Microsoft Publisher Password Recovery

The Publisher Family Tree

Publisher has gone through more quiet revisions than almost any Office application. The file format has tracked the encryption pipeline of the rest of Office but lagged behind by one version — a quirk that helps recovery. The family tree matters because the version written into the file determines what recovery method applies.

Why Publisher Gets Password-Protected

Publisher's user base is overwhelmingly small-to-medium sized organisations producing print-ready marketing materials in-house: church newsletters, school fundraiser flyers, restaurant menus, club annual reports, realtor property packages, community event programmes. The password is most often set to prevent accidental edits by non-original authors rather than to protect sensitive information. That matters because the passwords chosen in this context tend to be light — organisational names, acronyms, the author's first name, a year, an ampersand or exclamation. Our hit rate on Publisher files is consequently higher than on comparable-era Word/Excel corporate files, even though the underlying cryptography is identical.

A second common scenario: a design freelancer delivered a .pub file to a client, set a password so the client could not modify the deliverable, and either charged extra for the "unlocked" version or moved on without the client noticing. Years later the client wants to reuse the artwork, the freelancer is unreachable, and the only copy of the newsletter is the locked .pub. These are routine enterprise queries for us and almost always recover on Phase 1 dictionary because the passwords are simple business English.

Identifying Publisher Version from the File

The quickest way to identify what flavour of .pub you are looking at is to open the first few kilobytes in a hex editor. All Publisher versions share the OLE2 Compound Document header (D0 CF 11 E0 A1 B1 1A E1) but the internal streams differ.

# Quickly list internal streams using Python + olefile
pip install olefile
python3 <<'PY'
import olefile
ol = olefile.OleFileIO("brochure.pub")
for path in ol.listdir():
    print("/".join(path))
PY

# Publisher 2003 and earlier streams typically contain:
#   'Quill96 Story Group Class'
#   'SummaryInformation'
#   'Contents'   (the actual layout, encrypted with RC4 if set)
#
# Publisher 2007+ encrypted files contain:
#   'EncryptionInfo'
#   'EncryptedPackage'
# (same names as Word/Excel/PowerPoint 2007+)

If you see EncryptionInfo and EncryptedPackage, the file is Publisher 2007 or later and the recovery workflow is identical to Office 2007+ AES. If you see Quill96, the file is Publisher 2003 or earlier and may be legacy-RC4 or merely flag-protected.

Recovery Workflow for Publisher 2007+

For any Publisher file from 2007 onwards, the path is exactly the path documented for Word, Excel and PowerPoint. Because the .pub uses the same Office encryption envelope as Word/Excel/PowerPoint of the same vintage, the office2john.py extractor and the hashcat Office modes apply unchanged.

# 1. Extract hash
git clone https://github.com/openwall/john
cd john/run
python3 office2john.py ../../../newsletter.pub > hash.txt

# 2. Inspect the hash to identify the sub-version
cat hash.txt
# e.g. newsletter.pub:$office$*2013*100000*128*16*a3b2...

# 3. Choose hashcat mode
#    $office$*2007*  -> -m 9400
#    $office$*2010*  -> -m 9500
#    $office$*2013*  -> -m 9600  (also covers 2016/2019/2021)

# 4. Run dictionary + rules
hashcat -m 9600 -a 0 hash.txt rockyou.txt -r rules/T0XlC.rule

# 5. Escalate to targeted wordlist
# Build from organisation name, city, year, people names
cat org_dict.txt | sort -u > targeted.txt
hashcat -m 9600 -a 0 hash.txt targeted.txt         -r rules/best64.rule -r rules/OneRule.rule

The targeted wordlist makes the biggest practical difference. A 500-word list built around an organisation — its name, abbreviations, founders, city, founding year, slogan — combined with rule mutations (OneRuleToRuleThemAll, T0XlC, d3ad0ne) generates tens of millions of candidates that statistically cover the passwords typical small organisations actually set.

Recovery Workflow for Publisher 2003 and Earlier

Three paths exist for legacy .pub files, in order of preference.

1. LibreOffice Draw bypass

Download and install LibreOffice. Drag the .pub into LibreOffice Draw. If it opens, the file was flag-protected and you are done. Export to .pdf or .odg for editing.

2. Free OLE2 password tool

For files that use true RC4 40-bit encryption (Publisher 2002/2003 with password-set), the same tools that unlock Office 97-2003 work. The key space is only 2⁴⁰ which is small enough that pre-computed tables exist for near-instant decryption regardless of the password string.

3. Our guaranteed recovery service

Publisher 2002/2003 files are on our guaranteed recovery list with the same $34.99 release price after proof, turnaround in hours. Upload on the home page — the free check runs first at no cost. If it is a legacy RC4 file we always recover.

Publisher Never Shipped for Mac

A recurring support question: "Is there Publisher for Mac?" No — Microsoft never released a Mac version of Publisher, and never will. Mac users who receive .pub files from Windows colleagues have three options: open the file in LibreOffice Draw on Mac (works for most files, may break complex layouts), use a commercial third-party reader, or get the sender to export to PDF before transmitting. For Mac users with a forgotten password on a .pub file they own, the recovery workflow itself still runs on macOS — office2john.py is pure Python, hashcat has Apple Silicon support — so the Mac limitation only applies to reopening the unlocked file, not to cracking it.

If you need to reopen a recovered .pub on a Mac, Affinity Publisher ($69 one-time, Mac + Windows + iPad) imports .pub files directly. LibreOffice Draw is free but handles only a subset of Publisher features faithfully. Scribus is another free option. None of these reproduce Publisher's layout exactly for complex documents, so be prepared for some manual cleanup.

Realistic Recovery Expectations

Across the 600+ Publisher recovery jobs we have processed in the last two years, the success pattern is clear:

• Publisher 97-2003: near 100% recovery. Either LibreOffice bypass, free tool, or our guaranteed RC4 attack. Passwords are irrelevant on guaranteed.
• Publisher 2007-2010: 55-70% recovery on Phase 1 dictionary (rockyou + T0XlC), another 10-15% on Phase 2 targeted wordlist. Final 15-35% requires mask attacks or remain unrecovered.
• Publisher 2013-2016: 30-50% on Phase 1+2, another 5-10% on Phase 3 (full rockyou + OneRule). 40-60% remain unrecovered within a 24-hour budget.
• Publisher 2019-2021: 25-45%. Identical to modern Office 2019 recovery characteristics.

The headline is that a .pub from a small business or community organisation is far more likely to recover than a random corporate .docx, because the password-selection habits of the Publisher user base skew toward dictionary-friendly strings.

Common Misunderstandings

Frequently Asked Questions