Programming Excel with VBA and .NET

Excel Password Security

Encrypting a workbook makes it very difficult to extract passwords from a workbook by peeking inside the file in some way. However, Excel does leave passwords open to guessing attacks. In short, you can write a macro to call the Open method repeatedly with various passwords until you find one that works.

That’s because Excel doesn’t lock out attempts after a certain number of wrong passwords the way most networks do. Therefore, Excel passwords are only as good as their complexity.

For example, a four-character all-lowercase workbook password takes about 40 minutes to guess using brute-force techniques on a 2.0 GHz machine. By extrapolation, a mixed-case four-character password would take more than 10 hours, and a six-character password using any valid characters (letters, numbers, or symbols) would take 883 years.

That sounds pretty secure, but remember this is just using brute-force techniques—starting at Chr(33) and working through the valid character set. There are many ways to optimize guessing that would reduce these times. The controlling factors are how many attempts are made before guessing correctly and how long it takes Excel to run the Open method and return an error if the guess is wrong. For example, the Excel Key service on the Web promises password recovery in four to seven days regardless of password length.

These same guessing techniques can be applied to password-protected items within a workbook, such as worksheets. It is, in fact, much ...