Microsoft Project MPP Password Recovery

Why PMO Teams Password-Lock MPP Files

Before diving into cryptography, a quick reality check on where these locked files come from. In our production queue, the source of a password-protected .mpp is overwhelmingly one of three situations. First, a departing senior PM who saved schedules for regulated projects (pharma trials, utility rollouts, defence contracts) with a "safety" password and never told anyone. Second, consultancy deliverables where the vendor set a password so the client could not edit the baseline schedule without going through a change-control process. Third, legacy project archives dating back to Project 98/2000/2002 that were routinely password-protected by the original PM as a matter of habit, and where the original author is long since retired.

All three scenarios share a common pattern: the organisation has a legitimate need for the data (audit, historical baseline review, dispute resolution) but nobody remembers the password. Recovery is routinely authorised by a company's legal or IT team rather than being an end-user DIY task. That in turn means the cost of professional recovery is usually billed, and the tolerance for a 24-48 hour GPU attack is much higher than in consumer contexts.

Version Matters More Than Anything

Because the .mpp extension has been used since Project 1.0 in 1990, the single filename can hide any of eight distinct file formats with wildly different encryption strengths. Identifying which version wrote a given file is the single most important step in recovery. There are two ways to do this: look at the file's internal signature, or ask Project itself (via File → Info → Properties) if you have a working copy installed.

Percentages reflect real recovery rates on human-chosen passwords in our enterprise queue. Random-generator passwords (from 1Password, LastPass, Bitwarden) are not recoverable on 2010+ files within any reasonable time budget.

Identifying Your Project Version Without Project Installed

Many people asking for MPP recovery no longer have Project installed — the licence lapsed, the PM who owned it left, or they work on a different team now. You can still identify the version from the file itself. Open the .mpp in a hex editor such as HxD and inspect the first 512 bytes. Three patterns distinguish the eras:

# OLE2 Compound Document (Project 98 through 2003)
First 8 bytes: D0 CF 11 E0 A1 B1 1A E1
Within the 'SummaryInformation' stream look for
  'Microsoft Project 4.0/4.1/2000/2002'

# OOXML Encrypted (Project 2007+)
First 8 bytes: D0 CF 11 E0 A1 B1 1A E1  (still OLE2 envelope)
But the streams now include 'EncryptionInfo' and 'EncryptedPackage'
The EncryptionInfo version number tells you the sub-variant:
  Version 3.2  ->  Project 2007
  Version 4.4  ->  Project 2010+
  Agile/ECMA-376 -> Project 2013+

# Unencrypted .mpp (no password)
Same OLE2 envelope but no EncryptionInfo stream.

If you are on a Mac or Linux machine without Project, the olefile Python library dumps the internal streams in one command:

pip install olefile
python3 -c "import olefile, sys; ol=olefile.OleFileIO(sys.argv[1]); print(ol.listdir())" plan.mpp

Extract the Hash with office2john

For any Project 2007+ file, the recovery workflow is identical to Word/Excel/PowerPoint 2007+. Clone john-the-ripper jumbo (git clone https://github.com/openwall/john) and use the bundled office2john.py script. Despite the name, the script handles .mpp files transparently because they are structurally Office documents.

# Extract the hash
python3 run/office2john.py quarterly_plan.mpp > hash.txt

# Example output (Project 2013):
quarterly_plan.mpp:$office$*2013*100000*256*16*2b3f1...

# Use the numeric version field to pick the right hashcat mode:
#   2007 -> -m 9400
#   2010 -> -m 9500
#   2013 -> -m 9600 (Office2013 mode, covers 2013/2016/2019/2021)

Note the raw 256 in the example above indicates AES-256 key size (Project 2019+), while 2013+ files with AES-128 show 128. Hashcat mode 9600 covers both variants within the same numeric mode — hashcat internally branches on the key size.

GPU Attack Strategy

MPP passwords in the enterprise world have a distinctive statistical shape that differs noticeably from consumer Office passwords. The following attack ladder reflects what we actually run in production against paying customers' MPP hashes and explains the measured recovery rates in our table above.

Phase 1 — Targeted 140M dictionary, 15 minutes

Start with a curated 140 million entry dictionary that combines rockyou, HashKiller leaks, and our internal enterprise password list (scraped legally from public breach dumps and cleaned). Run with the T0XlC rule set, which applies common case / substitution mutations. Covers 30-45% of MPP recoveries alone.

hashcat -m 9600 -a 0 hash.txt big-140M.txt         -r rules/T0XlC.rule         --workload-profile 3

Phase 2 — Project-codename mask, 30 minutes

Enterprise MPPs are frequently named after project codenames: "Atlas", "Phoenix", "Everest", "Helix", followed by a year or version digit. A mask hybrid attack with a 5000-entry codename dictionary and year-like suffixes catches another 15-20%.

hashcat -m 9600 -a 6 hash.txt codenames.txt ?d?d?d?d
hashcat -m 9600 -a 7 hash.txt ?u?u codenames.txt

Phase 3 — Full rockyou + OneRule, 4 hours

If the first two passes fail, bring the big guns. The OneRuleToRuleThemAll set applied to rockyou generates ~1.5 trillion candidates. On a 6-GPU rig this runs overnight and catches another 10-15% of MPP passwords.

Phase 4 — Mask brute, 24+ hours

For passwords clearly outside the dictionary space (all lowercase + digits up to length 10, or mixed-case + digits up to length 9) a raw mask attack is the only remaining option. Runs 10-72 hours depending on mask and GPU count. Recovers another 5-10%.

Project for the Web and Project Online: No File Password

Microsoft 365 ships two modern cloud-based project management products under the Project brand: Project for the Web (the consumer / small-business offering, tightly integrated with Microsoft Planner and Power Platform) and Project Online (the enterprise successor to Project Server). Neither uses .mpp files as a native storage format. Plans live in a SQL-backed service; access is controlled by your Microsoft 365 account and the permissions assigned by the plan owner.

This means there is no file password to forget. If you cannot open a plan hosted in Project Online, the question is whether your Microsoft 365 account has been granted permission — which is resolved through the project owner or your tenant admin, not through cryptographic recovery. Users sometimes export a plan to .mpp for local editing or archival, and then set a file password on the export. Those files are in scope for this guide; they behave exactly like Project desktop files of the corresponding version.

Common Scenarios We See in the Queue

Frequently Asked Questions