Word Macro Security vs Document Protection — Differences Explained
Microsoft Word has two independent security layers that users frequently confuse: macro security (which controls whether VBA code in a document can execute) and document protection (which restricts editing, formatting, or structural changes). They protect different things and have very different recovery profiles — but only one of them is password-gated: document protection stores a password verifier, while macro security is a configuration toggle with no password and no cryptography at all. This guide explains how each works, when you might need to recover from each, and the technical processes involved.
What macro security actually does
Macro security in Word controls whether VBA macros embedded in a document are allowed to run. The setting is at the application level (Word Options > Trust Center > Trust Center Settings > Macro Settings), not the document level. You can choose from: Disable all macros without notification, Disable all macros with notification (default), Disable all macros except digitally signed macros, or Enable all macros.
The macro security setting is stored in the Windows Registry under HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Security as the VBAWarnings DWORD: 1 = Enable all macros, 2 = Disable all macros with notification, 3 = Disable all macros except digitally signed macros, 4 = Disable all macros without notification. (AccessVBOM, under the same key, is a different value — the Trust Center's 'Trust access to the VBA project object model' toggle, not the macro security level.) It is NOT stored in the document; on Windows fleets it is managed through Group Policy, and on Mac through the com.microsoft.office CFPreferences domain. When a user is blocked from running macros, the issue is with their Word configuration, not with the document itself.
There is no password for macro security itself. Word does not ask for a password to enable or disable macros. The gate is a registry key or group policy setting, not an encrypted hash. Recovery from 'I can't run macros' is a matter of changing the Trust Center setting, not password recovery.
Common misconception
Macro security is not a password feature. It's a configuration toggle. If Word won't run macros, the fix is Trust Center settings, not password recovery. The only macro-related password in Word is the VBA project password (Lock project for viewing).
What document protection actually does
Word document protection (Review > Restrict Editing) has two restriction categories plus the button that applies them: Formatting restrictions (limit formatting to a selection of styles) and Editing restrictions, whose four options are no changes (read only), tracked changes, comments, and filling in forms. Start enforcement is the button that applies the restrictions, optionally with a password.
When a password is set for document protection, Word stores a password hash in the document's XML (word/settings.xml inside the .docx archive). Word 2013 and later write SHA-512 (w:cryptAlgorithmSid="14") with w:cryptSpinCount="100000" and a 64-byte hash; Word 2007/2010-era files use SHA-1 (sid 4, typically 50000 spins). The hash can be removed structurally — like Excel sheet protection, it is not encryption, just a verification gate.
Document protection does NOT encrypt the document content. Any tool that can open the .docx ZIP and edit the XML can remove the <w:documentProtection> element. The document content is always readable regardless of the protection password.
VBA project password vs macro security
The VBA project password (Tools > VBAProject Properties > Protection > Lock project for viewing) is frequently confused with macro security. The VBA password prevents viewing/editing the macro source code, but does NOT prevent the macros from running. Macro security (Trust Center) controls whether macros run at all.
VBA project password removal follows the same structural patching technique as Excel VBA: open the .docm as a ZIP and extract word/vbaProject.bin, replace the protection entries in the PROJECT stream, repackage. For .doc, open the OLE2 compound file with an OLE/CFB-aware tool (oletools' oledump, for example) and patch the VBA project storage there. The macro code itself is compressed plaintext in the binary stream — the password only gates the UI.
Macro security has no recovery component because there's no password. If a user says 'I can't run macros in Word', the answer is always Trust Center settings or group policy, never hashcat or structural patching.
Document protection recovery techniques
For .docx files with editing restrictions: (1) click Review > Restrict Editing > Stop Protection — if the protection was applied with a blank password there is no hash stored, so Word does not prompt. (2) Unzip the .docx, open word/settings.xml, find the <w:documentProtection> element and delete it, rezip. (3) Open the .docx in LibreOffice — since LibreOffice 7.0 it opens the file read-only rather than ignoring the restriction, but Edit > Edit Mode lets you edit without the password (6.x and earlier ignored the restriction outright). (4) Copy-paste the content into a new document.
For .doc (binary format) files with protection: use a hex editor to locate the protection bytes in the OLE2 compound document. The protection flag is at a known offset. Several commercial Word recovery tools automate this — Accent Word Password Recovery (Passcovery), Word Password Recovery (Passcape) and Word Password (Thegrideon) all perform instant structural removal of Word modify and document-protection passwords.
None of these techniques involve password recovery via cracking — the protection is structurally removable in all cases. Hashcat becomes relevant in two situations: file-open password encryption (File > Info > Protect Document > Encrypt with Password), and, in principle, the modern document-protection verifier itself, which carries the same parameter set — SHA-512, spinCount 100000, a 64-byte digest and a base64 salt — that hashcat mode 25300 (MS Office 2016 - SheetProtection) was built for. Structural removal is faster than cracking either way.
File-open encryption in Word
Word supports file-open password encryption (Encrypt with Password in the Info panel). This IS real encryption — AES-256 with SHA-512 KDF (mode 9600 equivalent) for modern .docx files, or RC4 for legacy .doc files (modes 9700-9800). When a file-open password is set, the content is encrypted and cannot be read without the password.
File-open password recovery is the only scenario in Word that requires cryptographic recovery services. The hashcat mode depends on the Office version: Office 2007 (.docx) uses mode 9400, Office 2010 uses mode 9500, Office 2013 and later uses mode 9600. Legacy .doc files use the Office <= 2003 RC4 family — mode 9700 (MD5 + RC4) and mode 9800 (SHA-1 + RC4), plus their collider variants.
Unlike document protection (which is structural), file-open encryption cannot be bypassed. The password must be cracked or found through recovery techniques. This is the boundary between DIY structural removal and professional password recovery service.
Practical scenarios and correct responses
Scenario: 'I can't edit this Word document, it asks for a password' — establish which gate it is before editing anything. If Word prompts for a password to exit write protection but shows the content read-only, that is write protection (w:writeProtection in word/settings.xml, independent of documentProtection). If the content is visible and only editing is blocked, that is document protection. Both are structural and neither needs cracking — but deleting <w:documentProtection> does nothing for a write-protected file.
Scenario: 'I can't run macros in Word' — this is macro security settings in Trust Center, not a password. Change the macro security level to 'Disable all macros with notification' and then enable macros for the specific document.
Scenario: 'I can't view the VBA code, it asks for a password' — this is VBA project password, structural patching of vbaProject.bin. Removal is trivial with the right tool.
Scenario: 'Word asks for a password just to open the document' — this is file-open encryption. Cryptographic recovery via hashcat is the only path. This is where recovery services help.
Security recommendations for 2026
Use the correct layer for your actual threat model: file-open encryption for confidentiality (no one should read the content), document protection for collaboration discipline (prevent accidental edits), VBA project password for code obfuscation (not security), macro security digital signing (trusted publisher certificates) for enterprise distribution.
Document protection and VBA passwords are structural — they protect against casual users, not determined ones. Treat them as UI barriers, not security measures. If the content genuinely needs protection, use file-open encryption with a strong password or Information Rights Management.
For enterprises: use Group Policy to centrally manage macro security — a standard hardening step. Use Microsoft Purview Information Protection (sensitivity labels), the successor to Azure Information Protection, for content-level security that works across Office Online, Desktop and Mobile.
Identifying Word security issues
- 1
Check what's blocked
Asked for a password, no content at all? = file-open encryption. Asked for a password but content shows read-only? = write protection (w:writeProtection). Content visible but editing blocked? = document protection. Can open but can't view VBA? = VBA project password. Can open but macros don't run? = macro security settings.
- 2
For file-open encryption
Requires cryptographic password recovery. Run free analysis to check hashcat mode and feasibility.
- 3
For document protection
Structurally removable — remove <w:documentProtection> from word/settings.xml in the .docx ZIP.
- 4
For VBA project password
Replace the protection entries in the PROJECT stream inside vbaProject.bin (.docm). Automated tools are available.
- 5
For macro security
Word Options > Trust Center > Macro Settings. No password involved.
Frequently Asked Questions
Is macro security a password feature?
Can I recover a Word file-open password?
Is document protection removable?
What about Word for Mac?
Can I set a macro-security password in Word?
What's the strongest protection Word offers?
Need Office password recovery?
Run a free analysis — encryption type detected automatically, fast techniques tried first, pay only on success.
Run Free Analysis