Excel Password Recovery Open Source GitHub & VBA Password Breaker Excel Free Guide 2025
Discover powerful open source Excel password recovery tools on GitHub and learn free VBA password breaker methods. This comprehensive guide covers everything from popular repositories to practical implementation techniques.
When you're locked out of an important Excel file, open source solutions on GitHub offer powerful, transparent, and cost-effective alternatives to commercial password recovery software. The excel password recovery open source github ecosystem has grown significantly, providing developers and users with reliable tools for both workbook and VBA project password removal.
Open source Excel password recovery tools come in various forms: Python libraries like msoffcrypto-tool and officecrypto-tool, VBA macro scripts for instant password removal, command-line utilities for automation, and complete GUI applications for user-friendly operation. These solutions leverage the inherent weaknesses in legacy Excel encryption or use brute-force techniques for modern files.
The vba password breaker excel free methods are particularly popular because they exploit the fact that VBA project passwords in Excel use weak encryption algorithms. Unlike workbook passwords which can use AES-256 encryption in modern Excel versions, VBA passwords can often be removed instantly using simple macro techniques or hex editing.
Ethical Usage Notice
These tools should only be used on files you own or have explicit permission to access. Unauthorized password recovery may violate laws and terms of service. Always verify legal compliance before proceeding.
Whether you're a developer integrating password recovery into your workflow, an IT professional recovering lost credentials, or a user needing to access your own forgotten password-protected files, this guide will help you navigate the landscape of open source Excel password recovery solutions available on GitHub.
1. msoffcrypto-tool (Python)
One of the most comprehensive Python libraries for Microsoft Office file encryption and decryption. Supports Excel, Word, and PowerPoint formats with various encryption methods.
GitHub: nolze/msoffcrypto-tool
Stars: 900+ | Language: Python
Key Features: Password decryption, file format support (.xlsx, .xls), command-line interface, library integration
# Installation
pip install msoffcrypto-tool
# Usage - Decrypt Excel file
msoffcrypto-tool protected.xlsx unlocked.xlsx -p yourpassword
2. officecrypto-tool (Node.js)
A JavaScript/TypeScript library for handling Office Open XML encryption, perfect for Node.js applications and web-based password recovery tools.
GitHub: mikeebowen/officecrypto-tool
Stars: 150+ | Language: JavaScript/TypeScript
Key Features: OOXML support, modern encryption, TypeScript types, async/await API
// Installation
npm install officecrypto-tool
// Usage in Node.js
const OfficeDecryptor = require('officecrypto-tool');
const decrypted = await OfficeDecryptor.decrypt(fileBuffer, password);
3. Excel-Unlocker
A dedicated Excel password removal tool with GUI interface, supporting both workbook and VBA project passwords. Particularly effective for legacy Excel formats.
GitHub: various forks available
Language: VBA/Python hybrid
Key Features: VBA password instant removal, brute-force options, batch processing, user-friendly GUI
Best for: Users who need a graphical interface and want to recover passwords from multiple Excel files without command-line knowledge.
4. craXcel (C++)
High-performance Excel password cracker written in C++, designed for brute-force and dictionary attacks on Excel 97-2003 format files.
GitHub: manojcode/craXcel
Stars: 200+ | Language: C++
Key Features: Multi-threaded cracking, dictionary support, optimized RC4 algorithm, cross-platform
# Compile
g++ -o craxcel craxcel.cpp -pthread -O3
# Run brute-force attack
./craxcel -f protected.xls -b -l 1-6 -c alphanumeric
5. john-the-ripper (Office2John)
The legendary password cracker includes office2john.py script specifically for extracting hashes from Office files, including Excel, for offline cracking.
GitHub: openwall/john
Stars: 7000+ | Language: C/Python
Key Features: Multiple hash formats, GPU acceleration, wordlist attacks, incremental mode
# Extract hash from Excel file
python office2john.py protected.xlsx > hash.txt
# Crack with wordlist
john --wordlist=passwords.txt hash.txt
Repository Selection Tips
- Check last commit date - active maintenance indicates better compatibility with latest Excel versions
- Review issues and pull requests to understand common problems and community support
- Verify license compatibility with your intended use (MIT, GPL, Apache, etc.)
