Excel files are used in nearly every workplace and are frequently shared between people. It's not uncommon for passwords to get lost, leaving you locked out of your own files. In this blog post, I'll walk you through the process of regaining access to Excel files protected at the sheet, workbook, or VBA-project level.

• 1. Bypassing Password Protected Sheets
  • 1.1 Extracting the Excel-file
  • 1.2 Edit the XML file of the sheet
  • 1.3 Repack the Excel-file
  • 1.4 Lock the sheet again with the original password
• 2. Bypassing Password Protected Workbooks
  • 2.1 Extracting Excel-file
  • 2.2 Edit the XML file of the workbook
  • 2.3 Repack the Excel-file
  • 2.4 Lock the workbook again with the original password
• 3. Bypassing VBA Passwords (Hex Editing)
  • 3.1 Extracting the Excel-file
  • 3.2 Edit the vbaProject.bin file
  • 3.3 Repack the Excel-file
  • 3.4 Lock the vbaProject again with the original password

1. Bypassing Password Protected Sheets

Required Software:

• HEX Editor (Frhed - free/open-source) / Text editor (Notepad++ - free/open-source)
• Archive Tool (7-zip - free/open-source)

1.1 Extracting the Excel-file

• Change extension of Excel-file to .rar (filename.xlsx → filename.rar)
• Extract the rar-file

1.2 Edit the XML file of the sheet

• Go to /filename/xl/worksheets/, here you'll find the XML-files of all the sheets in the document
• Select the file of the protected sheet (in this example sheet1 is protected, so we select sheet1.xml)
• Open this file with your favorite HEX or text editor
• Search for the sheet protection tag (shown on figure below)
• Cut this tag and save the XML-file (keep the tag in notepad, if you wish to protect the file afterwards with the original password)

1.3 Repack the Excel-file

• Overwrite the XML-file of the sheet in the archive (filename.rar) with the edited file
• Replace the extension of the archive to the original one (filename.rar → filename.xlsx)
• Open the Excel-file. The sheet protection is disabled now.

1.4 Lock the sheet again with the original password

Only applicable if you wish to restore the original password after editing the file. I added the snippet of this example below:
\<sheetProtection algorithmName="SHA-512" hashValue="0jogPQRCGJjV9GCovvHZBp7uzTzQ0JOAE3FHQHBLuQWoHz6BIyWZDI4zqYTsnkVNlwm3WrtiifwWiz61XpbJ3A==" saltValue="F4+6MweQt8VuYjIQobOxTw==" spinCount="100000" sheet="1" objects="1" scenarios="1"/>

• Extract the Excel file again after editing and open the sheet XML file once more with your HEX or text editor
• Go to the end of the document and find <\sheetData><pageMargins
• Put your cursor on the < before pageMargins
• Go to Edit → Paste with dialog... or simply press Ctrl+Shift+V
• Paste the snippet in here, choose insert as paste mode and press ok
• Save the file
• Replace the extension of the archive to the original one (filename.rar → filename.xlsx)
• The modified sheet is protected with the original password

2. Bypassing Password Protected Workbooks

Required Software:

• HEX Editor (Frhed - free/open-source) / Text editor (Notepad++ - free/open-source)
• Archive Tool (7-zip - free/open-source)

2.1 Extracting Excel-file

• Change extension of Excel-file to .rar (filename.xlsx → filename.rar)
• Extract the rar-file

2.2 Edit the XML file of the workbook

• Go to /filename/xl/, here you'll find workbook.xml
• Open this file with your favorite HEX or text editor
• Search for the workbook protection tag (shown on figure below)
• Cut this tag and save the XML-file (keep the tag in notepad, if you wish to protect the file afterwards with the original password)

2.3 Repack the Excel-file

Overwrite the XML-file of the workbook in the archive (filename.rar) with the edited file Replace the extension of the archive to the original one (filename.rar → filename.xlsx) Open the Excel-file. The workbook protection is disabled now.

2.4 Lock the workbook again with the original password

Only applicable if you wish to restore the original password after editing the file. I added the snippet of this example below: \<workbookProtection workbookAlgorithmName="SHA-512" workbookHashValue="FIKLyYql9e3SuA46nvipVL1l9Bki+Eghhc5IjFyahuLV5p/oDcwelr8XBI2HGR/H6BUd6AAwOmBVnuUcT2t3Sw==" workbookSaltValue="IYEniDrscwXGhIoCs0Ez6Q==" workbookSpinCount="100000" lockStructure="1"/>

• Extract the Excel file again after editing and open the workbook XML file once more with your HEX or text editor
• Go to the end of the document and find \><bookviews>
• Put your cursor on the < before bookviews
• Go to Edit → Paste with dialog... or simply press Ctrl+Shift+V
• Paste the snippet in here, choose insert as paste mode and press ok
• Save the file
• Replace the extension of the archive to the original one (filename.rar → filename.xlsx)
• The modified workbook is protected with the original password

3. Bypassing VBA Passwords (Hex Editing)

Required Software:

• HEX Editor (Frhed - free/open-source)
• Archive Tool (7-zip - free/open-source)

3.1 Extracting the Excel-file

• Change extension of Excel-file to .rar (filename.xlsm → filename.rar)
• Extract the rar-file

Extract Excel File with 7-zip

3.2 Edit the vbaProject.bin file

• Go to /filename/xl/, here you'll find the binary file of the VBA project (vbaProject.bin)
• Open this file with your favorite HEX editor (I use Frhed)
• Search DPB and GC values

VBA-password values

• Copy the values to notepad
• Copy the following DPB and GC values as well and align with the previous values by adding zeroes

1DPB="DBD9775A4B774B77B4894C77DFE8FE6D2CCEB951E8045C2AB7CA507D8F3AC7E3A7F59012A2"
2GC="BAB816BBF4BCF4BCF4"

• The result after alignment is shown below:

1DPB="1416B848C8CFE5CFE5301BD0E5F2A4F0F7EB27CA3C7F4A869C848C4254DC3943951B5CFDAD23"
2DPB="DBD9775A4B774B77B4894C77DFE8FE6D2CCEB951E8045C2AB7CA507D8F3AC7E3A7F59012A200"

1GC="9E9C32C236C6C1C7C1C7C1"
2GC="BAB816BBF4BCF4BCF40000"

• Select DPB="....." and go to Edit → Find and Replace → Replace... (or simply press Ctrl+H)
• Replace the original value with the new aligned value
• Do the same for the GC value

3.3 Repack the Excel-file

• Overwrite the BIN-file of the vbaProject in the archive (filename.rar) with the HEX-edited file
• Replace the extension of the archive to the original one (filename.rar → filename.xlsm)
• Open the Excel-file. The password of the VBA-project is changed to: test

3.4 Lock the vbaProject again with the original password

• Only applicable if you wish to restore the original VBA password after editing the file.
• Extract vbaProject.bin from Excel-file again
• Open it with your HEX editor
• Restore original DPB and GC values and save
• Replace vbaProject.bin file in the archive, with the modified one
• Replace the extension of the archive to the original one (filename.rar → filename.xlsm)
• The VBA-project has the original password again