Best Way to Recover an XLSX Excel File Password
Q: I need to recover a password for an xlsx file. What is the "best way" or "best program" to do this?
A: XLSX files are Microsoft Excel 2007–2024 documents encrypted with AES. The only way to recover the password is brute force (trying every possible combination), and success is not guaranteed: the more complex the forgotten password, the longer the search.
The good news: there are two ways to dramatically cut recovery time:
- GPU acceleration on NVIDIA/AMD/Intel Arc graphics cards
- narrowing the search range with masks and dictionaries
When choosing software, these two capabilities are what determine the outcome.
Everything above applies equally to Microsoft PowerPoint (pptx) and Word (docx) files: encryption and password recovery methods are identical across all Microsoft Office formats.
Try Accent OFFICE Password Recovery by Passcovery. The program supports GPU acceleration and flexible attack configuration for all versions of Microsoft Office.
 |
Accent OFFICE Password Recovery for all versions of Microsoft Office and OpenOffice/LibreOffice files |
|
| ||
Why is brute force the only option for xlsx?
XLSX/DOCX/PPTX files in Office 2007–2024 use AES encryption with a 128- or 256-bit key – a federal standard adopted by the National Institute of Standards and Technology. Without the correct password, the file contents are a random stream of bytes. There are no workarounds or backdoors.
But it is important to distinguish between two types of protection in Excel. The type determines the method, the time, and the chances of success:
| Protection type | Difficulty | What to do |
|---|---|---|
| Sheet/workbook protection (editing restriction), VBA password | Removed instantly | Free scripts or AccentOPR |
| Open password (AES‑encryption) | Requires brute force | AccentOPR with GPU‑acceleration |
Excel sheet protection is tape on a box: anyone can peel it off in a second, contents intact.
Encryption with an open password is a welded seam: without an angle grinder (brute force), you can't cut through, and the thickness of the weld (password length and complexity) determines how long it takes.
Free scripts handle the "tape." For the "welded seam," you need AccentOPR with GPU‑acceleration.
How to speed up Excel password recovery?
GPU acceleration on NVIDIA, AMD, and Intel Arc graphics cards increases brute-force speed by tens of times compared to CPU (specific benchmarks). For xlsx/docx/pptx this is critical: the difference between days on CPU and hours on GPU can be decisive.
GPUs are faster because password cracking maps perfectly onto parallel GPU architecture: thousands of cores test thousands of combinations simultaneously. CUDA and OpenCL technologies deliver a substantial speed advantage here.
The second factor is narrowing the search range. If you remember anything at all about the forgotten password, put it to use:
- positional mask assigns character sets individually for each position in the password
- dictionary merging and mutation covers passwords built from modified words
Expert tip: how to speed up Excel password recovery
Denis Gladysh, CEO of Passcovery:
Narrow the search range before you launch the program. Recall the approximate password length, what characters you used, whether it contained words or dates. Each detail like this reduces search time by orders of magnitude – sometimes from years to hours.
All ways to remove an Excel password – a detailed guide
Beyond brute force, there are free methods for simpler protection types: VBA scripts, the ZIP method for editing XML metadata inside xlsx files (the format is based on the open ECMA-376 standard), and online services for decrypting legacy xls files. Each method works within its own limits and for specific versions of Excel, Word, and PowerPoint.
A detailed breakdown of every method – from free scripts to professional tools with GPU acceleration – is available in the article "How to Crack, Break or Just Remove a Forgotten Excel Password for Free/a Fee".
About the Author
Denis Gladysh, co-owner and head of Passcovery – a provider of high-speed GPU-accelerated password recovery software for popular file formats. Author of the original Accent OFFICE Password Recovery, first released in 1999.
Frequently asked questions about Excel password recovery
Is Excel password recovery legal – can I crack my own file?
Yes, as long as you own the data or are authorized to access it.
Here are situations where password recovery is a perfectly routine task:
- you forgot the password to your own work or personal file
- an employee left the company without handing over document passwords
- a former employee deliberately locked corporate files
- your organization is conducting an internal audit or investigation
- you need to retrieve data from old archives or backups
Recovering passwords on files you don't own or aren't authorized to access is illegal. Accent OFFICE Password Recovery is designed for files you have a legitimate right to open.
