Password encryption in Excel
Microsoft Excel 2002 (XP), 2003 and 2007 enable you to use password encryption.
This is standard functionality; no additional file encryption software is needed.
This article describes how to use the Excel password encryption options of
Excel 2002 and 2003 in a secure way. If the instructions are followed properly,
the result is an encrypted Excel spreadsheet that can only be opened by entering the
How to Password Protect or Encrypt Excel Spreadsheets
- How to set spreadsheet security in Excel 2002/2003
- File security settings in Excel 2002/2003
- File encryption is based on "open password"
- Set "advanced" property (Crypto Service Providers)
- Choose a strong password
- The result is a proper encrypted Excel spreadsheet
- Secure email with Excel files
How to set spreadsheet security in Excel 2002/2003
There is not something like an "encryption button" in Excel. On the other hand,
encrypting Excel spreadsheets is just a few clicks away.
- route 1: Tools | Options | Tab
File encryption options in Excel via the 'Tools' Menu
- route 2: File | Save As | Tools | General
Options | Tab Security
File encryption options in Excel via the 'Save As' Menu
Security settings in Excel 2002/2003
The Security tab shows different security settings:
- Open password
This password is used for spreadsheet encryption. This
security feature is discussed in the next paragraph.
- Modify password
This password is used for convenience when sharing
spreadsheets. This password does *not* encrypt the spreadsheet and therefore does
not add security. This modify password opens the Excel spreadsheet in an
editable modus but prevents the original file from being overwritten.
The modify password is stored within the Excel spreadsheet. There are tools
available that can extract and remove this modify password.
- Read-only recommended
This is a recommendation
to the person opening the spreadsheet. On opening, Excel asks the
user to choose read-only unless the user thinks that changes to
the spreadsheet are necessary. It's just a recommendation, no
Document encryption is based on "open password" So the only security password is the 'open' password, the 'modify' password and read-only setting offer no real security and can be removed by Excel password recovery tools.
Set "Advanced" property (Crypto Service Providers) Behind the password to open field, there is an "advanced" button. Click this button to get the list of available Crypto Service Providers.
List of available Crypto Service Providers in Windows
A Crypto Service Provider or CSP is a set of cryptographic algorithms with different properties. The default CSP is "Office 97/2000 Compatible". This is a CSP with public known security issues.
Spreadsheets that are secured with the "weak encryption (XOR)" or with the "Office 97/2000 Compatible" encryption type can be cracked within 30 seconds.
Thus, the default CSP provides no security.
For strong encryption of Excel spreadsheets one *must* change to the strongest available CSP, which may differ per Windows installation.
It's also important to choose the proper encryption key length. Some of the Crypto Service Providers don't support more than 40 or 56 bits. That's considered weak encryption. For strong encryption a minimum key length of 128 bits is required. Fortunately Windows contains Crypto Service Providers that offer strong encryption as well, for example the 'Microsoft Strong Cryptographic Provider'. To give an idea, 128 bits encryption is what banks use to encrypt the connection with their Internet Banking systems.
Choose a strong password If a strong Crypto Service Provider is chosen, there is one other requirement to achieve proper spreadsheet encryption: choose a strong password with a minimum length of 10 characters that is not easy to guess.
The result is a proper encrypted Excel spreadsheet For strong encryption of Excel spreadsheets, set the "open password", select a strong Crypto Service Provider, set the key length to at least 128 bits, choose a strong password and click "OK". The result is an encrypted Excel spreadsheet that can only be opened by entering the correct password. There are password crackers that can generate and try every possible password combination, but it will take thousands of years to find the correct password of this spreadsheet.
Is Excel encryption really secure? Read all about it!
This kind of knowledge about Excel file security cannot be expected from the average user. Many people end up with "secure" Excel spreadsheets that are in fact not secure at all! To help creating proper secured Excel spreadsheets EncOffice is available.
|EncOffice - Easy and Safe Encryption of Word and Excel Files
Secure email with Excel files
Encrypted Excel files can be attached to an email message. This is a form of secure email.
How to use Excel for Secure Email