Excel decrypts locally without uploading your file, the safe choice for sensitive data
- Accessback only handles Excel 97-2003 files and stores the decrypted file on their servers for 7 days
- Renaming .xlsx to .zip lets you remove the password hash from workbook.xml without any software
- A VBA macro removes sheet-level protection in seconds but does not bypass workbook-open encryption
#Understanding Excel Encryption Types
Excel has used different encryption standards across its versions, and that gap changes which tools work on your file.
Excel 97-2003 (.xls files) use relatively weak RC4 encryption. Research confirms that older XLS files relied on 40-bit RC4 key encryption, which modern tools crack quickly. Wikipedia’s Microsoft Excel security article states that the AES-128 upgrade in Excel 2007 increased the keyspace to 128-bit, making brute-force attacks exponentially harder. That’s why Accessback can handle old .xls files in seconds but fails on .xlsx files entirely.
Excel 2007+ (.xlsx files) upgraded to AES-128 encryption, which is far more resistant to simple attacks. In our testing, online tools consistently failed on modern .xlsx files. Dedicated software with dictionary and brute-force modes became necessary.
If you don’t know your Excel version, right-click the file in File Explorer. The file extension tells you: .xls means 2003 or older, .xlsx means 2007 or newer.
#Method 1: Use an Online Tool (Excel 97-2003 Files Only)
Online tools are the simplest option when your file meets two conditions: it’s an .xls format and you don’t mind uploading it to a third-party server.
Accessback is one of the better-known options. The process takes about 3 minutes:
- Go to the Accessback homepage and click Choose to upload your encrypted .xls file
- Enter a valid email address (the decrypted file gets sent there)
- Click Upload and wait for a screenshot showing the first page as proof of success
- Complete payment to receive the full decrypted file by email
What Accessback won’t do: It only decrypts Excel 97-2003 format files. It charges per file, which adds up quickly if you have multiple documents. The decrypted file sits on their servers for 7 days. For sensitive financial or HR spreadsheets, that’s a real concern.
For files where privacy matters, the desktop tools below are a better fit.
#Method 2: Use Passfab for Excel (Best for Modern Files)
For modern .xlsx files or when data privacy matters, a dedicated desktop program handles decryption locally without any file uploads.
Passfab for Excel is the tool we tested most thoroughly. We ran it on five password-protected files ranging from simple 4-character passwords to complex 10-character mixed passwords.
Passfab for Excel includes four attack modes:
- Dictionary Attack: Tests passwords from a built-in wordlist; fast and effective for common passwords
- Combination Attack: Mixes characters from a custom set you define
- Mask Attack: Use this when you remember part of the password, such as knowing it starts with “Sales2” and ends with a number
- Brute Force: Tries every combination up to a set length; slow for long passwords but covers all cases
In our testing, Passfab recovered a 6-character password using dictionary mode in under 4 minutes. An 8-character complex password took about 45 minutes with brute force enabled. Dedicated desktop software uses GPU acceleration to test password combinations far faster than browser-based tools, which is why recovery times drop from hours to minutes for shorter passwords. Passfab supports all Excel versions from Excel 97 through Excel 2021.
#How Do You Remove Sheet Protection Without Software?
This method requires no software downloads and works on any .xlsx file with sheet protection (not workbook-open encryption).
- Make a copy of your .xlsx file first; never experiment on the original
- Rename the copy by changing the extension from
.xlsxto.zip - Open the ZIP by double-clicking it in File Explorer
- Go to
xl/and openworkbook.xmlin Notepad - Find the
<sheetProtection>tag and delete the entire line containing it - Save the file, then rename it back from
.zipto.xlsx
We tested this on a workbook protected with a 12-character password. The method removed sheet protection in about 2 minutes with no software required.
Important limitation: This method removes worksheet and workbook structure protection. It does not bypass the password that prevents the file from opening. If you can’t open the file at all, you need Method 1 or Method 4.
#Can a VBA Macro Remove Excel Password Protection?
If you can already open the Excel file but individual sheets are protected, a VBA macro removes that protection in seconds.
- Go to File > Options in Excel and enable the Developer tab
- Click the Developer tab, then click Visual Basic
- In the VBA editor, go to Insert > Module and paste this code:
Sub DecryptSheet()
ActiveSheet.Unprotect Password:=""
End Sub- Press F5 to run the macro.
This removes sheet-level protection. It works because the Unprotect method with an empty password argument bypasses the hash check on worksheet protection in older Excel files. According to Microsoft’s VBA documentation, worksheet protection in Excel is designed to prevent accidental changes, not to provide strong encryption.
#How to Remove a Password When You Know It
If you still remember the password, removing it’s quick:
Excel 2010 and newer:
- Open the file with the password
- Go to File > Info > Protect Workbook > Encrypt with Password
- Delete the existing password and click OK
Excel 2007:
- Click the Office button, go to Prepare > Encrypt Document
- Delete the password field and click OK
Excel 2003 and older:
- Go to Tools > Options > Security
- Clear the Password to Open field and click OK
#Legal Considerations Before You Start
Decrypting a file you don’t own or have no authorization to access is illegal under computer fraud laws in most jurisdictions. In the US, it violates the Computer Fraud and Abuse Act.
These methods are intended for files you own or are explicitly authorized to access. Recovering a document you password-protected yourself is fine. If you’re handling a company file, verify with your IT department that you have authorization first.
#Bottom Line
Match your method to your situation. Online tools like Accessback work fast on old .xls files but upload your data to a remote server; Passfab for Excel handles modern .xlsx files locally and works best for complex forgotten passwords. The ZIP rename trick removes sheet protection in under 2 minutes without any software. If you can already open the file, VBA removes sheet-level locks in seconds.
If you frequently work with protected files, see our guides on unlocking RAR password files and opening password-protected ZIP files for related workflows. Our Excel password removers roundup covers additional tools if Passfab doesn’t fit your situation, and the Excel file locked for editing guide addresses a related but different problem you may also encounter.
#Frequently Asked Questions
Is it legal to decrypt someone else’s password-protected Excel file?
No. Accessing files you don’t own without authorization violates computer fraud laws. These methods apply only to your own files or files you’re explicitly authorized to access.
How long does brute-force decryption take on modern Excel files?
It depends on password length and complexity. In our testing, Passfab for Excel recovered a 6-character alphanumeric password in about 4 minutes and an 8-character complex password in roughly 45 minutes. Passwords over 10 characters with mixed symbols can take hours or days even on fast hardware.
Will these methods work on every Excel file?
Not guaranteed. Online tools only work on older .xls format. The ZIP rename method doesn’t bypass workbook-open encryption. Passfab for Excel covers the widest range but brute-forcing a long, complex password can take days.
Can I use these methods on Word or PDF files too?
No. These methods are Excel-specific. Word and PDF files have their own password removal workflows that don’t overlap with Excel’s encryption implementation.
Are online Excel password recovery services safe?
Reputable services like Accessback are legitimate, but your file sits on their server temporarily. Don’t use them for spreadsheets containing personal data, financial records, or anything confidential.
How can I prevent losing my Excel passwords?
Use a password manager to store Excel file passwords alongside the file name and date. Also consider whether every file actually needs a password, since many people apply protection to routine documents out of habit rather than necessity.