Guides / Forgot a sheet protection password

Forgot the password on a protected Excel sheet

Updated August 30, 2026

The workbook opens. You can read every cell. You type in one of them and Excel tells you the sheet is protected, and the password you set eighteen months ago is gone from your head and from every note you have ever written.

The good news is that you are not trying to break encryption, whatever the word password suggests. You are trying to remove a marker.

The cell or chart you're trying to change is on a protected sheet. To make a change, unprotect the sheet.

Check which lock you actually have

If the file asked for a password before showing you anything, stop: that is file encryption and nothing on this page applies. See the guide on telling the two apart. If the workbook opened and only editing is blocked, you have sheet protection, and it comes off.

What sheet protection is made of

An .xlsx file is a ZIP archive of XML. When you protect a sheet, Excel writes one element into that sheet's XML:

Newer files carry algorithmName, hashValue, saltValue and spinCount instead of that short legacy hash, which makes guessing the password harder. It makes no difference to the outcome, because Excel is the only thing checking. The cell data is not encrypted, not scrambled and not touched. Delete the element and the sheet behaves normally again.

Which is why the goal is not to recover the password. It is to delete one XML element. You do not get the password back by any of these routes.

The free routes, in order

Copy the data into a new workbook. Most protected sheets still allow selecting cells. Select all, copy, and paste into a blank workbook. If what you need is the numbers rather than this exact file, you are finished. Formulas come across, though any that reference other sheets need those sheets too.
Edit the XML yourself. This is the route that always works. Work on a copy. Rename report.xlsx to report.zip and extract it. Open xl/worksheets/sheet1.xml in a text editor, find the <sheetProtection .../> element, and delete it in full, from the opening bracket to the closing slash. Repeat for each sheet file that has one, and check xl/workbook.xml for a <workbookProtection/> element if you also cannot add or rename sheets.
Re-zip it correctly. This is where people lose an afternoon. You must zip the contents of the extracted folder, not the folder itself. From inside it: zip -r ../fixed.xlsx . on macOS or Linux. On Windows, select all the items inside the folder, right-click, and send them to a compressed folder. Then rename the result back to .xlsx. If Excel greets it with a complaint that the file format is not valid, you zipped the wrong level; see that error explained.
Google Sheets, if the data can leave. Upload the workbook and open it with Sheets. Excel's sheet protection does not usually survive the import, so you can edit and download as .xlsx again. Two conditions: the file goes to Google's servers, and Sheets rewrites the workbook, so macros, pivot tables and elaborate formatting may not come back the same.
LibreOffice Calc, worth one attempt. Open the file and try Tools, then Protect Sheet, to toggle protection off. Whether it asks for the password depends on the version, so treat this as a free thing to try rather than a plan.

The macro from the forum

You will find a VBA macro that loops through character combinations and announces a “usable password”. It targets the short legacy hash in older files, so it is irrelevant to a modern workbook, and it was never necessary in the first place: deleting the element does directly what the macro does by collision. Running unfamiliar VBA to solve a problem a text editor solves is a poor trade.

Do this on your own files

Sheet protection usually exists to stop colleagues breaking a model by accident, not to keep you out. Removing it from a workbook you own or maintain is ordinary maintenance. Removing it from someone else's file to get at something you were not given is not, and the fact that it is technically easy does not change that. If the sheet belongs to a colleague, the two minute conversation is cheaper than any of this.

If you would rather not hand-edit XML

FileQuiet's sheet unlock does the same operation in your browser tab: it reads the workbook locally, tells you for free exactly which sheets carry protection and how many markers it will remove, then strips those elements and re-zips the file correctly. Your cell data, formulas and formatting are left exactly as they were. Nothing is uploaded, and if the workbook has no protection it says so and there is nothing to pay for. It is $9 one time when there is.

Scan a locked workbook, free

Honest limits: this removes the edit lock only. A file that needs a password to open is real encryption and is refused with an explanation rather than attempted. Neither route recovers the original password.

Frequently asked

Will removing sheet protection damage my formulas or formatting?

No. The protection element sits alongside the sheet's data rather than inside it, so removing it changes nothing about cells, formulas, charts or styles. The one thing that does cause damage is re-zipping the archive incorrectly, which is a packaging mistake rather than a data one, and is why you should always work on a copy.

Is this the same as cracking the password?

No, and the difference matters. Cracking means recovering the secret. This removes the check that consults it. You never learn the password, so if you need to re-protect the sheet later you will be choosing a new one.

I deleted the element and now Excel says the file is corrupt.

Almost always the re-zip. The archive must have [Content_Types].xml at its root, which means you zipped the contents of the extracted folder rather than the folder itself. Extract a fresh copy and try again from inside the folder. A text editor that re-encoded the XML on save can also do it, so use a plain editor rather than a word processor.

What if I need the password itself, not just the ability to edit?

Then none of this helps. Modern files store a salted hash with a high iteration count precisely so it cannot be reversed, and the older format's short hash gives you a collision rather than the original text. If the password is used elsewhere, look in a password manager or ask whoever set it.