Excel 365 Online vs Desktop — Password Recovery Differences

Encryption support — Office 365 Online vs Desktop

Excel Desktop supports file-open encryption across several Office generations. Older Standard Encryption files use AES-128 in the documented 9400/9500 families; newer Agile Encryption files can use AES-128 or AES-256 with configurable KDF parameters. The exact mode must be read from the file's EncryptionInfo rather than inferred from the Office year alone. Legacy binary files use separate RC4 modes.

Excel Online (browser version) has partial support for file-open password encryption. Microsoft added Password to Open support to Excel for the web in late 2021, so a workbook encrypted with a file-open password can be viewed and edited in the browser once the password is entered — but it cannot be co-authored there. Microsoft has not documented why the browser implementation remains narrower than the desktop one.

Sheet-level protection is supported in Excel Online: it protects individual sheets from editing (formulas, formatting changes) without encrypting the file, and is structurally removable in both Online and Desktop environments. Workbook structure protection is a different matter — Microsoft's capability list for Excel for the web names only Sheet Protection, so do not assume structure protection behaves the same in the browser.

File-open password recovery — desktop mode comparison

Excel Desktop file-open passwords use separate hashcat mode families for Office generations. Standard Encryption and Agile Encryption can differ in cipher, hash, key size, and spin count; inspect the file's EncryptionInfo instead of inferring AES-256 from the Office year.

Measured RTX 4090 figures from a published hashcat benchmark log: mode 9400 ≈ 860,000 H/s, mode 9500 ≈ 430,000 H/s and mode 9600 (SHA-512 iteration) ≈ 68,000 H/s. The 2:1 ratio between 9400 and 9500 follows directly from the 50,000 vs 100,000 SHA-1 iterations each candidate costs, and mode 9600 is far slower again because 100,000 SHA-512 compressions per candidate put its hardware ceiling at roughly 75,000 H/s on that card. Benchmark your own GPU with `hashcat -b -m 9600` before planning a run.

Excel Online has no equivalent hash modes. Encryption is applied and removed in the desktop application, so if a user has been working exclusively in Excel Online and their file is encrypted, the encryption was applied in Desktop — and recovery also requires Desktop-side techniques.

Sheet protection in Excel Online vs Desktop

Excel Online supports sheet protection (Review > Manage Protection > Protect sheet) with the same XML-based structure as Desktop, though some protection options remain desktop-only. In both environments, sheet protection does NOT encrypt the worksheet XML — it stores a password verifier that gates editing, formatting, and structural operations.

That verifier is stored on the <sheetProtection> element in the sheet's XML, and there are two mechanisms, not one. The legacy password attribute holds a 16-bit XOR verifier — four hex characters, no salt, no hash function, trivially reversible. Modern Excel instead writes algorithmName="SHA-512" with saltValue, hashValue and spinCount="100000"; SHA-1 is only the ECMA-376 default when algorithmName is absent. Both Online and Desktop store the same XML structure in the same .xlsx ZIP archive.

Because sheet protection is structural (not encryption), it is equally removable in both environments. The technique: unzip the .xlsx, locate the worksheet XML, and remove the <sheetProtection> element. Excel Online users who protect a sheet in the browser and forget the password can recover via the same structural edit as Desktop users.

Workbook structure protection differences

Workbook structure protection (preventing sheet rename, delete, insert, move operations) is a Desktop feature: Microsoft's capability list for Excel for the web names only Sheet Protection. The <workbookProtection> element is stored in the workbook.xml file of the .xlsx archive.

Like sheet protection, workbook structure protection is hash-based and structurally removable. The same unzip-edit-rezip technique applies to any protected .xlsx, whichever application produced it.

VBA project protection is NOT accessible in Excel Online. Excel Online cannot open the VBA editor or execute macros. If a workbook has VBA project password protection, it must be opened in Desktop Excel (or a third-party VBA editor) to remove or bypass the protection.

AutoSave implications for password protection

AutoSave is unavailable for file-open-encrypted workbooks. Microsoft's AutoSave troubleshooting lists removing password encryption from the file (File > Info > Protect Workbook) as the fix for a greyed-out AutoSave switch, and AutoSave is disabled whenever a workbook contains password protection. Saving an encrypted workbook is therefore a manual operation — make sure changes are saved deliberately rather than assuming a continuous autosave is running.

Excel Desktop with AutoSave enabled (OneDrive/SharePoint) triggers a save on every change — but not for file-open-encrypted workbooks, where AutoSave is switched off and saving is manual. One consequence is that OneDrive version history only captures the saves you made by hand: there are no intermediate encrypted versions being written in the background, so if you want a rollback point, save a copy deliberately.

Best practice: if you need to share an encrypted Excel file via OneDrive/SharePoint, set the password in Desktop, save, and tell recipients that the browser can open it with the password but that co-authoring and AutoSave are not available while the file stays encrypted.

Co-authoring and real-time collaboration

Excel Online supports co-authoring (multiple users editing simultaneously) for files stored on OneDrive/SharePoint. File-open password encryption DISABLES co-authoring — encrypted files cannot be co-authored in either Online or Desktop.

Sheet protection allows co-authoring: multiple users can edit different unprotected sheets simultaneously. The protection only restricts specific editing actions on protected sheets, not file access. This makes sheet protection the preferred model for collaborative environments where some sheets should be read-only.

For enterprise environments: SharePoint library Information Rights Management (IRM) can give users read-only access to IRM-protected files in Office for the web, when the library allows browser preview — but not edit access. IRM-protected documents cannot be co-authored; editing requires the desktop app, removing the protection, or the separately licensed Microsoft Purview Information Protection co-authoring capability. Note too that IRM applied from an Office application rather than from a SharePoint library is not supported in the browser at all. Recovery of IRM-gated content follows a different process (contacting the SharePoint administrator).

Practical recovery decision tree

Scenario 1: File opened with a password prompt and you can't remember it — this is a file-open password. The encryption tier is read from the file's EncryptionInfo with an extraction tool (office2john, office2hashcat, msoffcrypto-tool), so the file does not need to be opened in Excel to be analysed. Run a free analysis to determine the hashcat mode and password complexity before pursuing recovery — the cracking itself is Desktop-side work.

Scenario 2: The file opens in Excel Online but you can't edit certain cells/sheets — this is sheet protection. The password verifier is structurally removable, not encryption; you can do it yourself by editing the worksheet XML.

Scenario 3: The file was created entirely in Excel Online and now asks for a password — check whether the file was originally encrypted in Desktop or if the protection is at the sheet/workbook level. If the file was truly created in Online and has a file-open password, something else set that password (the user must have opened it in Desktop at some point).

Scenario 4: Co-authoring stopped working — check if a file-open password was recently added. Removing the password restores collaboration features. Sheet protection does not block co-authoring.

Recovery decision flow by protection type

1. 1

   Identify the protection type

   File asks for password on open? = file-open encryption. File opens but sheets are locked? = sheet protection (structurally removable).

2. 2

   Identify the layer from the symptom, not from the app

   Which application opens the file is not a reliable diagnostic — Excel for the web can open password-protected workbooks too. A password prompt before any content = file-open encryption. Content visible but cells or sheets locked = sheet or workbook protection.

3. 3

   For file-open encryption

   Must be handled in Desktop. Run a free analysis to determine hashcat mode (9400/9500/9600) and password complexity.

4. 4

   For sheet/workbook protection

   Structurally removable via XML edit — no cracking involved, and no password needed.

5. 5

   For collaboration issues

   File-open password blocks co-authoring. Remove the password or switch to sheet protection for collaborative workflow.

Frequently Asked Questions

Related Reading