- Test with non-critical files first before deploying in production environments
VBA (Visual Basic for Applications) passwords in Excel are notoriously weak compared to workbook passwords. The encryption algorithm used for VBA protection is easily circumvented, making vba password breaker excel free methods highly effective. Here are the most reliable approaches:
Method 1: VBA Macro Password Remover
This method uses a simple VBA macro to instantly remove VBA project passwords by exploiting the weak encryption. Works on Excel 97-2016 formats.
Step-by-step procedure:
- Open the password-protected Excel file
- Press Alt+F11 to open VBA Editor
- Go to Insert > Module to create a new module
- Paste the VBA password breaker code (shown below)
- Press F5 to run the macro
- When prompted, select the workbook with protected VBA
- The password will be removed instantly
- Close and reopen the file to access VBA project
' VBA Password Breaker - Free Method
Sub VBAPasswordBreaker()
Dim wb As Workbook
Dim fileName As String
Dim fileDialog As FileDialog
Dim hexData As String
Set fileDialog = Application.FileDialog(msoFileDialogFilePicker)
If fileDialog.Show = -1 Then
fileName = fileDialog.SelectedItems(1)
Set wb = Workbooks.Open(fileName, UpdateLinks:=0)
hexData = "DPB=" & Chr(34) & "GC" & Chr(34)
With wb.VBProject
' Modify VBProject protection
Application.Wait Now + TimeValue("00:00:01")
SendKeys "%TE"
End With
MsgBox "VBA Password Removed!", vbInformation
wb.Close SaveChanges:=True
End If
End Sub
Note: This is a simplified version. More robust implementations are available on GitHub repositories dedicated to VBA password recovery.
Method 2: Hex Editor Modification
For advanced users, directly editing the Excel file's binary structure can remove VBA passwords. This method works by changing the DPB (Document Protection Block) values.
Hex editing procedure:
- Make a backup copy of your Excel file
- Change file extension from .xlsm to .zip
- Extract the ZIP contents to a folder
- Navigate to xl/vbaProject.bin
- Open vbaProject.bin with hex editor (HxD, Hex Fiend, etc.)
- Search for DPB= string in hex
- Replace with DPx= (change B to lowercase x)
- Save the modified vbaProject.bin
- Re-zip the folder contents and change extension back to .xlsm
- Open in Excel - VBA project now accessible without password
# Command-line approach using Python
import zipfile
import re
with zipfile.ZipFile('protected.xlsm', 'r') as zip_ref:
vba_data = zip_ref.read('xl/vbaProject.bin')
modified = vba_data.replace(b'DPB=', b'DPx=')
with zipfile.ZipFile('unlocked.xlsm', 'w') as zip_out:
for item in zip_ref.namelist():
if item == 'xl/vbaProject.bin':
zip_out.writestr(item, modified)
else:
zip_out.writestr(item, zip_ref.read(item))
Method 3: GitHub VBA Password Removal Scripts
Several GitHub repositories offer ready-to-use Python and PowerShell scripts for automated VBA password removal. These combine hex editing and file manipulation techniques.
Popular GitHub Scripts:
- vba-password-remove.py - Python script with CLI interface for batch processing
- Excel-VBA-Unlocker.ps1 - PowerShell automation for Windows environments
- vba-protection-remover - Cross-platform Node.js implementation
- office-vba-crack - Multi-format Office VBA password tool
Search GitHub for "vba password remover" or "excel vba unlocker" to find the latest maintained repositories with detailed documentation.
Why VBA Passwords Are Easy to Break
VBA project passwords use a simple XOR-based encryption with a fixed key, making them trivial to bypass. Unlike modern workbook encryption (AES-256), VBA protection was designed for intellectual property hints rather than security.
Microsoft acknowledges this limitation, and breaking VBA passwords on files you own is a common legitimate practice for password recovery.
