How to Password Protect an Excel File: Complete Guide (Windows and Mac)

Password protecting an Excel file adds a layer of security that prevents unauthorized users from opening, reading, or editing your data. Excel offers three distinct levels of protection — file-level password encryption, worksheet protection, and workbook structure protection — and each serves a different purpose. Understanding which level you need lets you apply the right protection rather than over-securing a file or leaving gaps you didn't anticipate.

File-level password encryption prevents anyone from opening the file without the correct password. This is the highest protection level for sensitive data — payroll files, personal information, financial projections, anything you wouldn't want visible to someone who finds the file on a shared drive. The file is encrypted when saved, and without the password, the data isn't accessible even to someone who can see the file in their file browser.

Worksheet protection keeps the file openable and readable but prevents editing of cells, formulas, or structure within a specific sheet. This is the right level when you're sharing a spreadsheet with colleagues who need to see the data but shouldn't be changing formulas or deleting rows. You specify exactly which actions are allowed and which are blocked, giving fine-grained control over what editors can do without preventing anyone from reading.

Workbook structure protection prevents users from adding, deleting, renaming, moving, or hiding sheets. This matters when your workbook's sheet structure drives formula references — a template with interconnected sheets where sheet-level modifications would break functionality. It doesn't prevent editing cell content on individual sheets unless you also apply worksheet protection. For related Excel data protection context, the how to password protect an excel file guide to cell locking covers cell-level protection in detail.

One important distinction before diving in: Excel password protection and OneDrive or SharePoint access permissions are entirely separate systems. A file shared on OneDrive can be accessed by anyone with the share link regardless of Excel-level protection, unless the OneDrive sharing settings restrict access. For full security of sensitive files in cloud storage, you need both the right sharing permissions at the cloud level and file-level encryption at the Excel level — neither alone is sufficient.

This guide walks through each protection type step by step for Windows and Mac, including what to do if you forget a password and how to remove protection when it's no longer needed.

How to Password Protect an Excel File (Encrypt with Password)

Go to File > Info > Protect Workbook > Encrypt with Password. A dialog box asks you to enter a password. Type your password and click OK. Excel asks you to confirm by typing it again — this prevents locking yourself out with a mistyped password. After confirming, save the file. The password is now active and required every time someone tries to open it.

When the file is opened in the future, Excel displays a password dialog before showing any content. Enter the correct password and the file opens normally. An incorrect password returns an error and blocks access. The protection persists when the file is copied, moved, or sent by email — wherever the file goes, the password requirement goes with it.

The password uses AES-256 encryption — the same standard used for banking and government data. Without the correct password, the file's content is computationally infeasible to access by brute force. The implication, which Excel warns you about directly, is that if you forget the password to an encrypted file, there is no backdoor and no recovery method. Microsoft cannot recover it. Third-party tools work only on very short or weak passwords and success isn't guaranteed. Write the password down somewhere secure before you forget it.

To remove the file-level password, open the file (requires the current password), go to File > Info > Protect Workbook > Encrypt with Password, clear the password field entirely, and save. The file will no longer require a password to open. This is also how you change the password — remove it first, then add a new one. For context on unprotecting sheets, the how to password protect an excel file resource covers sheet protection removal.

A note on older Excel formats: .xls files (Excel 97-2003 format) use a weaker encryption algorithm than modern .xlsx files, and password protection on .xls files is significantly less secure. If you have sensitive files in .xls format, save them as .xlsx first (File > Save As > Excel Workbook), then apply password protection. The .xlsx format uses AES-256 and is substantially stronger than the RC4 encryption used in .xls files.

On Mac, the process is nearly identical: File menu > Passwords, then set the Password to Open field. Excel for Mac uses the same AES-256 encryption as Windows, and files encrypted on Mac open correctly on Windows and vice versa — the protection is fully cross-platform. Excel Online does not support file-level password encryption; you must use the desktop application.

How to Protect a Worksheet in Excel

Worksheet protection locks cells and controls what actions users can take within a specific sheet. Go to the Review tab and click Protect Sheet. A dialog appears with checkboxes for allowed actions: selecting locked cells, selecting unlocked cells, formatting cells, formatting columns, formatting rows, inserting/deleting columns, inserting/deleting rows, inserting hyperlinks, sorting, using AutoFilter, editing objects, and others. Checking a box allows that action; unchecking it blocks it.

You can optionally add a password required to remove protection later. Without a password, any user can remove protection through Review > Unprotect Sheet. Whether to add a password depends on use case — for shared templates where you want to prevent accidental edits but trust users to override when legitimately needed, no password may be fine. Where you genuinely don't want users bypassing protection, add one.

Before applying worksheet protection, decide which cells should remain editable. By default, all cells are set to Locked in their format properties — meaning all cells lock when protection is applied. To keep specific cells editable, select them, right-click, choose Format Cells, go to the Protection tab, and uncheck Locked. Those cells remain editable while everything else is locked. This is the standard workflow for data-entry templates where users fill in specific input fields but can't touch formula cells or headers.

Worksheet protection doesn't encrypt content — data is still visible when the file opens, and the protection can be removed by anyone with the password. It prevents accidental or casual editing, not data hiding. If the data itself needs protection from viewing, use file-level encryption. The combination — only authorized users can open the file, and once open only specific cells can be edited — requires both file encryption and worksheet protection together. For unlocking protected sheets, the how to password protect an excel file resource covers the full unlock process.

