Guides / Sheet protection or encryption
Sheet protection versus file encryption: which Excel lock do you have?
Updated August 30, 2026
Excel has three separate features that people all describe with the same sentence: “the file has a password”. One of them is genuine encryption that nobody can undo. One is a suggestion. One is a marker in an XML file. Which one you have decides whether your afternoon involves a minute of work or a difficult conversation.
The ten second test
| What you see | Which lock, and what it means |
|---|---|
| A password box before any content appears | Encrypt with Password. Real encryption. Without the password the contents are unreadable, by you or anyone else. |
| It opens, offering read-only or a password for write access | Password to modify. Not encryption. Open read-only and save a copy. |
| It opens fully, but editing a cell is refused | Sheet or workbook protection. An XML element Excel honours. Removable. |
| It opens, but the macro editor asks for a password | VBA project protection. Separate again, and it protects the code rather than the data. |
Confirm it by looking at the bytes
If you want certainty, open a copy of the file in any text editor and look at the first two characters.
- PK means an ordinary ZIP-based workbook. Whatever is stopping you is inside the file, and inside the file is reachable. This is what sheet protection looks like.
- ÑÒ or a run of unreadable symbols starting with D0 CF 11 E0 means an OLE2 compound file. For something named .xlsx that means the workbook is encrypted, and the whole thing is scrambled. It is also what a genuine legacy .xls looks like, so check the extension before concluding anything.
What each lock is really doing
Encrypt with Password replaces the file with an encrypted container. The key is derived from your password through a large number of hashing rounds, which is what makes guessing impractical rather than merely slow. There is no back door, no vendor override, and no tool that removes it: anything advertising otherwise is selling you a brute force attempt. This is the correct feature to use for a workbook that must stay private, and the one to be careful with, because losing the password loses the data.
Password to modify, set under Save As and then General Options, is not encryption at all. The file opens for anyone; the password only gates saving over the original. Open it read-only and save a copy, and you have an editable workbook. It is a politeness mechanism, useful for stopping accidents, useless as security.
Sheet and workbook protection writes an element into the worksheet or workbook XML with a hash of the password. Excel reads that element and refuses edits. The cell data alongside it is completely untouched, so removing the element restores normal editing. That is not a flaw in Excel. Protection exists to stop colleagues wrecking a model by accident, and it does that job well. It was never meant to withstand someone with the file and an hour.
What you can do about each
- Encrypted, password known. Open it, then File, Info, Protect Workbook, Encrypt with Password, and clear the box to remove it.
- Encrypted, password lost. Look in your password manager, ask whoever set it, and ask IT whether an unencrypted copy exists in a backup or a mail attachment. If none of that works, the honest answer is that the data is gone. Recovery services offer brute force, which fails against any decent password.
- Password to modify. Open read-only, then Save As under a new name. Done.
- Sheet protection. Remove the element, either by hand or with a tool. The step by step is here.
Why the distinction is worth caring about
These two things get described identically and are not remotely the same act. Removing an edit lock from a workbook you maintain is housekeeping. Getting past encryption on a file somebody deliberately sealed is circumvention, and any tool that blurs the line is telling you something about how it will treat you elsewhere. It is also a useful test of a vendor: one that offers to remove any Excel password is either misdescribing what it does or planning to fail expensively.
Not sure which one you are holding?
FileQuiet's sheet unlock reads the workbook in your browser and tells you for free. If it finds an encrypted file it says so plainly and offers you nothing to buy, because removing open encryption is not something it does. If it finds sheet or workbook protection, it names the sheets and the number of markers before you decide anything. Removing them is $9 one time, and if the file turns out to have no protection at all it tells you that too, again for free.
Check which lock your file hasHonest limits: the free scan covers worksheet and workbook edit protection. It does not decrypt, it does not recover passwords, and it does not touch VBA project protection.
Frequently asked
Can any tool remove an Excel password to open?
Not by removing it. The contents are encrypted with a key derived from the password, so without the password there is nothing to open, only ciphertext. Products that promise removal are running a guessing attack, which succeeds against short and common passwords and fails against everything else. Treat the promise as a warning sign.
If sheet protection comes off so easily, why use it?
Because it is a safety rail, not a vault. It stops a colleague pasting over the formula column in a shared model, which is the thing that actually happens. If a workbook holds information that must stay private, encrypt it, and accept the trade that a lost password means lost data.
My file opens read-only and I never set a password. Why?
Several things produce that. The read-only recommended flag, a file marked read-only by the operating system, a document open in another session or on a network share, and files from the internet opening in Protected View. Check the file's properties and the yellow banner at the top of the window before assuming a password is involved.
Does removing sheet protection change my data?
No. The protection element sits beside the cell data, not inside it. Values, formulas, charts and formatting are unaffected by its removal. The risk in doing it by hand is in rebuilding the ZIP archive afterwards, which is why working on a copy matters.