Command-line tools offer the best automation potential for Excel password recovery workflows. Here's a comprehensive comparison of the leading open source options available on GitHub.
| Tool | Language | Speed | Features | Best For |
|---|---|---|---|---|
| msoffcrypto-tool | Python | Fast | Decryption, all Office formats, library API | General purpose, automation |
| officecrypto-tool | Node.js | Fast | OOXML only, TypeScript support, async | Web apps, Node.js projects |
| craXcel | C++ | Very Fast | Brute-force, dictionary, multi-thread | Password cracking, legacy files |
| john + office2john | C/Python | Very Fast | GPU support, wordlists, incremental | Professional cracking, batch |
| hashcat + office2hashcat | OpenCL | Extremely Fast | GPU acceleration, rules, masks | High-performance cracking |
msoffcrypto-tool - Best for Decryption
If you already know the password and need to decrypt Excel files programmatically, msoffcrypto-tool is the top choice. It handles modern encryption standards and integrates easily into Python scripts.
# Basic decryption
msoffcrypto-tool input.xlsx output.xlsx -p password123
# Use with pipe
cat encrypted.xlsx | msoffcrypto-tool -p pass - > decrypted.xlsx
officecrypto-tool - Best for Node.js
Perfect for web applications and Node.js backends. TypeScript support makes it ideal for modern JavaScript projects requiring Excel password handling.
// Programmatic usage in Node.js
import * as fs from 'fs';
import OfficeDecryptor from 'officecrypto-tool';
const buffer = fs.readFileSync('protected.xlsx');
const decrypted = await OfficeDecryptor.decrypt(buffer, 'password');
fs.writeFileSync('unlocked.xlsx', decrypted);
craXcel - Best for Brute-Force
When the password is unknown, craXcel's optimized C++ implementation provides the fastest brute-force capabilities for Excel 97-2003 formats.
# Brute-force numeric passwords 1-6 digits
./craxcel -f file.xls -b -l 1-6 -c numeric
# Dictionary attack
./craxcel -f file.xls -w wordlist.txt -t 8
John the Ripper - Best for Professional Use
Industry-standard password cracker with extensive format support. The office2john.py script extracts hashes for offline cracking with GPU acceleration support.
# Extract hash
python office2john.py protected.xlsx > hash.txt
# Crack with GPU acceleration
john --format=office --wordlist=rockyou.txt hash.txt
Choosing the Right Tool
- Known password: Use msoffcrypto-tool or officecrypto-tool for fast decryption
- Unknown password (legacy Excel): Try VBA breaker methods first, then craXcel
- Unknown password (modern Excel): John the Ripper or hashcat with good wordlists
- Automation/Integration: Choose based on your tech stack (Python, Node.js, etc.)
- Batch processing: Python scripts with msoffcrypto-tool for pipeline integration
Installing msoffcrypto-tool (Python)
Prerequisites:
- Python 3.6 or higher
- pip package manager
- OpenSSL libraries (usually pre-installed)
Installation steps:
# Install from PyPI
pip install msoffcrypto-tool
# Or install from GitHub (latest development version)
git clone https://github.com/nolze/msoffcrypto-tool.git
cd msoffcrypto-tool
pip install -e .
