Microsoft 365 Password vs Document Password

The Five Password Mechanisms in Modern Office

Mechanism 1: The Microsoft Account Password

This is the password you set when you created a @outlook.com, @hotmail.com or personal Gmail-linked Microsoft account. It controls every consumer Microsoft service: OneDrive (personal), Office.com, Xbox, Skype. If you forget it, go to account.microsoft.com/password/reset. Microsoft sends a code to your backup email or phone.

What resetting this password does NOT do. It does not remove encryption from any document you saved locally with File → Info → Protect Document → Encrypt with Password. Those files carry their own AES-128 key derived from a password you typed separately at save time — often years ago, on a different device.

Mechanism 2: The Work Account (Entra / Azure AD)

If you sign in to Microsoft 365 as first.last@company.com, you are authenticating against your organisation's Entra ID tenant (formerly Azure AD). Password reset goes through your IT department — either self-service on passwordreset.microsoftonline.com if SSPR is enabled, or a helpdesk ticket otherwise.

Work accounts are also the hook for Mechanism 5 (sensitivity labels). If a colleague sends you a file marked "Confidential — Internal" via email, the file opens because your Entra sign-in proves you are an employee — but if you leave the company, the file stops opening even on your personal machine. This has nothing to do with file passwords; it is policy-based encryption that the tenant admin can revoke at will.

Mechanism 3: OneDrive Personal Vault

Personal Vault is a special folder inside consumer OneDrive that requires an extra 2FA challenge every time you open it. The files inside the Vault are regular Word/Excel/PDF/JPEG; they are not individually password-protected. The "lock" is on the folder — unlock it with your authenticator app and every file inside opens normally.

If you can no longer receive your 2FA code, the recovery path is the standard Microsoft account-recovery form, which may take days and may refuse if you cannot prove ownership. There is no "vault password" that can be cracked locally — everything the Vault protects depends entirely on your Microsoft account being accessible.

Mechanism 4: Document Password (Real Encryption)

This is the mechanism that brings users to recovery services. When you save a file with File → Info → Protect Document → Encrypt with Password, Office asks for a string, derives a key from it using PBKDF2 (SHA-512 at 100,000 iterations since Office 2013), and encrypts the file body with AES-128.

Key facts.

• The password lives only in your head — and optionally, in a text you wrote to yourself.
• Microsoft never receives the password. The file encryption is performed entirely on your device before save.
• Changing your Microsoft account password has zero effect.
• Uninstalling and reinstalling Office has zero effect.
• Moving the file to a different computer has zero effect.

The only paths to recover a forgotten document password are (a) trying candidate passwords until one works (what GPU recovery services do), (b) finding an old note in a password manager or email, or (c) exploiting a weak encryption version if the file is old enough — see our Excel version comparison for specifics.

Mechanism 5: Sensitivity Labels, IRM and AIP

Microsoft 365 lets tenants enforce policy-based encryption on documents. You have probably seen labels like "Confidential — Internal", "Highly Confidential — Contoso" or simply "Do Not Forward". These are Sensitivity Labels (the modern incarnation) or their predecessors Information Rights Management (IRM) and Azure Information Protection (AIP).

Unlike a file password, a labelled document is encrypted with a tenant-owned key, not a user-derived key. When you open the file, Office contacts your tenant's rights server, verifies your sign-in token against the label's policy, and receives the decryption key. This is why labelled files can be revoked even after they have been emailed out — the tenant just refuses the decryption token next time.

If you cannot open a labelled document, a recovery service is the wrong tool. Contact your IT admin. They can either reassign rights through the Microsoft Purview compliance portal or strip the label entirely. We cannot help — there is no math attack against correctly configured tenant-owned keys.

Why "Forgot Password" Does Not Unlock Your File

Walk through the mental model. When you click "Forgot password" on outlook.com, Microsoft verifies your identity through your backup email, phone or passkey, and then sets a brand-new password for your Microsoft account. This overwrites whatever was in Microsoft's database.

Your Excel file is not in Microsoft's database. It is on your disk (or OneDrive), encrypted with an AES key derived from a password that was never, ever sent to Microsoft. There is no row in any Microsoft server that says "user X encrypted file Y with key Z". So there is nothing for Microsoft to reset.

This is by design. It is a feature of the threat model — if Microsoft could reset your file password, so could anyone who compromised Microsoft. The industry-standard choice is to make the file owner solely responsible for the file password, and accept that forgetting it is catastrophic.

Co-Authoring With a Password — It Does Not Work

Microsoft 365 real-time co-authoring needs the server to read the file to merge changes. AES-128 file encryption prevents that by design. So if you apply Encrypt with Password to a shared workbook, everyone else in the co-author list loses live-edit access the moment they re-open.

If you want both collaboration and encryption, use a sensitivity label. Labels let the server hold the key and apply it per-user, preserving co-authoring while still restricting access to authorised staff. This is what large tenants roll out through Microsoft Purview / Compliance Center.

Troubleshooting Decision Tree

1. File opens in Excel / Word but a yellow banner says "Marked as Final" — click Edit Anyway. Not encrypted.
2. File prompts for a password before any content appears — AES document encryption. Recovery via our service.
3. File opens read-only and a banner says "Contact [admin] for permissions" — sensitivity label / IRM. Contact your IT admin, not us.
4. OneDrive says "Unlock Personal Vault" — account-recovery problem. Follow Microsoft's 2FA reset flow on account.microsoft.com.
5. Excel Online refuses to open, works in desktop Excel — file has a password; Excel Online does not support password-protected workbooks. Open in desktop.
6. SharePoint says "The file is checked out to another user" — not a password; ask that user to check it back in or an admin to override.

Frequently Asked Questions