You can also control protection at the range level using the Allow Users to Edit Ranges feature. This lets you specify password-protected ranges that specific users can unlock and edit while the rest of the sheet remains fully protected. It's useful in multi-user environments where different teams need to edit different sections of the same protected sheet without giving everyone the sheet password. Access it through Review > Allow Users to Edit Ranges before applying sheet protection.

Protection applies per-sheet. If your workbook has five sheets and you protect only one, users can freely edit the other four. You need to protect each sheet individually through Review > Protect Sheet for each one you want to restrict. There's no single-click option to protect all sheets simultaneously in standard Excel — it requires either doing each one manually or using a macro that loops through all sheets.

Password Best Practices and Common Issues

Excel passwords have no length restriction or mandatory complexity requirements — you can set a one-character password as easily as a 40-character one. File-level encryption is only as strong as the password protecting it. A short, common password can be defeated quickly by brute-force tools; a long, random password is computationally infeasible to crack in any practical timeframe. For files with genuinely sensitive data, use at least 12 characters, mix character types, and don't reuse a password you've used elsewhere.

Password managers are the recommended storage method for Excel file passwords. Storing passwords in a document on the same drive, or in an email to yourself, defeats most of the security value. A password manager keeps passwords encrypted separately and allows you to generate strong random passwords without needing to memorize them. This also prevents the common scenario where someone sets a strong password, forgets it a month later, and can no longer access their own file.

A frequent issue is worksheet protection that blocks actions users didn't expect to be blocked. Specifically, users often find they can't sort or use AutoFilter on a protected sheet because those options aren't checked in the Protect Sheet dialog by default. If users need to sort or filter on a protected sheet, unprotect it, open the Protect Sheet dialog, check Sort and/or AutoFilter, and reprotect. This is the most common source of confused support requests about Excel protection.

Another common issue involves protection set years ago with a forgotten password. For worksheet and workbook structure protection without file encryption, various third-party utilities and VBA workarounds have historically been able to remove protection without the password in older Excel formats. In modern .xlsx files, the protection hash is strong enough that cracking requires the same computational effort as brute-forcing the password directly.

If you're locked out of a sheet you own, check if an unprotected version exists in version history on OneDrive or SharePoint. For practical Excel workflow skills complementing security practices, the how to password protect an excel file formulas guide covers the Excel functions most commonly used alongside protected templates.

Consider using different passwords for different sensitivity levels of files. A shared company template that just prevents accidental edits doesn't need the same password complexity as a file containing payroll data or health information. Creating a mental hierarchy — simple memorable passwords for low-risk protection, strong randomly-generated passwords for genuinely sensitive files stored in a password manager — reduces friction for low-stakes use while maintaining strong protection where it actually matters.

When sharing password-protected files by email, never include the password in the same message as the file. Send the file first, then communicate the password through a separate channel — a phone call, text message, or separate email. This prevents someone who intercepts or stumbles across the file share from also having the password in the adjacent thread.

How to Remove Excel Password Protection

Removing file-level encryption requires knowing the current password — the file is encrypted with that password, and opening it to change the settings requires decrypting it first. Once open, go to File > Info > Protect Workbook > Encrypt with Password, clear the password field completely, click OK, and save the file. After saving, the file opens without any password prompt. On Mac, the path is File > Passwords, then clear the Password to Open field.

Removing worksheet protection follows the same principle if a password was set. Go to the Review tab and click Unprotect Sheet. If a password was set when protection was applied, you'll be prompted to enter it. Enter the correct password and the sheet becomes fully editable again. If no password was set at the time protection was applied, the sheet unprotects immediately without any prompt — which is why setting a password during protection matters if you want to prevent anyone from removing it.

Removing workbook structure protection works identically: Review tab > Protect Workbook (the button toggles when a workbook is protected). If a password was set, enter it. If not, structure protection is removed immediately.

If you receive a protected workbook from a colleague and need to edit it but don't have the password, options are limited by design. For file-level encryption, you need the password — full stop. For worksheet protection without a password, you can unprotect immediately. For worksheet protection with a forgotten password in a modern .xlsx file, the protection isn't trivially bypassable and you'll need the original password or a fresh copy from someone who can unprotect it.

For team environments where multiple people work with protected templates, establish a shared password storage practice rather than relying on informal communication that breaks down over time. The how to password protect an excel file shortcuts guide covers keyboard shortcuts for Excel tasks including protection-related ribbon commands.

Version history is an underused resource when dealing with protection issues. Files saved to OneDrive or SharePoint automatically maintain a version history that you can browse in the file's online view. If a file was accidentally protected with the wrong password, or if an old version existed before protection was applied, the version history may contain an accessible copy. This doesn't help with file-level encryption on locally stored files, but for cloud-based Excel files it's worth checking before assuming a file is permanently inaccessible.

One practical point for regular users: if you use the same protected Excel file frequently and find password entry on each open annoying, consider whether the data actually requires that protection level in your environment. File-level encryption is appropriate for sensitive data on shared drives; it may be unnecessary overhead for files stored on a personal local drive accessed only by you. Calibrate protection to actual risk — this reduces friction without compromising meaningful security.