Skip to main content
1 of 2
Bacon Brad
  • 3.4k
  • 21
  • 26

MS Office documents are not encrypted with the plain text password. They use the hash of the plain text password. If the user supplied password goes through the hashing process and matches then it will decrypt the file with the supplied password.

Additionally the hash is not a direct hash of the key. In Office 2007 it hashes the password 50,000 times and in Office 2010 it hashes it 100,000 times. Both using SHA-1. This is to fight off tools that brute forced hashes for earlier versions. Office 2013 uses the same strategy but uses SHA-512 by default.

So if you know the hash method and the Office version you can write a script that turns a plain text password into a compatible hash to compare to the MS document's hash. If your script compares them as equal then you can verify it is the correct password.

Bacon Brad
  • 3.4k
  • 21
  • 26