Excel Protected View — Not a Password

What Protected View Actually Is

Protected View is a sandboxed, read-only mode that Excel (and Word, PowerPoint) applies when it thinks a file might be unsafe. The file opens in a restricted process with no write access, no macro execution, no external data fetching, no embedded-object activation. It looks and feels like the real workbook — you can scroll, read cells, inspect formulas — but you cannot edit or save until you explicitly take the file out of Protected View by clicking Enable Editing.

Microsoft introduced this feature in Office 2010 after a decade of headline-grabbing macro-virus outbreaks (Melissa, ILOVEYOU, LOCKY-via-XLSB, and so on). The idea is that even if you blindly open a malicious attachment, the file cannot do anything destructive until you consciously authorise it. The yellow banner — "PROTECTED VIEW Be careful — files from the Internet can contain viruses. Unless you need to edit, it's safer to stay in Protected View." — is the user-facing surface of the sandbox.

Importantly, the file itself is not modified, not encrypted, and not password-protected. Protected View is purely a client-side policy that Excel applies on open. Send the same file to someone else and they can open it normally as long as their Excel does not also flag it.

The Three Triggers

Excel applies Protected View for exactly three reasons, each toggleable independently:

1. Files originating from the internet. Windows attaches a "Zone.Identifier" marker to files downloaded via Edge, Chrome, Firefox and most mail clients. Excel reads that marker and sandboxes the file.
2. Files in potentially unsafe locations. By default Outlook's temporary attachment folder, the Downloads folder on some corporate images, and certain network shares are considered unsafe.
3. Files from Outlook attachments. Even if the file has no Zone.Identifier, Outlook marks its own attachment directory as untrusted and hands files off to Excel with a separate trust bit set.

A single file can satisfy multiple triggers at once. An .xlsx downloaded from an email attachment is flagged both as "from the internet" and "from Outlook", which means turning off the internet trigger alone is not enough to eliminate the yellow banner. Check the message inside the banner — Excel tells you exactly which rule it applied.

Mark of the Web (MOTW) in Windows

The plumbing under Protected View's internet trigger is an NTFS alternate data stream called Zone.Identifier. When a browser or mail client saves a file from the internet, Windows automatically writes a small text stream attached to the file:

[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://example.com/report.xlsx
HostUrl=https://example.com/report.xlsx

ZoneId=3 means "internet zone". Zone.Identifier is why a file you download keeps triggering Protected View even after you save it to your local disk, attach it to an email, extract it from a zip, or copy it to a USB stick — Windows carries the stream along.

You can remove MOTW in three ways:

• Right-click → Properties → Unblock. A checkbox appears at the bottom of the General tab when a file carries MOTW. Tick it and click OK.
• PowerShell: Unblock-File report.xlsx. Works on any file.
• Command line: alternate-stream clear: echo. > "report.xlsx:Zone.Identifier". Fiddly but useful in scripts.

Windows 11 version 22H2 and later also propagate MOTW through extracted archives. Files inside a zip downloaded from the web now inherit the parent's Zone.Identifier, which closed a long-standing loophole. If you download a zip and extract it, every .xlsx inside still triggers Protected View until you Unblock them individually or use the Unblock option on the zip before extracting.

Trust Center Settings

For power users who want to tune Protected View rather than bypass it one file at a time, the Trust Center is the control panel:

File → Options → Trust Center → Trust Center Settings… → Protected View

The three checkboxes correspond to the three triggers listed above. Untick them and Excel will stop applying the corresponding rule. Do not untick all three unless you have a strong threat model. The rules exist because malicious Excel files from the internet remain one of the most common initial-access vectors in targeted attacks. Turning off Protected View globally is roughly equivalent to turning off User Account Control — possible, sometimes justified, usually a bad idea.

A middle-ground option is to use Trusted Locations (Trust Center → Trusted Locations) to whitelist specific folders. Files inside a Trusted Location bypass Protected View regardless of their MOTW. The folder C:\Users\YourName\Documents is on the default trusted list for personal files; you can add your company share drive or a specific project folder.

