Protect Sheet or Workbook

[Mike1001]

Did you know that there is more than the one password you have entered when protecting a sheet or workbook that can remove the protection?
In fact, I found 8960 password combinations for one password entered (three digits) that remove the protection!
Using a relatively simple VBA macro, you can crack a three digit password in just three seconds, four digits in 24 seconds, five digits in less than 100 seconds maximum.
Even for nine digit passwords, it will not take longer than seven hours to crack them!

All you need to run through in the first loop is characters 128 and 129, last loop characters 32 through 255 and all loops in between through characters 126 through 129.

For users trying to protect their work this means they should use at least 10 characters for their passwords!

[dominicb]

Good morning Mike1001

This is a serious weakness in Excels' security features, which are well known for their flimsiness. The weakness that you are referring is well known and documented.

When protection is applied using the Tools > Protection > Protect Worksheet or Protect Workbook the password supplied is not saved. The password (irrespective of length or characters used) will have an algorithm applied to it which will convert it to a 12 digit string and it is this 12 digit string that is saved as the password. When the correct password is entered to unprotect the sheet, the algorithm will be applied and the new string created will be compared to the saved version and if the two match, Excel will unprotect the file. The 12 digit string is not as secure as it may sound as the first 11 characters will be one of two possible values (A or B) and the twelfth character will be one of 95 possible values (from ASCII value 32 - 126). This means that there are approximately 195,000 possible combinations of the 12 digit string and for a reasonably modern computer it is no great task for each possible combination to be tried until the correct one is found.

However the password routine that can be used to protect workbooks from opening (File > Save, Tools > General Options) and to protect macros and VBA routines from being accessed is much more robust. Even so, this can still be circumvented by use of specialist cracking software, which is easily obtainable, or by a knowledgeable user with a hex editor

DominicB

[Mike1001]

Thanks for the reply, DominicB

I didn't think it was that bad!

Best regards
Mike