You sent the wrong workbook to a client once. Just once. The file had a hidden tab with everyone's salary on it, and after that little fiasco you swore you'd lock things down properly. Good instinct. Excel actually gives you several ways to add a password, and they're not all created equal — some keep prying eyes out at the file level, others stop edits to a specific sheet, and a couple are mostly cosmetic locks that anyone with five minutes and a Google search can pop open.
Here's the short version: if your file holds anything sensitive — payroll, customer data, financial models you don't want walking around — you want File > Info > Protect Workbook > Encrypt with Password. That one uses real AES-256 encryption. The other options (sheet protection, workbook structure, modify password) are useful, but they're guardrails, not vaults.
This guide walks through every method. We'll cover password protecting an entire Excel file, locking individual sheets so colleagues can view but not change them, protecting the workbook structure so nobody adds or deletes tabs, removing passwords when you no longer need them, and what to do if you forgot the one you set last month. Mac and Windows. Microsoft 365, Office 2021, Office 2019, even the older 2016 version. We'll also talk about what these passwords actually protect against — and the surprisingly long list of things they don't.
One more thing before we dive in. Passwords in Excel are case-sensitive, can be up to 255 characters, and there is no master reset. Microsoft cannot recover them. Your IT department cannot recover them. If you lose the password on an encrypted file, your options are commercial recovery tools or saying goodbye to that data. Write it down somewhere safe. Seriously.
This is the one you want when the file itself is sensitive. It encrypts the whole workbook so the data on disk is unreadable without the password — open it in Notepad, in a hex editor, in another spreadsheet program, and you'll see scrambled bytes. Microsoft uses AES-256, the same algorithm banks and governments rely on, and there's no backdoor.
To add a password to an Excel file on Windows, open your workbook and click File in the top-left ribbon. The Info pane appears by default — if it doesn't, click Info on the left sidebar. Look for the big Protect Workbook button (it's usually got a little yellow padlock icon). Click it, then pick "Encrypt with Password" from the dropdown. Type your password, click OK, then type it again to confirm. Save the file. Done. Next time anyone opens it, Excel demands the password before showing a single cell.
On Mac the path is slightly different but the result is identical. Go to the Review tab on the ribbon, click Protect Workbook, and you'll see "Password to open" and "Password to modify" fields. Fill in the open password, retype it, save. The Mac version actually exposes both passwords in one dialog, which is a little friendlier than the Windows flow where you have to dig into Save As > Tools > General Options to find the modify password.
What if you want both an open password and a modify password? Useful when you want some people to view the file read-only and others to edit it. On Windows: File > Save As, then click Tools next to the Save button (bottom-right of the dialog), choose General Options, and you'll see both fields. Set them to different values, save, done. Now anyone who only has the open password can read but not save changes; anyone with the modify password gets full access.
File > Info > Protect Workbook > Encrypt with Password is the only Excel password that uses real encryption (AES-256). Every other option — sheet protection, workbook structure, modify password — can be bypassed in minutes with free tools. Use file-level encryption for anything you actually care about keeping private. Use the others for honest-mistake prevention only.
Sheet protection is a different animal. It doesn't encrypt anything. The data stays readable to anyone who opens the file — the password just stops users from editing locked cells, deleting rows, changing formulas, or messing with the tab. Think of it as a "don't touch" sign, not a safe.
To protect a sheet, click the Review tab on the ribbon, then click Protect Sheet. A dialog pops up with a password field and a long list of checkboxes covering what users are still allowed to do — select cells, sort, use AutoFilter, format columns, that sort of thing. Type a password, pick the permissions you want to leave open, click OK, confirm the password. Anyone trying to edit a locked cell now gets a polite error message.
Here's the catch most people miss. By default every cell in a new sheet is marked as "Locked" — but locking only kicks in once you protect the sheet. So if you want some cells editable (an input form, say, where users fill in values but can't touch the formulas), you have to unlock those cells before protecting. Select the cells you want editable, hit Ctrl+1 to open Format Cells, go to the Protection tab, uncheck Locked, click OK. Then protect the sheet. Now users can edit the cells you unlocked and nothing else.
