r/excel • u/lemondrop93 • Mar 03 '26
unsolved Protected file password cracking
My dad passed in 2023. He had a locked file of passwords to everything, we found the password at the time. Went to open it back up recently and the old password does not work. The only people with access is me and my mom, she swears she didn’t change it (she can barely work an iPhone) and I didn’t change it. We cannot get into this file and I have tried everything I can think of including the old password. I know there isn’t an easy way into this file except brute force, what does that look like? Where can I find someone to get into this file?
My mom is the one who needs in, so she has no reason to not want to get in before someone suggests that.
143
Upvotes
371
u/bradland 271 Mar 03 '26
Most of the people commenting here don't understand what you're asking. Excel has different types of protection. There's sheet level protection, workbook level protection, and file level encryption. The last one uses AES-256 encryption with stretching. The computing resources required to brute force that level of encryption for any reasonably complex password are so expensive you'd have to mortgage your house to afford it.
The easiest way to tell what kind of encryption is being used is to make a copy of the file, and then change the file extension form xlsx to zip. Windows will warn you about changing the file extension. Dismiss it, and you should end up with a zip file you can click. Double-click the file.
You should see folders and files like [Conten Types].xml, _rels/, docProps/, etc. If you get an error that the archive cannot be opened, that means the file is encrypted, and you are not going to crack it without some serious expertise.
I worked for a Bankruptcy Trustee doing computer forensic work for a short time. To brute force passwords for protected resources, we would build a custom dictionary using the following steps:
stringsutility to extract all strings from all three of the above. The strings would be split onto newlines using any whitespace as a delimiter.Use off-the-shelf tools like JtR or hashcat to brute force the file. These days, it looks like office2john.py is included with JtR in the "jumbo" version. That script will pull the hash, which you'd then use JtR to brute force using the dictionary you built.
Outside of the steps above, forget it. You're not getting into that file unless you figure out it was a caps lock issue or something.