How long does it take to crack a forgotten xlsx password with GPU acceleration?
Anywhere from minutes to "never." Recovery time depends on three things: password length, character set, and file format version. Length and character set determine the search space, while the format version controls recovery speed through the number of key stretching iterations (the spinCount parameter).
Below are estimates for Excel 2013–2024 (AES-256, SHA-512, spinCount = 100,000). These are full brute-force times without any mask:
| Password length | Character set | RTX 4060 | RTX 5090 |
|---|---|---|---|
| 6 characters | lowercase (a–z) | ~6 hours | ~1 hour |
| 6 characters | lowercase + digits | ~1.9 days | ~8 hours |
| 8 characters | lowercase (a–z) | ~6 months | ~1 month |
| 8 characters | mixed-case + digits | ~512 years | ~89 years |
| 10 characters | all printable ASCII | millions of years | millions of years |
Excel 2007 (AES-128, SHA-1, spinCount = 50,000) is considerably faster to crack: the RTX 4060 delivers ~186,700 p/s, and the RTX 5090 exceeds one million. The same 8-character lowercase password that would take half a year on Excel 2024 is found in a couple of weeks on an RTX 4060 and in a couple of days on an RTX 5090.
The search space grows exponentially: (character set size)password length. With a 62-character alphabet (a–z, A–Z, 0–9), every extra character in the password multiplies the number of candidates by 62. Even a top-tier RTX 5090 won't help if the password is long and mixes upper/lowercase letters, digits, and special characters. That's why brute-forcing the entire search space blindly is a bad idea: a positional mask and dictionary attack with mutations shrink it by orders of magnitude, turning years into days.
AccentOPR does all this math for you. While you're setting up a task, the program shows the total number of combinations and the estimated recovery time before you hit Start. You can see right away whether the job is feasible or whether you need to narrow the range with a mask.
Can I recover the password from an xlsx file online, or do I need to install software?
For an xlsx file with an open password – realistically, no. Excel 2007–2024 files are encrypted with AES-128/256 and key stretching: the algorithm deliberately slows down every verification attempt. An online service checks a few hundred passwords per second; a GPU on your own machine checks tens of thousands. An online tool might handle a trivial password like "123," but anything real is out of reach.
That's why xlsx recovery calls for AccentOPR installed locally. Your file never leaves your computer, the cracking runs on your own GPU, and the speed difference compared to the cloud is orders of magnitude.
Older formats are a different story, though. Files with RC4 encryption and a short 40-bit key can be decrypted online with guaranteed results. The AccessBack.com service handles xls (Excel 97–2003), doc (Word 97–2003), and PDF 1.0–1.4 with a 100% success rate.
How does a mask attack help recover a forgotten Excel password faster?
A mask narrows the search space: instead of trying every possible combination, the program only checks candidates that match the password structure you remember.
Here's how it plays out with real numbers. A 7-character password, GeForce RTX 4060 GPU, Excel 2024, recovery speed ~13,500 p/s:
- Full brute force over the entire alphabet (a–z, A–Z, 0–9): 3.5 trillion combinations. That's over 8 years of waiting
- Mask
?c*s?d?d(you recall: capital letter first, lowercase in the middle, two digits at the end): 1.19 billion combinations. That's about 24 hours
One hint about the password's structure turned 8 years into a single day. It's called a positional mask in AccentOPR because each position in the password gets its own character set. Syntax details and examples are in a dedicated article.
Does an Excel 2013–2024 password take longer to crack than an Excel 2007 file?
Yes – several times longer. Microsoft tightened protection with every release, and each upgrade hits recovery speed directly:
- Excel 2007: AES-128, SHA-1 hash, 50,000 key stretching iterations. The fastest modern format to brute-force
- Excel 2010: AES-128, SHA-1 hash, but 100,000 iterations. Recovery is twice as slow as 2007
- Excel 2013–2024: AES-256, SHA-512 hash, 100,000 iterations. SHA-512 is computationally heavier than SHA-1, slowing things down by several more times
Bottom line: the very same password on an Excel 2007 file is found several times faster than on Excel 2013+. For newer formats, GPU acceleration goes from nice-to-have to a must.
Everything above applies equally to Microsoft PowerPoint (pptx) and Word (docx) files: the encryption algorithms and hash iteration counts are identical across versions.