The big limitation? Sheet protection passwords are notoriously weak. Excel uses a legacy hash that's been cracked since the early 2000s. Free websites and open-source tools will strip a sheet password in under a minute. So this is the right tool when you want to prevent accidental edits — a colleague clicking the wrong cell, an intern overwriting a formula — but completely the wrong tool when you're trying to hide data from someone determined to see it.
Encrypts entire workbook with AES-256. Required to open the file. The only password that genuinely protects data confidentiality.
Lets users open and view the file but blocks saving changes unless they have the modify password. Bypassed by saving as a new file.
Stops edits to locked cells on a specific worksheet. Data remains visible. Weak hash — strippable in minutes.
Prevents adding, deleting, hiding, or renaming sheets. Useful for templates. Also weak hash.
You've built a beautiful financial model. Three input tabs, four calculation tabs, two output tabs, and a hidden "Don't Touch" tab full of named ranges. A junior analyst gets the file, right-clicks a tab, and deletes it. The model breaks. This is exactly what protecting the workbook structure is for.
Click the Review tab, then Protect Workbook. A small dialog appears — leave Structure ticked (Windows shows the option clearly; Mac too) and add a password if you like. Click OK. Now the right-click menu on tabs is mostly grayed out. No deleting, no inserting, no moving, no renaming, no unhiding. The data inside each sheet remains fully editable unless you've also added sheet protection on top.
This is the protection layer people forget. You can have a single workbook with file-level encryption (so nobody opens it without the password), workbook structure protection (so the tabs are safe), and individual sheet protection on the input tab (so users can only edit specific cells). That's three different passwords, three different protections, all stacked. Most templates and shared models benefit from at least the structure protection — it costs you nothing and prevents the most common form of "I broke the file" disaster.
File > Info > Protect Workbook > Encrypt with Password. Newest interface, AES-256, fastest. Modify password lives under File > Save As > Tools > General Options. Cloud-saved files (OneDrive, SharePoint) inherit the same encryption when downloaded.
Identical path to Microsoft 365: File > Info > Protect Workbook. Same AES-256 encryption. The only real difference is that older versions sometimes don't open files encrypted by newer ones — keep everyone on a recent build if you're sharing protected files cross-version.
Review tab > Protect Workbook. The Mac dialog shows both "Password to open" and "Password to modify" in one window, which is more discoverable than the Windows version. AES-256 since Office 2016 for Mac. Mac and Windows files are fully cross-compatible.
The browser version cannot set or change file-level passwords. You can open and edit encrypted files (Excel Online prompts for the password) but to add a new password you have to open the file in the desktop app. Sheet protection works in-browser.
Removing a password assumes you know it. If you do, it's quick. To strip the file-level password on Windows: open the file (enter the password when prompted), go to File > Info > Protect Workbook > Encrypt with Password, delete the existing password from the field, leave it empty, click OK, save the file. The encryption is gone.
For sheet protection: Review tab > Unprotect Sheet, enter the password, the sheet is now editable. For workbook structure: Review > Protect Workbook (it'll be highlighted, indicating protection is on), enter the password, structure protection is off.
On Mac the path is the same — Review tab — but the dialogs are arranged slightly differently. The end result is identical.
If you don't know the password, things get harder. Microsoft has no recovery mechanism. For sheet protection and workbook structure passwords, free or cheap third-party tools can usually crack them within minutes because the hash is weak. For file-level encryption (the AES-256 one), recovery is realistically only possible if your password is short or simple enough for brute-force or dictionary attack. Commercial recovery services exist; they can run for hours or days on a single file and often fail. The honest answer is: back up your passwords. Use a password manager. The recovery options are bad on purpose.
A weak password defeats the whole point. The classic mistakes — using your name, the company name, the file's topic, the year, or a date — show up in every dictionary attack within seconds. So does anything you've used on another account. If your Excel password is the same as your email password and your email's been in a breach (check haveibeenpwned.com), the Excel file is already exposed in theory.
