Excel VBA Project Password Recovery

VBA Password vs Sheet Password vs Workbook Password

Excel has three password slots that users constantly confuse. They protect different things, use different storage, and recover with completely different techniques. Before opening a hex editor, be sure you are attacking the right one.

If you cannot open the file at all, you have a workbook password — head over to Excel password recovery. If you can open it but cells are greyed out, see unprotect sheet without password. If the file opens, cells edit, but Alt+F11 prompts for a password, you are in the right place.

Why the VBA Password Is Weak

The VBA project password has never been real encryption. It was introduced in Office 97 as a courtesy lock so that colleagues would not accidentally browse your macro source. Microsoft documents it as obfuscation rather than encryption in the MS-OVBA specification. The macro code itself is stored in plaintext (as p-code and compressed source) inside vbaProject.bin. Only three metadata keys in the PROJECT stream tell Excel whether to prompt for a password:

• DPB — encrypted password hash, 32 bytes of hex text after the DPB=" marker.
• GC — host-specific GUID blob (rare in modern files).
• CMG — command-bar signature used by older hosts.

If Excel cannot find DPB when it opens the file, it assumes there is no password. That is the entire basis of the hex-edit method: by renaming DPB= to anything else, you hide the key from Excel's parser. The file loads, you accept a warning, and you set a new password (or clear it) from the Visual Basic editor.

Exact Byte Sequences You Will Search For

Inside vbaProject.bin, the PROJECT stream is stored as a UTF-8 text blob. Open the file in HxD, 010 Editor or any hex editor and search by ASCII string:

Important: overwrite the single letter only, do not delete or insert bytes. File size and every offset must stay identical or the OLE2 directory inside vbaProject.bin will be corrupt. If your hex editor has an "insert" mode, switch it off.

Step-by-Step Procedure

1. Make a copy. Duplicate Book.xlsm and work on the copy. If you corrupt the PROJECT stream, Excel will refuse to open the file at all.
2. Open the .xlsm with 7-Zip. Right-click the file → 7-Zip → Open Archive. You will see xl/, _rels/, docProps/, and [Content_Types].xml.
3. Drag out xl/vbaProject.bin. Copy it to the desktop. Keep 7-Zip open — you will drag the edited file back in a moment.
4. Open vbaProject.bin in HxD. Press Ctrl+F, switch to Text-string mode, search for DPB=.
5. Overwrite 'B' with 'x'. The third letter is at offset +2 from DPB. In HxD, click on the 'B' (hex 42) and type 78 in overwrite mode.
6. Repeat for CMG. Search CMG=, change 'G' (hex 47) to 'x' (hex 78).
7. Save the file. Ctrl+S. Size must be identical — HxD shows it in the status bar.
8. Drag the edited vbaProject.bin back into 7-Zip. Replace the file inside the xl/ folder. 7-Zip will update the archive in place.
9. Open Book.xlsm in Excel. You will see: "Unexpected error. Continue loading project?" — click Yes. Then: "The VBA project cannot be read." — click OK. Both are normal.
10. Press Alt+F11 to open the Visual Basic editor. The project now loads without a password prompt.
11. Right-click VBAProject → VBAProject Properties → Protection tab. Uncheck "Lock project for viewing" or set a new password of your choice.
12. Save, close, reopen. The next time you open Alt+F11, there is no password prompt. The two warnings also disappear after the save.

.xla / .xlam / Old .xls Files — A Note on Binary OLE

Excel add-ins saved as .xla and binary workbooks saved as .xls are pure OLE2 compound files, not ZIP. There is no outer archive to open, but the PROJECT stream is still there — you can search the raw file directly. The DPB / CMG / GC byte sequences and the rename technique are identical.

For OLE2 files, make sure your hex editor does not re-calculate the internal FAT or directory after saving. HxD, 010 Editor and WinHex all write back faithfully. Built-in Windows Notepad and any editor that normalizes line endings will destroy the file.

When the Hex Edit Does Not Work

A small number of corporate templates use a non-standard VBA project signature written by third-party tools (e.g. some document-management plugins). In those files, the DPB / CMG rename will make Excel reject the project entirely rather than warn-and-continue. Symptom: you open Alt+F11 and the VBAProject tree is empty.

Fix: revert to your backup and try an alternative route — copy all modules into a fresh, unprotected workbook. In Alt+F11 right-click each module → Export File, then import into the new workbook. Forms (UserForms) carry across the same way. It is tedious but never fails, because you are copying the plaintext code out of a file you can already read.

Frequently Asked Questions