Excel Password Security
Cracking the Sheet Password Protection
Sometimes users will have a Sheet in a Workbook protected because they don't want any changes made. If we need to edit the Sheet, we can simply copy the whole Sheet's contents and paste it into a new Sheet. Normally this works all the time but there are rare cases where a Sheet copy doesn't quite work correctly. In those cases, we can crack and remove the password completely. Here's how to crack that password:
To start, you need to complete the front half of the ZIP process FIRST... to reveal Excel file XML contents.
If you haven't done that yet, Go to the ZIP Process first. If you've already extracted the ZIP file, then continue below...
- In the resulting folder after the ZIP process extraction above... if you drill down into the xl subfolder, then into the "worksheets" folder, you will find the .xml file that has the same name as the Sheet you want to unlock. You just have to open that .xml file in any text editor program, like NotePad.
- In the text editor (like NotePad), make sure the Word Wrap is on (if NotePad). Your xml file can possibly be quite long with hundreds of lines. So, type the Control+F keys and search for the word "Protection". XML code is formatted just like HTML code (if you're a web developer). All of the code instructions exist in anchor brackets < .... /> just like HTML anchors. In this code, you should find the Sheet protection in it's bracket.
- The Sheet protection will be a long string of text between the anchor brackets <sheetProtection...................... />. You may notice that Excel is using a monsterous SHA-512 hash algorithm based on non-linear functions to protect the password. It is designed to prevent any known decryption method and is considered to be uncrackable. You can see the giant hashValue code combined with an additional saltValue code with a 100,000 spinCount making the password even more complicated to crack. Except you are looking at this fantastic cryptographic technology in clear text... The password may be uncrackable, but that doesn't mean you can't just delete it. Highlight the entire <sheetProtection... /> anchor text and delete it!
- Seems stupid, yes? It is. This is like having a giant bank vault with a one-foot thick steel door, then that door has a little backyard gate latch holding it closed.
- When you're done, save the file
- Now working in reverse from the ZIP process, navigate back up to the top-level folder of the ZIP extraction. Highlight all of the contents of that folder, and Send all of the contents to a new ZIP file.
- Continue reversing the ZIP process and rename the new ZIP file back to .xlsx (or .xlsm)
- Now just open your Excel file and the Sheet will have the password removed.