What works: a randomly generated passphrase of three or four unrelated words, plus a number and a symbol. Something like "purple-tractor-balcony-47!" is wildly stronger than "P@ssw0rd2026" and easier to remember. Length beats complexity. A 20-character all-lowercase password is harder to brute-force than an 8-character one with symbols and uppercase.
Where to store the password: a password manager. Not in a sticky note. Not in the same email thread as the file. Not in a "passwords.txt" sitting next to the workbook. If you must share the password, use a different channel from the file itself — file by email, password by Signal, or password over the phone.
Finally, audit your protected files quarterly. Old workbooks accumulate. The file you encrypted three years ago for a project that ended two years ago probably doesn't need its password anymore, and that password is probably one you've forgotten. Decrypt and archive, or delete entirely.
Setting a password creates a false sense of security if you don't understand what it actually does. Let's be honest about the limits.
File-level encryption stops someone from opening the file without the password. That's it. Once the file is open on a screen, anyone can read it, screenshot it, copy cells into another workbook, or save an unprotected copy. Encryption protects the file at rest — sitting on a hard drive, in an email attachment, on a USB stick. It does nothing once the file is being viewed.
Sheet protection and workbook structure passwords are bypassable in minutes. There are free websites, open-source scripts, and well-known XML manipulation tricks (rename the .xlsx to .zip, edit a couple of files, rename back) that strip these protections without needing the password at all. Use them to prevent accidents, not attacks.
None of Excel's passwords protect against:
If you're protecting genuinely high-stakes data — trade secrets, regulated financial info, healthcare records — Excel password protection is a starting point, not the finish line. Pair it with proper access controls, sensitivity labels (Microsoft Purview, formerly Azure Information Protection, ties encryption to user identity rather than a shared password), and policies about who can extract data into local files in the first place.
"The password is correct but Excel won't accept it." Check Caps Lock first — Excel passwords are case-sensitive. Then verify the keyboard layout (a French AZERTY keyboard typing a US-set password will shift several keys). Also confirm the file isn't read-only at the file-system level; sometimes Windows marks a file read-only and the password prompt behaves oddly.
"I set a password and now Excel says the file is corrupted." Almost always means the file was encrypted by a newer Excel version than the one trying to open it. Open it in Microsoft 365 or the latest Office, remove the password, save, and you can downgrade. Files encrypted in 2016+ formats won't open in Office 2010 or earlier without the legacy compatibility pack.
"I want to protect just the formulas." Select all cells (Ctrl+A), Format Cells (Ctrl+1), Protection tab, uncheck Locked, OK. Then select only the cells with formulas (Find & Select > Formulas), Ctrl+1 again, check Locked. Then protect the sheet. Now everything except formulas is editable.
"The Protect Workbook button is grayed out." The workbook is probably in a co-authoring session via OneDrive or SharePoint. Click File > Info, and if you see "Shared workbook" or co-authoring indicators, stop sharing first, then protect. Alternatively, save a local copy and protect that.
"How do I remove a forgotten sheet protection password?" Search for "excel password remover" — several free tools (and even a manual XML method on .xlsx files) will strip sheet protection in under a minute. This works precisely because the sheet password algorithm is weak. For file-level encryption, it doesn't work.
The right protection depends on what you're defending and from whom. A shared template that you don't want a colleague to accidentally destroy needs workbook structure protection plus maybe sheet protection on the calculation tabs — passwords optional, since you're not really worried about attackers. A monthly financial report you email to executives needs a file-level password with a strong passphrase, sent through a separate channel. A workbook with personal data subject to GDPR, HIPAA, or similar regulations needs file-level encryption plus an actual data-handling policy that says it shouldn't be in Excel in the first place.
The three-minute version: open File, click Info, click Protect Workbook, choose Encrypt with Password, type a long random passphrase, store it in your password manager, save the file. That covers 90% of real-world needs.
Build up from there as the stakes warrant. Add sheet protection where you want users to fill specific cells without breaking formulas. Add workbook structure protection where the tab layout matters. Layer them. And remember — the password keeps the file private, but the moment someone legitimate opens it, the data is on their screen, in their clipboard, and potentially in their next email. The most secure spreadsheet is the one you didn't share.