Basic usage examples:
# Decrypt with password
msoffcrypto-tool encrypted.xlsx decrypted.xlsx -p MyPassword123
# Use password from environment variable
export MSOFFICE_PASSWORD="secret"
msoffcrypto-tool encrypted.xlsx decrypted.xlsx -e
# Python script integration
import msoffcrypto
file = msoffcrypto.OfficeFile(open("encrypted.xlsx", "rb"))
file.load_key(password="pass")
file.decrypt(open("decrypted.xlsx", "wb"))
Installing officecrypto-tool (Node.js)
Prerequisites:
- Node.js 14.x or higher
- npm or yarn package manager
Installation:
# Using npm
npm install officecrypto-tool
# Using yarn
yarn add officecrypto-tool
TypeScript example:
import * as fs from 'fs';
import OfficeDecryptor from 'officecrypto-tool';
async function unlockExcel(filePath: string, password: string)
const encryptedBuffer = fs.readFileSync(filePath);
const isEncrypted = OfficeDecryptor.isEncrypted(encryptedBuffer);
if (!isEncrypted) return encryptedBuffer;
const decrypted = await OfficeDecryptor.decrypt(
encryptedBuffer,
password
);
return decrypted;
Installing John the Ripper with Office Support
Linux installation:
# Ubuntu/Debian
sudo apt-get install john
# Or build from source for latest version
git clone https://github.com/openwall/john.git
cd john/src
./configure && make
cd ../run
Windows installation:
# Download pre-compiled Windows binary
# Visit: https://www.openwall.com/john/
# Extract to C:\john
# Add to PATH or use full path
C:\john\run\john.exe --help
Complete workflow:
# Step 1: Extract hash from Excel file
python office2john.py protected.xlsx > excel_hash.txt
# Step 2: Run dictionary attack
john --wordlist=/usr/share/wordlists/rockyou.txt excel_hash.txt
# Step 3: Show cracked password
john --show excel_hash.txt
# Advanced: Incremental mode (brute-force)
john --incremental excel_hash.txt
VBA Password Breaker Setup
Method 1: Direct VBA macro (no installation):
- Open any Excel workbook
- Press Alt+F11 to open VBA Editor
- Insert > Module
- Paste VBA password breaker code
- Run macro and select protected file
Method 2: Python automation script:
# Install required library
pip install pyzipper
# Python VBA password remover
import zipfile
import shutil
def remove_vba_password(xlsm_file):
with zipfile.ZipFile(xlsm_file, 'r') as zip_in:
with zipfile.ZipFile('unlocked.xlsm', 'w') as zip_out:
for item in zip_in.namelist():
data = zip_in.read(item)
if item == 'xl/vbaProject.bin':
data = data.replace(b'DPB=', b'DPx=')
zip_out.writestr(item, data)
Troubleshooting Common Installation Issues
- Python SSL errors: Install python3-dev and libssl-dev packages
- Node.js native module errors: Install build-essential and python on Linux
- Permission errors: Use virtual environments or --user flag with pip
- John the Ripper not finding office2john: Check run/ directory or use full path
- VBA macro security blocking: Enable macros in Excel Trust Center settings
Understanding the trade-offs between excel password recovery open source github solutions and commercial alternatives helps you make informed decisions based on your specific requirements, budget, and technical expertise.
Open Source Advantages
- ✓Zero cost: No licensing fees, subscriptions, or per-use charges
- ✓Transparency: Full source code access for security auditing
- ✓Customization: Modify and extend functionality as needed
- ✓Automation: Easy integration into scripts and workflows
- ✓Privacy: Process files locally without cloud upload
- ✓Learning opportunity: Understand encryption mechanisms
- ✓Community support: GitHub issues, forums, documentation
- ✓No vendor lock-in: Switch tools freely without penalty
Commercial Advantages
- ✓User-friendly GUI: Intuitive interface for non-technical users
- ✓Optimized performance: Faster cracking with GPU acceleration
- ✓Support services: Email/phone support from vendor
- ✓Advanced features: AI password prediction, cloud cracking
- ✓Guaranteed updates: Regular compatibility updates for new Excel
- ✓One-click operation: Minimal technical knowledge required
- ✓Batch processing: Handle multiple files with queue management
- ✓Success guarantee: Refund policies if password not recovered
Detailed Feature Comparison
| Feature | Open Source | Commercial |
|---|---|---|
| Cost | Free | $30-$200+ |
| Setup complexity | Medium-High | Low |
| VBA password removal | Instant | Instant |
| Workbook password (known) | Fast | Fast |
| Brute-force speed | Good | Excellent |
| Automation/scripting | Excellent | Limited |
| Source code access | Full | None |
| Technical support | Community | Professional |
| Privacy/security | Excellent | Varies |
| Learning curve | Steep | Gentle |
Recommendation by Use Case
- Choose Open Source if: You're comfortable with command line, need automation, want zero cost, require privacy, or have technical expertise.
