Excel 365 Online vs Desktop — Password Recovery Differences

Encryption support — Office 365 Online vs Desktop

Excel Desktop supports the full Office encryption suite: file-open passwords with AES-128 (Office 2007-2010, mode 9400), AES-256/SHA-1 (Office 2013, mode 9500), and AES-256/SHA-512 (Office 2016+, mode 9600). It also supports agile encryption (XML Encryption with ECMA-376 standard) and the legacy binary RC4 modes (Office 97-2003, modes 9700 and 9800).

Excel Online (browser version) does NOT support file-open password encryption at all. A workbook encrypted with a file-open password cannot be opened in the browser — Excel Online displays an error and requires the user to open the file in the desktop application. This is by design: the browser JavaScript engine cannot perform the Office key-derivation function in a performant way, and Microsoft has chosen not to implement it.

Sheet-level protection and workbook structure protection ARE supported in Excel Online — these protect individual sheets from editing (formulas, formatting changes) without encrypting the file. These are structurally removable in both Online and Desktop environments.

File-open password recovery — desktop mode comparison

Excel Desktop file-open passwords use hashcat modes 9400 (Office 2007-2010, AES-128, 50,000 SHA-1 iterations), 9500 (Office 2010-2013, AES-256, 100,000 SHA-1 iterations), and 9600 (Office 2016+, AES-256, 100,000 SHA-512 iterations). The iteration count and hash algorithm determine per-candidate verification speed.

Mode 9400 achieves approximately 1,200,000 H/s on an RTX 4090, mode 9500 achieves ~650,000 H/s, and mode 9600 (SHA-512 iteration) achieves ~280,000 H/s. The SHA-512 iteration in mode 9600 is deliberately expensive to throttle brute-force attacks.

Excel Online has no equivalent hash modes. Since Online cannot open encrypted files, there is no encrypted blob to extract. If a user has been working exclusively in Excel Online and their file is encrypted, the encryption must have been applied in Desktop — and recovery also requires Desktop-side techniques.

Sheet protection in Excel Online vs Desktop

Excel Online supports sheet protection (Review > Protect Sheet) with the same XML-based structure as Desktop. In both environments, sheet protection does NOT encrypt the worksheet XML — it stores a hash of the password that gates editing, formatting, and structural operations.

The sheet protection password hash is stored in the sheet's XML: <sheetProtection password="..." /> with a SHA-1 hash algorithm. This is identical between Online and Desktop. Both store the same XML structure in the same .xlsx ZIP archive.

Because sheet protection is structural (not encryption), it is equally removable in both environments. The technique: unzip the .xlsx, locate the worksheet XML, and remove the <sheetProtection> element. Excel Online users who protect a sheet in the browser and forget the password can recover via the same structural edit as Desktop users.

Workbook structure protection differences

Workbook structure protection (preventing sheet rename, delete, insert, move operations) is also supported in Excel Online. The <workbookProtection> element is stored in the workbook.xml file of the .xlsx archive.

Like sheet protection, workbook structure protection is hash-based and structurally removable. The same unzip-edit-rezip technique works for Excel Online protected files. The protection is identical in both environments — Excel Online writes the same XML as Desktop.

VBA project protection is NOT accessible in Excel Online. Excel Online cannot open the VBA editor or execute macros. If a workbook has VBA project password protection, it must be opened in Desktop Excel (or a third-party VBA editor) to remove or bypass the protection.

AutoSave implications for password protection

Excel Online saves automatically to OneDrive or SharePoint. If a file is encrypted with a file-open password, Excel Online cannot save changes to it — the Save operation fails silently or prompts the user to save a copy. This can result in data loss if the user is unaware that Online cannot handle encrypted files.

Excel Desktop with AutoSave enabled (OneDrive/SharePoint) triggers a save on every change. For encrypted files, AutoSave works in Desktop because Desktop can decrypt, modify, and re-encrypt. However, version history in OneDrive stores intermediate encrypted versions — recovery of a previous password-protected version may require cracking each version's password independently if different passwords were used.

Best practice: if you need to share an encrypted Excel file via OneDrive/SharePoint, set the password in Desktop, save, and instruct recipients to open in Desktop. Using Online for encrypted files creates confusion and potential data loss.

Co-authoring and real-time collaboration

Excel Online supports co-authoring (multiple users editing simultaneously) for files stored on OneDrive/SharePoint. File-open password encryption DISABLES co-authoring — encrypted files cannot be co-authored in either Online or Desktop.

Sheet protection allows co-authoring: multiple users can edit different unprotected sheets simultaneously. The protection only restricts specific editing actions on protected sheets, not file access. This makes sheet protection the preferred model for collaborative environments where some sheets should be read-only.

For enterprise environments: SharePoint Information Rights Management (IRM) provides an alternative to password protection that works in the browser. IRM permissions apply at the user/group level rather than at the document level. IRM-protected files can be opened in Excel Online without a password prompt, but recovery of IRM-gated content follows a different process (contacting the SharePoint administrator).

Practical recovery decision tree

Scenario 1: File opened with a password prompt and you can't remember it — this is a file-open password. The file must be opened in Desktop Excel to even evaluate the encryption tier. Run a free analysis to determine the hashcat mode and password complexity before pursuing recovery.

Scenario 2: The file opens in Excel Online but you can't edit certain cells/sheets — this is sheet protection. The password is structurally removable; any recovery service can remove it in seconds. You can also do it yourself by editing the worksheet XML.

Scenario 3: The file was created entirely in Excel Online and now asks for a password — check whether the file was originally encrypted in Desktop or if the protection is at the sheet/workbook level. If the file was truly created in Online and has a file-open password, something else set that password (the user must have opened it in Desktop at some point).

Scenario 4: Co-authoring stopped working — check if a file-open password was recently added. Removing the password restores collaboration features. Sheet protection does not block co-authoring.

Recovery decision flow by protection type

1. 1

   Identify the protection type

   File asks for password on open? = file-open encryption. File opens but sheets are locked? = sheet protection (structurally removable).

2. 2

   Check if the file opens in Excel Online

   If it opens in Online but not Desktop, or vice versa, this tells you the protection type immediately.

3. 3

   For file-open encryption

   Must be handled in Desktop. Run a free analysis to determine hashcat mode (9400/9500/9600) and password complexity.

4. 4

   For sheet/workbook protection

   Structurally removable via XML edit. Any recovery service or DIY unzip-patch works in seconds.

5. 5

   For collaboration issues

   File-open password blocks co-authoring. Remove the password or switch to sheet protection for collaborative workflow.

Frequently Asked Questions

Related Reading