When Protected View Hides Real Corruption

Occasionally the yellow banner and Enable Editing button are the first sign of a genuinely broken file. Symptoms:

• You click Enable Editing and Excel crashes instead of exiting Protected View.
• The file opens in Protected View but the worksheet appears blank or shows "File failed to load" errors.
• Excel says "Excel cannot open the file because the file format or file extension is invalid".
• The file is over 50 MB and hangs indefinitely on the transition out of Protected View.

These are not Protected View problems — Protected View is simply where you happen to see the failure. The file itself is damaged or truncated, typically from an incomplete download, a mail server that stripped part of the attachment, or a storage error. The fix is to try File → Open → browse → select the file → click the small arrow next to Open → Open and Repair. Excel will either rebuild the workbook or report what it could salvage. See our dedicated repair Office file guide for the full procedure.

Macro-Enabled Files: .xlsm and Beyond

Protected View becomes more important for files with the .xlsm extension — Excel macro-enabled workbooks — because those files can execute VBA code the moment macros are enabled. Starting in Office 2022 and continuing in 365, Microsoft applies an additional rule: if an .xlsm file has MOTW, Excel blocks macros by default rather than prompting. The message reads "Microsoft has blocked macros from running because the source of this file is untrusted."

Unblock the file (Properties → Unblock) or put it in a Trusted Location, then reopen. If you cannot Unblock because you received the file as a corporate policy restriction, contact your IT department — Group Policy may be enforcing the macro-block behaviour across the organisation, separately from Protected View.

A subtle corollary: an .xlsm file from your own Documents folder, that you created yourself, has no MOTW and opens normally. The first time you email it to a colleague, it gets MOTW on their machine. The same file, two different experiences.

Excel Safe Mode — A Completely Different Thing

Users often confuse Protected View with Safe Mode. They are unrelated. Safe Mode is a troubleshooting mode for Excel itself, not for a specific file. You start it by holding Ctrl while launching Excel, or by running excel.exe /safe from the command line.

Safe Mode disables add-ins, custom templates, the Startup folder XLSTART, saved workbook recovery, and all user customisations. It is used to diagnose why Excel is crashing or behaving oddly: if Excel works fine in Safe Mode but crashes in normal mode, an add-in is the culprit. If Excel crashes in Safe Mode too, the installation itself is damaged and needs Quick Repair via Control Panel → Programs → Microsoft 365 → Change → Quick Repair.

Safe Mode does not apply to files; it applies to Excel. Protected View does not apply to Excel; it applies to specific files. Different layer, different purpose.

Step-by-Step: Get a Legitimate File Out of Protected View

1. Verify the source. If the file came from a person or system you trust, continue. If not, open it in Protected View, read the contents, and save a clean copy only if needed.
2. Close Excel. Actions on MOTW happen in Explorer, not in Excel.
3. Right-click the file → Properties. A checkbox labelled "Unblock" or "Security: This file came from another computer…" appears at the bottom of the General tab if MOTW is present.
4. Tick Unblock, click OK. Windows clears the Zone.Identifier stream.
5. Open the file in Excel. The yellow banner should not appear. If it does, the Outlook-attachment rule or the unsafe-location rule is still active. Open Trust Center and confirm the trigger, or move the file to your Documents folder.
6. If clicking Enable Editing crashes Excel, try Open and Repair. See our repair guide for details.

Protected View for Files Genuinely Locked With a Password

If a file is both downloaded (Protected View active) and password-protected (AES encryption applied), Excel evaluates Protected View first. You see the yellow banner, click Enable Editing, and only then does the password dialog appear. If you know the password, type it and carry on. If you do not know the password, Protected View is irrelevant — you cannot get past the AES encryption regardless of how you got out of the sandbox.

In that scenario the next step is password recovery, either locally with hashcat against an office2john hash or via a service. Our main Excel password recovery guide covers the recovery chances by Excel version and the typical attack strategies we use.

Frequently Asked Questions