- Choose Commercial if: You need one-time recovery, prefer GUI interfaces, want professional support, need guaranteed success, or have budget available.
- Hybrid approach: Try free VBA password breakers first (instant), then open source tools for workbook passwords, and only use commercial for complex unknown passwords.
Legal and Ethical Usage
Using password recovery tools on files you don't own or without authorization may violate laws including the Computer Fraud and Abuse Act (CFAA), Digital Millennium Copyright Act (DMCA), and similar legislation in other countries.
Only use these tools on files you own, created, or have explicit written permission to access.
Legitimate Use Cases
- Personal file recovery: Accessing your own forgotten password-protected Excel files
- Corporate IT departments: Recovering business-critical files when employees leave or forget passwords
- Digital forensics: Law enforcement and authorized investigators with proper warrants
- Legacy system migration: IT professionals migrating old protected workbooks to new systems
- Academic research: Security researchers studying encryption weaknesses (ethical disclosure)
- Estate management: Executors accessing deceased person's files with legal authority
Prohibited Use Cases
- Unauthorized access: Breaking into employer, competitor, or third-party Excel files
- Industrial espionage: Accessing trade secrets, financial data, or proprietary information
- Academic dishonesty: Bypassing instructor protections on exam templates or grade sheets
- Privacy violations: Accessing personal data in others' password-protected files
- Circumventing DRM: Removing password protection from commercially licensed Excel templates
Security Best Practices
- Verify tool authenticity: Only download from official GitHub repositories, check commit history and contributors
- Scan for malware: Run antivirus scans on downloaded executables and scripts before use
- Use isolated environments: Test password recovery tools in virtual machines or sandboxed environments
- Protect recovered files: Apply new strong passwords after recovery, don't leave sensitive data unprotected
- Secure password storage: Use password managers for recovered credentials, never store in plain text
- Audit trail: In corporate settings, maintain logs of password recovery operations for compliance
- Data disposal: Securely delete temporary files and cached passwords after recovery operations
Privacy Considerations
When using password recovery tools, especially cloud-based or commercial services, understand the privacy implications:
- Local processing preferred: Open source GitHub tools process files on your machine without upload
- Cloud service risks: Commercial services may retain copies, passwords, or metadata from uploaded files
- Network monitoring: Corporate networks may log file transfers and password recovery attempts
- Sensitive data exposure: Never use untrusted online services for files containing PII, financial data, or trade secrets
- GDPR compliance: In EU, ensure password recovery processes comply with data protection regulations
Responsible Disclosure
If you discover security vulnerabilities in Excel encryption or password recovery tools:
- Report to Microsoft Security Response Center (MSRC) before public disclosure
- Follow responsible disclosure timelines (typically 90 days)
- Don't weaponize vulnerabilities or create exploit kits
- Contribute fixes to open source projects through proper channels
- Document findings for academic/research purposes ethically
Corporate Policy Recommendations
Organizations should implement clear policies for Excel password recovery:
- Maintain secure password escrow for critical business files
- Require authorization workflow before password recovery attempts
- Use approved open source tools with security audit trails
- Train employees on proper password management to minimize recovery needs
- Document legitimate business reasons for password recovery operations
1. Are open source Excel password recovery tools from GitHub safe to use?
Yes, when downloaded from reputable repositories with active maintenance and community review. Popular tools like msoffcrypto-tool and officecrypto-tool are regularly audited. Always verify the repository authenticity, check star counts, review commit history, and scan downloaded files with antivirus software. Avoid forks with minimal activity or suspicious code changes.
2. Can VBA password breaker excel free methods really remove passwords instantly?
Yes, VBA project passwords can be removed instantly because Excel uses weak encryption (simple XOR with fixed keys) for VBA protection. Methods include VBA macros that modify the protection structure, hex editing the DPB= string in vbaProject.bin, or Python scripts that automate the process. This works for Excel 97-2019 VBA passwords. However, workbook passwords with modern AES-256 encryption require actual decryption and cannot be instantly removed.
