Editing Microsoft Excel (section)

=== Password protection ===
{{Main|Microsoft Office password protection}}

Microsoft Excel protection offers several types of passwords:
* Password to open a document<ref>{{cite web|url=http://office.microsoft.com/en-us/word-help/password-protect-documents-workbooks-and-presentations-HA010148333.aspx#BM1|title=Password protect documents, workbooks, and presentations|publisher=Office.microsoft.com|access-date=April 24, 2013|archive-date=February 12, 2014|archive-url=https://web.archive.org/web/20140212134311/http://office.microsoft.com/en-us/word-help/password-protect-documents-workbooks-and-presentations-HA010148333.aspx#BM1|url-status=live}}</ref>
* Password to modify a document<ref>{{cite web|url=http://office.microsoft.com/en-us/word-help/password-protect-documents-workbooks-and-presentations-HA010148333.aspx#BM3a|title=Password protect documents, workbooks, and presentations|publisher=Office.microsoft.com|access-date=April 24, 2013|archive-date=February 12, 2014|archive-url=https://web.archive.org/web/20140212134311/http://office.microsoft.com/en-us/word-help/password-protect-documents-workbooks-and-presentations-HA010148333.aspx#BM3a|url-status=live}}</ref>
* Password to unprotect the worksheet
* Password to protect workbook
* Password to protect the sharing workbook<ref>{{cite web|url=http://office.microsoft.com/en-us/excel-help/password-protect-worksheet-or-workbook-elements-HP005201059.aspx|title=Password protect worksheet or workbook elements|publisher=Office.microsoft.com|access-date=April 24, 2013|url-status=dead|archive-url=https://web.archive.org/web/20130326192849/http://office.microsoft.com/en-us/excel-help/password-protect-worksheet-or-workbook-elements-HP005201059.aspx|archive-date=March 26, 2013}}</ref>
All passwords except ''password to open a document'' can be removed instantly regardless of the Microsoft Excel version used to create the document. These types of passwords are used primarily for shared work on a document. Such password-protected documents are not [[encrypted]], and data sources from a set password are saved in a document's [[Header (computing)|header]]. ''Password to protect workbook'' is an exception – when it is set, a document is encrypted with the standard password "VelvetSweatshop", but since it is known to the public, it actually does not add any extra protection to the document. The only type of password that can prevent a trespasser from gaining access to a document is the ''password to open a document''. The cryptographic strength of this kind of protection depends strongly on the Microsoft Excel version that was used to create the document.

In ''Microsoft Excel 95'' and earlier versions, the password to open is converted to a 16-bit [[Key (cryptography)|key]] that can be instantly cracked. In ''Excel 97/2000'' the password is converted to a 40-bit key, which can also be cracked very quickly using modern equipment. As regards services that use [[rainbow tables]] (e.g. Password-Find), it takes up to several seconds to remove protection. In addition, password-cracking programs can [[brute-force attack]] passwords at a rate of hundreds of thousands of passwords a second, which not only lets them decrypt a document but also find the original password.

In ''Excel 2003/XP'' the encryption is slightly better – a user can choose any encryption algorithm that is available in the system (see [[Cryptographic Service Provider]]). Due to the CSP, an ''Excel'' file cannot be decrypted, and thus the ''password to open'' cannot be removed, though the brute-force attack speed remains quite high. Nevertheless, the older ''Excel 97/2000'' algorithm is set by the default. Therefore, users who do not change the default settings lack reliable protection of their documents.

The situation changed fundamentally in ''Excel 2007'', where the modern [[Advanced Encryption Standard|AES]] algorithm with a key of 128 bits started being used for decryption, and a 50,000-fold use of the hash function [[SHA1]] reduced the speed of brute-force attacks down to hundreds of passwords per second. In ''Excel 2010'', the strength of the protection by the default was increased two times due to the use of a 100,000-fold SHA1 to convert a password to a key.