How to password protect an Excel file
- Choose the workbook (.xlsx, .xlsm or .xlsb). The file is checked first; if it is already encrypted you are offered the other mode.
- Type a password twice. The strength hint helps you avoid weak passwords. Long phrases are easier to remember and harder to guess than short codes.
- Confirm you have saved it and click Encrypt and download.
- The result is checked before download: the encrypted file is opened again with your password and compared with the original, byte for byte.
- Open it in Excel. Excel asks for the password before showing anything.
Your password never leaves your device
Encryption runs in your browser, in a background worker, with the browser’s built-in Web Crypto API. Neither the file nor the password is sent anywhere, stored, or logged. The page only downloads its own code from this site. You can disconnect from the internet after the page loads and it keeps working.
That is the whole point: a tool that adds a password on a remote server would see both your file and your password.
A lost password cannot be recovered
This is real encryption, not a lock that can be bypassed. The workbook is encrypted with a random 256-bit key, and that key is protected by your password. There is no master key, no backdoor and no reset link. If the password is lost, the file is lost too: this site cannot help, Microsoft cannot help, and “password recovery” services can only try guesses, which fails against a good password. Keep the password in a password manager, and keep an unencrypted copy somewhere safe if the data matters.
What encryption is used
The tool writes the same format Excel itself uses for File › Info › Protect Workbook › Encrypt with Password: ECMA-376 Agile Encryption.
- Cipher
- AES-256 in CBC mode, with a random key for each file
- Password hashing
- SHA-512, repeated 100,000 times with a random salt, to slow down guessing
- Integrity
- HMAC-SHA512 over the encrypted data, so tampering is detected
- What is encrypted
- The whole workbook: sheets, values, formulas, sheet names, comments and document properties such as author and title. Only the file name and its size are visible.
We checked the output independently: Microsoft Excel opens the files with the password, and the open-source msoffcrypto-tool library decrypts them and confirms the integrity check.
Remove a password you know
Switch to Remove a password I know, choose the encrypted file and type its password. You get a normal copy without a password to open, useful before converting the file, importing it into another program or archiving it. Both the Agile encryption of Excel 2010 and later and the older Standard encryption of Excel 2007 are supported.
The tool only decrypts with the password you type. It never tries to guess, brute-force or crack a password.
Password to open, password to modify and sheet protection
- Password to open (what this tool adds): the file is encrypted. Without the password, nobody can see its contents.
- Password to modify: the file is not encrypted; Excel only offers to open it read-only.
- Sheet or workbook protection: stops people editing cells or moving sheets, but the data is not encrypted and Microsoft says it is not a security feature. To remove a sheet lock from your own file, use Unprotect Excel sheet.
How to do it in Excel
On Windows, go to File › Info › Protect Workbook › Encrypt with Password. On a Mac, go to File › Passwords and fill in “Password to open”. To remove it, open the file with the password and clear the same field. This page does the same without Excel, on any device, and checks the result for you.
Known limitations
- Old .xls files are not supported: their only encryption is the weak RC4 scheme of Excel 97–2003. Convert them to .xlsx first with XLS to XLSX.
- Files encrypted for a certificate or a rights-management service (IRM / Purview labels) cannot be opened here.
- Most web viewers, including Google Sheets, cannot open an encrypted workbook. The person you send it to needs Excel or another app that supports Excel encryption.
- There is no file size limit or quota. The file is processed in memory, so very large workbooks need enough RAM; on phones, keep files under about 20 MB.
- Send the password through a different channel from the file (for example, a phone call or a message app if the file goes by email).