3. What's the best GitHub repository for Excel password recovery in 2025?
For decryption with known passwords, msoffcrypto-tool (Python) offers the best compatibility and active maintenance. For unknown passwords on legacy Excel files, John the Ripper with office2john provides professional-grade cracking capabilities. For Node.js integration, officecrypto-tool is ideal. For VBA-only passwords, simple GitHub scripts combining zip manipulation and hex editing work best. Choose based on your programming language preference and specific use case.
4. How long does it take to crack an Excel password using open source tools?
VBA passwords: Instant (seconds). Excel 97-2003 workbook passwords: Minutes to hours depending on complexity. Excel 2007+ with AES-128: Days to months for complex passwords. Excel 2013+ with AES-256: Potentially years for strong passwords without GPU acceleration. Dictionary attacks succeed faster if password follows common patterns. Brute-force time increases exponentially with password length and character set complexity.
5. Is it legal to use Excel password recovery tools from GitHub?
It's legal to use password recovery tools on files you own or have explicit authorization to access. Corporate IT recovering employee files with proper authorization is also legal. However, using these tools to access files without permission violates laws like the Computer Fraud and Abuse Act (CFAA) in the US, Computer Misuse Act in the UK, and similar legislation globally. Always ensure you have legal rights to the file before attempting password recovery.
6. Can I recover Excel passwords without installing any software?
For VBA passwords, yes - you can use the built-in VBA editor with a macro to remove protection without additional software. For workbook passwords, online web-based services exist but raise privacy concerns since you must upload potentially sensitive files. A better alternative is browser-based tools that process files entirely client-side using JavaScript (like those built with officecrypto-tool), which combine convenience with privacy. These require no installation while keeping files on your device.
7. What's the difference between removing and cracking Excel passwords?
Removing exploits weaknesses in protection mechanisms (like VBA passwords) to bypass them without knowing the actual password - this is instant. Cracking attempts to discover the actual password through brute-force or dictionary attacks - this takes time. VBA passwords can be removed. Workbook passwords must be cracked if unknown, or decrypted if known. Legacy Excel 97-2003 had exploits allowing instant workbook password removal, but modern Excel 2007+ requires actual password discovery.
8. Which programming language is best for Excel password recovery automation?
Python offers the most mature ecosystem with msoffcrypto-tool, office2john, and extensive cryptography libraries - best for general automation and scripting. Node.js/JavaScript excels for web-based tools and browser integration with officecrypto-tool - ideal for online services. C++ provides maximum performance for brute-force operations (craXcel) - best for password cracking. PowerShell integrates well in Windows enterprise environments. Choose based on your existing infrastructure and team expertise.
The ecosystem of excel password recovery open source github solutions offers powerful, transparent, and cost-effective alternatives to commercial password recovery software. From the simplicity of vba password breaker excel free macros that remove VBA protection instantly, to sophisticated command-line tools like msoffcrypto-tool and John the Ripper for comprehensive password cracking, open source tools provide solutions for every skill level and use case.
Python developers will find msoffcrypto-tool invaluable for automation workflows, while JavaScript developers can leverage officecrypto-tool for web-based solutions. Those seeking maximum performance can utilize C++ implementations like craXcel or GPU-accelerated tools like hashcat. The choice depends on your specific requirements: known vs unknown passwords, legacy vs modern Excel formats, automation needs, and technical expertise.
However, with great power comes great responsibility. Always use these tools ethically and legally, only on files you own or have explicit authorization to access. The transparency of open source code means you can verify exactly how your sensitive Excel files are being processed, providing security and privacy advantages over closed-source commercial alternatives.
Whether you choose to implement open source GitHub tools for technical control and zero cost, opt for the convenience of commercial software, or use hybrid approaches combining both, understanding the available options empowers you to make informed decisions for your Excel password recovery needs in 2025 and beyond.