Is it safe to store account credentials in an Excel sheet protected with a password?

Question

Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, this sheet would be in a safe place as well: besides the password to open the sheet, an attacker would need the password to access the Google Drive account and a second factor authentication token from Google.

Answer 1

In the existing answers, a lot of "Excel is not secure" gets thrown around, so let's look at what this means in detail.

First, we need to establish which Excel feature we are talking about. There are two fundamentally different ways to "protect an Excel sheet with a password".

1. File encryption: This is what Microsoft calls "Protect an Excel file". This feature encrypts the whole file with symmetric encryption:

   • Office 2016 and later use
     • 256-bit AES when encrypting Office Open XML files (docx, xlsx, ...),
     • RC4 (considered insecure) when encrypting files in the legacy formats (doc, xls, ...).
   • Office 2007–2013 uses 128-bit AES for Office Open XML files
   • earlier versions of Office used various algorithms which are now considered insecure.

2. Locking a workbook or worksheet. This is what Microsoft calls "Protect a workbook" and "Protect a worksheet". Microsoft explicitly states that "Worksheet level protection is not intended as a security feature". This kind of protection can easily be bypassed by a skilled user by modifying the XLSX file. It's a convenience feature that protects designated cells in your file (a) from accidental modification by users and (b) from deliberate modification by unskilled users.

Thus, from a cryptographic point of view, feature 2 is absolutely insecure, whereas feature 1 offers reasonable at-rest encryption when used with a strong password in current versions of Excel.

---

However, as Adam Katz's answer describes in more detail, good at-rest encryption is not the only important factor when choosing a password manager.

Thus, while storing your passwords in an encrypted Excel file is

• more secure than storing them unencrypted (or reusing a single password for multiple accounts), it is also

• less secure than using dedicated password manager software (or keeping your passwords off-line).

Answer 2

No. At best, password-encrypted Excel sheets are only protected at rest, not while opened. At worst, it's not encrypted and/or an adversary can use one of several documented MS office password recovery attacks.

It is unwise to assume that Excel's protections have anywhere near as much security vetting as any password manager, especially not the better-established ones like Bitwarden and 1Password.

In addition to being vetted for secure password storage, actual password managers include an interface that prevents you from seeing all passwords at the same time. They also have tons of extra features, like options to generate secure passwords, the ability to privately determine if a given password was part of a recent breach, and even the ability to wipe your clipboard a minute after you copy a password to it.

See also Wikipedia's List of password managers § Features matrix for a better list of what Excel can't offer but plenty of free options do.

Answer 3

No, absolutely not safe

Here is the top google result for

how to crack excel password

It literally tells you how to open a password-"protected" excel spreadsheet.

There are dozens more articles on the same topic, and anyone can do it (that's right, while you do need to copy/paste some code, you do not even need to be a computer programer or need to know anything about 'hacking' to follow the steps).

This means, for better or worse, it's really easy for someone to open a password "protected" excel spreadsheet.

So the answer is no - you should not consider passwords stored in a excel spreadsheet secure, even if it's "protected" by a password.

Answer 4

Probably not, but it depends on your threat model.

What are you trying to protect AGAINST ?

If your main concern is that you forget passwords and that some low-level attacker might get them, then you may be ok. If you want to be safe from anyone with even some skill, then no. Excel is not safe.

A password manager is probably the better solution, and you didn't explain why you don't want that.

The next best solution if you need to store the passwords somewhere is to store them physical, on a piece of paper in a safe. The number of potential attackers drops dramatically as soon as physical intrusion is required. Again, details depend on your threat model.

Answer 5

This is not safe for the reasons stated in other answers, however a quick alternative for the same stuffy offices environments where Excel is being used is often to pack the spreadsheet into an archive (such as the ZIP format), encrypting that with a password

This is quite secure, though it requires a long passphrase and reasonable choice of encryption (consider AES128), as it trivially permits offline attacks against the file (while an online password manager will not)

Answer 6

As a counterpoint to the intuitive "no, Excel is not a password manager" I'd like to present a threat model in which the Excel-stored password is safer.

Most scenarios in which Excel-vs-password-manager make a difference involve an attacker accessing your system (password-encrypted Excel sheets are only protected at rest, etc.). In such a case, it would be trivial to search for e.g. Keepass files.

$ find / -type f -exec file {} \; | grep Keepass
/home/appelbaum/.well-hidden.kbd: Keepass password database 2.x KDBX

Finding Excel files is no harder, but with Excel files:

1. The value of the file is not obvious. The attacker might not think to look for the passwords in an Excel file, especially if the target is tech-savy and there are decoy Keepass files on the system.
2. There could plausibly be hundreds of Excel files, difficult to determine which could contain valuable information.
3. Excel is a proprietary format, notoriously difficult to implement 100%. Automated tools might be able to sniff many ways of hiding data in Excel, but only MS Excel implements all of it. You could probably find a way to obfuscate the data in an Excel cell that is not obviously either a password or protected somehow. Automated tools might find encrypted files or protected cells, but they won't suspect that Mary's birthday was last Thursday encodes the password Znel'foveguqnljnfynfgGuhefqnl.

All these considerations apply to a file stored on Google Drive or other cloud platform as well. In fact, if the attacker is a state actor and can subpoena Google, the last point becomes even more poignant.