Comparison Guide

Remove Password from Word Document: Free vs Paid Methods

Forgot the password on a Word document? Before paying for a recovery service, you need to identify which type of Word protection you are dealing with. There are three separate layers: document editing restrictions (structurally removable, free), VBA project password (structurally removable, free), and file-open encryption (requires real cryptographic work, paid services justified). This guide walks through each layer, shows the free methods, and explains exactly when paid recovery makes sense.

Identifying the type of Word password protection

Word has three distinct password layers, and most confusion comes from treating them as interchangeable. The correct identification determines whether the fix is free (two minutes, no tools) or requires paid recovery.

Layer 1 — Editing restrictions (Review > Restrict Editing). If Word opens the document and shows content but blocks editing, this is a structural hash stored in the document XML. It is trivially removable without the password. Every free method works on this layer.

Layer 2 — VBA project password (Tools > VBAProject Properties > Protection). If the document opens, content is visible, but you cannot view macro code — the password gates only the VBA editor. Also structural: the macro source code is compressed plaintext in the file. Free removal in seconds.

Layer 3 — File-open encryption (File > Info > Protect Document > Encrypt with Password). Word asks for a password before showing any content. This is real encryption with key derivation — AES-256 with a 100,000-iteration SHA-512 derivation in modern .docx files, or RC4 with an MD5/SHA-1-derived key in legacy .doc — and free methods do NOT work here, because the file's streams are themselves encrypted. This layer requires cryptographic recovery via hashcat or a paid service.

First question: does Word show content before asking for a password?

If Word shows content, the protection is structural and free to remove. If it demands a password before showing anything, look one step further before paying: a 'password to modify' prompts in exactly the same way, yet the document opens read-only for free and its hash is structurally removable. Only a 'password to open' file is encrypted and needs cryptographic recovery.

Free method 1 — Remove editing restrictions via XML edit

Word document editing restrictions (also called restricted editing or formatting restrictions) are stored as a single XML element inside the .docx archive. Removing it takes under two minutes.

Steps: (1) Make a backup copy of the .docx file. (2) Rename the copy from document.docx to document.zip. (3) Open the ZIP with any archiver (7-Zip, Windows built-in). (4) Navigate to word/settings.xml. (5) Find the <w:documentProtection> element and delete it entirely. (6) Save the change, rename back to .docx, open in Word — editing restrictions are gone.

This method works on all modern .docx files from any Word version (365, 2021, 2019, 2016). It also works on .docm (macro-enabled) files. The element looks like: <w:documentProtection w:edit="readOnly" w:enforcement="1" w:cryptProviderType="rsaAES" w:cryptAlgorithmClass="hash" w:cryptAlgorithmType="typeAny" w:cryptProvider="Microsoft Enhanced RSA and AES Cryptographic Provider" w:cryptAlgorithmSid="14" w:cryptSpinCount="100000" w:hash="..." w:salt="..." />

Free method 2 — Copy-paste to a new document

If you cannot be bothered with XML editing, a trivial bypass: open the protected document in Word (it opens read-only), select all (Ctrl+A), copy (Ctrl+C), open a new blank document, and paste (Ctrl+V). The new document has no editing restrictions.

This works because the content is always readable — only the editing gate is locked. Caveats: formatting may shift slightly, tracked changes are flattened, and macros do not transfer. For quick content recovery, it is the fastest free method.

Free method 3 — VBA project password removal

If the document has a VBA project password (you can open the document but cannot view macro code), the fix is structural. In a .docm the project is stored as word/vbaProject.bin; a legacy .doc has no such part — the project lives in an OLE storage inside the binary compound file and is reached with an OLE-aware tool such as oledump.

The stored password is a salted SHA-1 digest obfuscated into the PROJECT stream's DPB= value: per [MS-OVBA] 2.3.1.16 the DPB data is a 29-byte hash data structure (a 4-byte salt plus a 20-byte SHA-1 digest) when a password is set, and the encoded value is at least 16 hex digits — real DPB strings run to 50-odd characters. There is no flag byte to flip: removing the gate means replacing that obfuscated value, and because the ID, CMG, DPB and GC lines are keyed to the project ID, the reliable method is to replace all four lines with those from an unprotected project and repackage the file.

A quicker trick is to rename the DPB= line to DPx=, which makes Word ignore it. That works on many builds but is not dependable — newer and 64-bit Office builds can leave the project unreadable afterwards — so treat it as a convenience for throwaway files rather than a method. For a .docm the edited vbaProject.bin is zipped back into the archive; for a .doc the edit happens inside the compound file.

There is no maintained general-purpose free tool for this in oletools: its own tool list covers oleid, olevba, mraptor, msodde, oleobj, rtfobj, olebrowse, olemeta, oletimes, oledir and olemap, none of which patch VBA protection, and the request to add that feature is still an open issue in its tracker. The nearest packaged project, Sorlas/Excel-VBA-Project-Password-Remover, is Excel-only. For Word, the manual line replacement above is the method.

When paid recovery is justified — file-open password

File-open password encryption (Encrypt with Password in the Info panel) is the only Word protection layer where paid recovery services are legitimately useful. The document content is protected with AES-256 under a 100,000-iteration SHA-512 key derivation in modern .docx files, or with RC4 under an MD5/SHA-1-derived key in legacy .doc files.

