Sometimes you just need the password

Microsoft Office Password Recovery

Word / Excel / Powerpoint

Microsoft Office Document Password Recovery Password recovery (cracking) of protected Office documents such as Word (doc/docx) or Excel (xls/xlsx) can be achieved by simply guessing the password. No this is not a joke. Guessing the password is the only way to crack the hash. However, you can do better than typing in thousands of passwords by hand. Using password recovery tools such as John the Ripper (jtr) or Hashcat simple passwords crumble when attacked.

Try our free online password recovery tool below to quickly determine if a password protected document has a weak password. The number of attempts at recovering the passwords will depend on the version of Microsoft Office the document was saved in. The number of passwords tested will be millions for older versions of Office such as Office 97/2003 or only a few thousand in later versions of Microsoft Office 2013 / 2016.

When recovery of a password can affect the businesses bottom line it pays to have an understanding of the art of password recovery. Whether you work in Cyber Security or are an IT support professional, a bit of knowledge about passwords and recovery will go a long way.

The version of Office used greatly affects the ability to crack the hash. Later versions of Microsoft Office are very difficult as they use a much stronger algorithm to protect the document. Earlier releases are easily cracked through the weak algorithms used.

Benchmark Microsoft Office Password Cracking with Hashcat (RTX 3090)

In this chart it is clear to see the version of Microsoft greatly affects the hash rate when attacking passwords generated for these documents.

Password recovery has a wealth of jargon that can mean the same thing or very different things depending on the password breaking technique being used. Decrypting, decoding and brute forcing are all different ways that a password can be attacked. In the end the correct technical phrase does not matter when you just want to get the password to your locked up XLS budget!

Test password protection in documents including Microsoft Office 2016, 2013, 2010 and more. Depending on the version we will test thousands or even millions of possible passwords in a matter of seconds.

Password Recovery of Microsoft Office Documents using John the Ripper

Using John the Ripper to find the password of an Office Document is a relatively straight forward process. It involves first extracting the hash using a script that is actually bundled with John the Ripper (jumbo community edition). Note that the John the Ripper version should be the Jumbo version to have the included scripts for extracting password hashes.


      test@ubuntu:~$ office2john.py Documents/test-pass3.doc
      test-pass3.doc:$oldoffice$1*0b50d48778cc821e2ee5487440fc2cde*c0f65e3c31f106f5e219991ef698e9c2*83d1be759884b408852b49663ca64436:::::Documents/test-pass3.doc

To use the hash for the test-pass3.doc we need to redirect it to a file so that john can read the hash from the file. See the steps below to extract the hash to a file and then run john against that file using the default cracking method.


        test@ubuntu:~$ office2john.py Documents/test-pass3.doc > test-pass3.hash
        test@ubuntu:~$ john test-pass3.hash
        Using default input encoding: UTF-8
        Loaded 1 password hash (oldoffice, MS Office <= 2003 [MD5/SHA1 RC4 32/64])
        Cost 1 (hash type [0-1:MD5+RC4-40 3:SHA1+RC4-40 4:SHA1+RC4-128 5:SHA1+RC4-56]) is 1 for all loaded hashes
        Will run 4 OpenMP threads
        Proceeding with single, rules:Single
        Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
        Almost done: Processing the remaining buffered candidate passwords, if any.
        0g 0:00:00:00 DONE 1/3 (2022-03-01 22:18) 0g/s 142568p/s 142568c/s 142568C/s Doctest1900..Dpass31900
        Proceeding with wordlist:john/run/password.lst
        Enabling duplicate candidate password suppressor
        password'        (test-pass3.doc)     
        1g 0:00:00:01 DONE 2/3 (2022-03-01 22:18) 0.8547g/s 338229p/s 338229c/s 338229C/s 032892..winner17
        Use the "--show --format=oldoffice" options to display all of the cracked passwords reliably
        Session completed.

We can see here that john discovered the password with the default password.lst used by JtR.