In most small businesses, Excel is where the sensitive data ends up. Payroll, client lists, pricing models, bank details for suppliers, HR trackers. These files get emailed, saved to laptops and copied to USB sticks far more often than anyone would like to admit.
Adding a password feels like the responsible thing to do, and it is a good start. The problem is that Excel offers several features with the word “protect” in the name, and only one of them protects the file from being read. If you pick the wrong one, you get the feeling of security without the substance.
How Do You Password Protect an Excel File on Windows?
This works in Excel for Microsoft 365, Excel 2024, 2021, 2019 and 2016.
-
- Open the workbook you want to protect.
- Select File > Info.
- Select Protect Workbook and choose Encrypt with Password.
- Type a password and select OK.
- Type the same password again to confirm it and select OK.
- Save the file.
To check it worked, go back to File > Info. You should see a note that a password is required to open the workbook.
Two things to remember: passwords are case sensitive, and if you forget the password, Microsoft cannot retrieve it for you. Store it in a password manager before you close the file.
How Do You Password Protect an Excel File on a Mac?
-
- Open the workbook.
- Go to File > Passwords.
- Enter a Password to open. This is the one that encrypts the file.
- Optionally add a Password to modify if you want people to enter a second password before they can edit.
- Select OK, re-enter the passwords when asked and save the file.
Can You Password Protect an Excel File in Excel for The Web?
No. Excel for the web lets you set a workbook to open in read only mode, but it cannot encrypt a workbook with a password. To add a password, select Editing > Open in Desktop App and follow the Windows or Mac steps above.
How Do You Remove A Password From an Excel File?
Open the file using the current password. Go to File > Info > Protect Workbook > Encrypt with Password, delete the password from the box, select OK and save. On a Mac, go back to File > Passwords and clear the field.
This only works if you know the password. There is no official way to remove it without one.
Which Excel Protection Options Actually Protect Your Data?
Excel has six features that people commonly treat as security. Only one of them is.
|
Option |
Where to find it |
What it does |
Does it keep data private? |
|---|---|---|---|
|
Encrypt with Password |
File > Info > Protect Workbook |
Encrypts the whole file. Nobody can open it without the password. |
Yes |
|
Password to modify |
File > Save As > Tools > General Options |
Asks for a password before editing. Anyone can still open the file as read only. |
No |
|
Protect Sheet |
Review > Protect Sheet |
Locks cells so they cannot be changed. |
No |
|
Protect Workbook (structure) |
Review > Protect Workbook |
Stops people adding, deleting, moving or renaming sheets. |
No |
|
Mark as Final |
File > Info > Protect Workbook |
Labels the file as final. Anyone can click Edit Anyway. |
No |
|
Hidden sheets |
Right click a sheet tab > Hide |
Hides a sheet from view. |
No |
A useful rule: if the password is optional, there is no encryption. Sheet and structure protection are there to stop someone overwriting a formula by accident. They do nothing to stop a person reading the data, and in an unencrypted file the contents of a “protected” or hidden sheet can be read by anyone who opens the file’s underlying XML.
You can combine options. For example, encrypt a file you are sending to an accountant, and also protect the sheets inside it so formulas do not get broken.
A useful rule: if the password is optional, there is no encryption. Sheet and structure protection are there to stop someone overwriting a formula by accident. They do nothing to stop a person reading the data, and in an unencrypted file the contents of a “protected” or hidden sheet can be read by anyone who opens the file’s underlying XML.
You can combine options. For example, encrypt a file you are sending to an accountant, and also protect the sheets inside it so formulas do not get broken.
How strong is Excel’s encryption?
Strong, as long as you save in a modern format. Since Office 2016, Excel encrypts .xlsx files by default with AES using a 256-bit key and SHA-2 hashing. That is the same family of encryption used across the security industry.
The catch is the file format. Files saved in the old .xls format can only be encrypted with RC4, an older and much weaker method kept for compatibility. If you still have .xls files with sensitive data, open them and save them as .xlsx before you add a password.
What does Excel password protection not protect?
This is where most people get caught out. Encryption protects the file while it sits on a laptop or travels by email. It does not cover any of the following.
Anyone who already has the password
Once a person opens the file, they can copy the data into a new workbook, print it, screenshot it or paste it into an email. The password controls who gets in, not what happens afterwards.
A password sent the wrong way
Sending the password in the same email as the attachment, or in a reply to the same thread, cancels out the encryption. Anyone who gets into that mailbox gets both. Share the password through a different channel, such as a phone call, a text message or a business password manager.
Weak passwords
AES is not the weak point. The password is. Someone who has a copy of the file can run password guessing tools against it offline, with no lockout and no limit on attempts. A short or common password can fall quickly. Use a long passphrase of four or more random words, or a generated password stored in a password manager.
Access you want to take back later
A password protected file has no expiry date, no way to revoke access and no record of who opened it. If you email it to the wrong person, or a contractor leaves, there is nothing you can do to that copy.
A compromised device
If malware is running on the laptop where the file is opened, it can capture the password as it is typed or read the data once the file is open. Encryption protects files at rest, not the device using them.
Day to day collaboration
Microsoft lists password protection as one of the reasons co-authoring does not work. AutoSave stops working too. In practice, teams then make unprotected copies to get their work done, which defeats the purpose.
Your own access
If you lose the password, you lose the data. Microsoft has no reset option and cannot recover it.
Need help protecting sensitive files across your business?
At Lucidica, we help London SMEs keep their data secure without slowing their teams down. As an ISO 27001:2022 certified managed IT and cybersecurity provider, we can set up Microsoft 365 sensitivity labels, secure sharing, password management and device encryption across your business, so protection does not depend on everyone remembering the right Excel menu.