No XML edit, no VBA patch, no copy-paste bypass works because the content itself is ciphertext. The only path to recovery is cryptographic: try candidate passwords until one decrypts the file successfully.

Paid services justify their cost here by maintaining GPU hardware and orchestration a consumer PC does not have — multiple GPUs, cloud instances and high-throughput candidate generation. On a modern .docx the honest figure is millions of candidates per second across such a cluster, not billions: the 100,000-iteration SHA-512 derivation puts a single flagship GPU in the tens of thousands of candidates per second (posted hashcat mode 9600 benchmarks sit around 28,000 H/s). Billions per second is a legacy-file figure — 40-bit RC4 on mode 9700 really does run at roughly a billion candidates per second per GPU — and no service achieves it against an Office 2013+ file.

Ordered attack strategies (dictionary plus rules, Markov-driven masks, PCFG models) matter more than raw throughput for human-chosen passwords, and they are where a paid service adds the most over a single-PC attempt.

Free vs paid comparison table

The decision matrix for Word password removal:

Editing restrictions (read-only, can't edit): FREE — XML edit, any .docx
VBA project password (can't view macros): FREE — replace the obfuscated DPB value in the PROJECT stream
File-open password (can't open file at all): PAID — cryptographic recovery via GPU hardware or a service
Modify password: FREE — .docx: delete <w:writeProtection> from word/settings.xml; legacy .doc: strip the write-reservation hash in the FIB
Mark as Final (yellow banner): FREE — click 'Edit Anyway', no password involved

Why free methods cannot handle file-open encryption

Modern Word file-open encryption uses ECMA-376 Agile Encryption (MS-OFFCRYPTO 2.3.4.7/2.3.4.11). An encrypted .docx is not a ZIP any more — it becomes an OLE compound file containing an EncryptionInfo stream and an EncryptedPackage stream, and the whole package is encrypted as a single payload in AES-CBC segments. Unzipping it is not merely useless, it does not work.

The key comes from a salted, 100,000-iteration SHA-512 derivation (hashcat mode 9600) — PBKDF2-style, though the specification defines its own iterated hash chain rather than PBKDF2's HMAC construction. There is no element to delete, no flag to patch and no structural shortcut: the password is the only key, and without it recovery means searching the password space, so the outcome turns on password strength rather than on which tool you buy.

This is the exact boundary between 'free DIY fix' and 'paid recovery service.' Any service that claims to 'remove Word password instantly' but cannot distinguish between editing restrictions, a modify password and file-open encryption is either misinformed or misleading.

Word password type identification flow

1
Try to open the document
If Word shows content = structural protection (free fix). If Word demands a password before showing anything, establish whether it is file-open encryption or a password to modify before paying anyone.
2
If content is visible but editing blocked
Editing restrictions. Rename to .zip, edit word/settings.xml, remove <w:documentProtection>. Free.
3
If the prompt is a password to modify
Clear the prompt and the document opens read-only — no cracking needed. The hash is removable: delete <w:writeProtection> from word/settings.xml for .docx, or strip the write-reservation hash in the FIB for legacy .doc. Free.
4
If content is visible but VBA locked
VBA project password. Replace the obfuscated DPB value in the PROJECT stream — ideally the ID/CMG/DPB/GC lines together. Free; there is no single flag byte to flip.
5
If it is a password to open
File-open encryption. No structural method works. Attack it with hashcat on your own hardware using the matching mode, or use a paid recovery service — and expect the result to depend on password strength.

Frequently Asked Questions

Can I remove a Word password for free?

Yes for every layer except a password to open. Editing restrictions, a VBA project password and a 'password to modify' are all stored as hashes that can be removed structurally without cracking anything. Only a 'password to open' file is actually encrypted — and there the result depends on password strength, not on the tool.

Is the XML edit method legal?

Removing editing restrictions from a document you own or are authorised to change is generally lawful, but anti-circumvention and computer-misuse rules in some countries are stricter, and removing protection from someone else's document without permission can breach both those rules and the document's terms of use. Where ownership or authorisation is unclear, get advice before proceeding.

Will XML editing work on .doc files?

No. Legacy .doc is a binary OLE compound file, so the XML method and unzipping do not apply. The modify password there is removed by editing the write-reservation hash in the FIB with a hex editor. For a .doc with file-open encryption, recovery means attacking the password — RC4 CryptoAPI variants allow key lengths up to 128 bits (hashcat modes 9700/9800), so nothing about .doc makes success automatic.

Do paid services guarantee Word password recovery?

No reputable service can guarantee recovery of a modern file-open password — it depends on password strength. Legacy .doc is not automatically easier either: the RC4 CryptoAPI variants allow key lengths up to 128 bits (hashcat modes 9700/9800), so 'guaranteed' is not supportable for any file-open encrypted document. Prefer a service that offers a free pre-check before payment.

Can Word's own 'Recover Password' feature help?

Word has no built-in password recovery feature, and no password-hint feature for either the modify gate or file-open encryption — Microsoft's own guidance is that no Office application offers a hint for a protected document. Without the password, the options are cryptanalysis or a third-party service.

What about Word Online — can it bypass protection?

Word Online cannot open file-open encrypted documents at all. It respects editing restrictions set in Desktop Word. Switching to Online does not bypass either protection type.

Need Office password recovery?

Run a free analysis — encryption type detected automatically, fast techniques tried first, pay only on success.

Run Free Analysis