I am writing a Python program to decrypt a MS Office encrypted document. Referencing This GitHub Repo for reference.

Now what I want to do is try bunch of commonly used passwords against the document. Sort of a brute force approach. But the issue is when I feed in the password, I don't have any way to know if the decrypted content is garbage meaning that the password was wrong or the decrypted content is the right original content meaning that the password was right.

I know that inside the document structure, this information is usually embedded inside EncryptionInfo. But I don't understand how do I verify either the password I'm using is correct or the content it is decrypting is correct.

I've tried checking a lot of online sources and one that could help is This YouTube Video and May be this code (I don't think so though) but I am not able to realize this all into a python code because I don't understand all the operations suggested in it properly.

  • 1
    can you post what you have so far?
    – MikeSchem
    Oct 2, 2017 at 22:57
  • I have parsed Ole Streams. Also the information from the EncryptionInfo file. I'll post what I have in a while. Oct 2, 2017 at 23:01

1 Answer 1


MS Office documents are encrypted with the plain text password. But they use the hash of the plain text password to verify if it will work first though. If the user supplied password goes through the hashing process and matches it's stored hash then it will decrypt the file with the supplied password.

Additionally the hash is not a direct hash of the key. In Office 2007 it hashes the password 50,000 times and in Office 2010 it hashes it 100,000 times. Both using SHA-1. This is to fight off tools that brute forced hashes for earlier versions. Office 2013 uses the same strategy but uses SHA-512 by default.

So if you know the hash method and the Office version you can write a script that turns a plain text password into a compatible hash to compare to the MS document's hash. If your script compares them as equal then you can verify it is the correct password.

  • I understand. So is there any way, given a document and let's say 100 passwords, to know which password is right and decrypt the document with that? I'm particularly interested in office 2013 documents. Oct 2, 2017 at 23:12
  • If you have your script loop through each password, hash them 100,000 times using SHA-512 and matching them with the hash supplied with the encrypted document you could see if any of them are a match. If any of them are a match they are the password.
    – Bacon Brad
    Oct 2, 2017 at 23:19
  • Ooh. It's that simple! And would you happen to know what exact field to refer to for in the encrypted file this hash? Oct 2, 2017 at 23:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .