When data security is paramount, knowing how to password-protect an Excel file is essential for safeguarding sensitive information. But for enterprise teams, the question goes further: Once a file is protected, where does that password live, who can access it, and what happens when the employee who set it leaves the company?
This guide covers how to secure Microsoft Excel files with passwords and encryption, and includes an enterprise section for IT teams on managing file credentials at scale.
Who this guide is for: Individual employees who need to protect sensitive files, and IT and security leaders who need to understand why Excel file passwords represent an unmanaged enterprise credential risk.
The basics of Excel spreadsheet protection
Excel and Google Sheets help users identify data trends and sort heaps of information into meaningful insights. Password-protecting these files helps safeguard your data, intellectual property, and hard work from unauthorized access and unintended changes.
Excel has built-in password protection and encryption features to lock certain aspects of your document and restrict file access. However, Google Sheets doesn’t come with this built-in functionality. To apply password protection to a Google Sheet, you’ll need to use a template that contains an Apps Script code.
Therefore, if you need to password-protect your spreadsheets, Excel might be the simpler option for you.
Here are the top reasons Excel users might want to lock their files:
- Security: When a password is required to open Excel, it helps keep sensitive data confidential and prevents unauthorized access.
- User error prevention: Password protection or restricting permissions can prevent accidental or unintentional modifications to Excel files, reducing the risk of data loss or corruption caused by user error.
- Version control: With Excel's version control feature, only authorized individuals can track, review, and approve changes, helping maintain data integrity and consistency over time.
- Intellectual property protection: Excel workbooks may contain proprietary formulas, calculations, or business strategies that provide a competitive advantage. Password-protecting an Excel file safeguards intellectual property from unauthorized access or being copied.
Choosing the right level of protection
Excel offers three distinct protection levels. Choosing the right one depends on what you're trying to secure:
Protection Level | What It Controls | Best For |
|---|---|---|
| File password | Who can open the file at all | Highly sensitive files: financials, HR data, client records |
| Workbook protection | Who can add, delete, or rename sheets | Files shared across a team where structure must stay intact |
| Sheet protection | Who can edit specific cells or ranges | Files where some users should view but not modify data |
How to password protect an Excel file? (open password)
An open password prevents anyone without the correct password from opening the file. This is the strongest form of Excel file protection.
On Windows
- Open the Excel file you want to protect.
- Click File and select Info.
- Click Protect Workbook, then select Encrypt with Password.
- Enter a strong password and click OK.
- Re-enter the password to confirm and click OK.
- Save the file.
On Mac
- Open the Excel file.
- Click the Review tab in the ribbon.
- Click Protect Sheet or Protect Workbook depending on what you want to lock.
- Enter a password and confirm.
- Save the file.
Note: The password you set here is a credential, in exactly the same way a login password is a credential. It should be strong, unique, and stored in a password manager, not texted or emailed to others or written down.
How to password protect an Excel workbook
Workbook-level protection controls structural changes: Who can add, rename, move, or delete worksheets. This is separate from the file open password.
- Go to the Review tab.
- Click Protect Workbook.
- Check Structure to prevent sheet-level changes.
- Enter a password, click OK, and confirm.
How to password protect an Excel sheet
Sheet-level protection lets you lock specific sheets while leaving others editable. You can also define which cells users can edit even within a protected sheet.
- Right-click the sheet tab you want to protect.
- Select Protect Sheet.
- Choose which actions permitted users can still take (select cells, format, insert rows, etc.).
- Enter a password and click OK.
How to remove password protection from an Excel file
If you need to remove protection from a file you already have the password for:
- Open the file and enter the password when prompted.
- Go to File > Info > Protect Workbook > Encrypt with Password.
- Delete the existing password from the field and click OK.
- Save the file.
For sheet or workbook protection, go to Review > Unprotect Sheet or Unprotect Workbook and enter the password.
Choosing a strong Excel file password
Excel's encryption is only as strong as the password protecting it. A weak password on an AES-256 encrypted file is still easily brute-forced.
A strong Excel file password should:
- Be at least 16 characters
- Include uppercase letters, lowercase letters, numbers, and symbols
- Not be a word, phrase, or pattern that can be guessed
- Be unique to this file and not reused from any other account or file
Excel file passwords are an enterprise credential risk
Most organizations treat Excel file passwords as an individual responsibility, meaning the employee who creates the file sets a password and is responsible for sharing it. In practice, this produces a credential risk problem that IT and security teams have little visibility into.
What makes Excel passwords a security gap
Across a typical enterprise, password-protected Excel files contain some of the most sensitive data in the organization:
- Financial models and forecasts
- Employee salary and HR records
- Customer contracts and pricing
- Proprietary business formulas and strategies
- Regulated data subject to compliance requirements (HIPAA, SOX, GDPR)
The passwords protecting these files are almost never managed with the same rigor applied to login credentials. Common patterns that security teams see:
- Weak, predictable passwords: “Password123,” the company name, or the file name itself
- Password reuse: The same password applied to dozens of files across the organization
- Unsecure sharing: File passwords sent over email, Slack, or SMS in plaintext
- No offboarding process: When an employee leaves, the passwords they set on business-critical files leave with them
Each of these represents a real data exposure risk that standard credential management policies fail to address because they were never designed with file-level passwords in mind.
Why IT teams have no visibility
The challenge is structural. Excel's built-in password protection is entirely user-controlled. There is no admin override, no central log of which files have been protected, and no audit trail of who has accessed a password-protected file.
This means:
- A departing employee can take access to critical files by simply not sharing the password before they leave
- There is no way to enumerate which sensitive files are protected with weak or reused passwords
- If a password-protected file is exfiltrated, there is no mechanism to force a remote password reset
- Security teams cannot include file passwords in their credential hygiene audits without manually surveying employees
For organizations subject to compliance frameworks (SOC 2, ISO 27001, HIPAA, SOX), the inability to demonstrate control over file-level access credentials is a genuine audit risk.
The right way to manage Excel file passwords in a business
Treating Excel file passwords as managed credentials rather than informal employee choices closes most of the gaps above.
In practice, this means:
- Store file passwords in a business password manager, not in your head or your inbox. A password manager gives the employee secure, retrievable storage for the file password, generates a strong unique password on demand, and allows the password to be shared securely with authorized colleagues without sending it over an unencrypted channel.
- Use secure password sharing, not email. Sharing an Excel file password over email or Slack sends the credential in plaintext through systems that may be logged, archived, or compromised. A password manager's secure sharing feature transmits credentials through an encrypted channel with access controls. Dashlane allows businesses to share credentials with specific team members and revoke access when the collaboration ends.
- Include file passwords in offboarding procedures. When an employee who owns password-protected business-critical files leaves the organization, their file passwords should be transferred to a manager or successor before the account is closed. A business password manager with admin console access makes this process auditable and controllable.
- Apply the same password hygiene standards to file passwords that you apply to login credentials. Set a minimum length and don't reuse any passwords. If your organization has a password policy, it should explicitly include file-level passwords for sensitive documents.
Enterprise credential risk management and Excel files
For security teams managing credential risk at scale, Excel file passwords are a category worth including in the credential hygiene program. The practical steps:
- Audit existing sensitive files to identify which business-critical Excel files are password-protected and confirm that those passwords are stored in the company password manager.
- Update the acceptable use policy to require that passwords for sensitive files meet the organization's credential standards (length, uniqueness, no reuse).
- Include file password transfer in the offboarding checklist so that departing employees hand off access before their accounts are closed.
- Integrate file credential management into day-one security onboarding so new employees know from their first day how to create, store, and share file passwords securely.
Dashlane's admin console gives security teams a centralized view of the organization's credential health. While it cannot audit Excel files directly, it can confirm that the passwords employees are using for sensitive files meet the organization's hygiene standards.
Proactive credential security: Beyond the file
Excel file protection is one layer. For organizations that store genuinely sensitive data in spreadsheets, file-level protection should sit inside a broader proactive credential security posture:
| Layer | What it provides |
|---|---|
| Excel file password (strong, unique) | Prevents unauthorized file access |
| Business password manager | Stores, generates, and securely shares file credentials |
| Admin console credential visibility | Confirms file passwords meet hygiene standards |
| Dark web monitoring | Alerts if a file password or related credential appears in a breach |
| Employee security training | Ensures employees understand file security as part of credential hygiene |
Organizations with this stack in place have visibility into their file credential risk, not just their login credential risk. They can remediate quickly if a file password is exposed, and they can demonstrate to auditors that sensitive data is protected with managed, policy-compliant credentials.
Summary: File protection is only as strong as the credential behind it
Excel's built-in encryption is technically strong. AES-256 encryption, which Excel uses for file-open passwords, is not practically breakable with current technology. The real vulnerability is the credential protecting it.
A strong, unique, properly stored and shared password makes Excel's file protection genuinely effective. A weak, reused, or unsecurely shared password makes the encryption irrelevant.
For individual employees: Use Dashlane's password generator to create a strong password for each sensitive file, and store it in your vault so you never have to write it down or email it to a colleague.
For IT and security teams: Include file-level credentials in your credential hygiene program, your offboarding procedures, and your day-one security training. The sensitive data in those files deserves the same managed credential posture you apply to your login credentials.
Frequently asked questions
What are the biggest credential security risks facing enterprises?
Beyond the well-known threats like phishing and credential stuffing, one underappreciated risk is unmanaged file-level credentials. Password-protected Excel files containing sensitive business data are common across almost every enterprise, but the passwords protecting them are rarely subject to the same policies applied to login credentials. They are frequently weak, reused, shared unsecurely, and invisible to security teams.
How do enterprises manage and reduce credential-based security risk?
The most effective approach combines a business password manager (for generating, storing, and securely sharing credentials) with a comprehensive admin console (for visibility into credential hygiene across the workforce), and a policy layer (minimum standards for password strength, uniqueness, and rotation). File-level credentials like Excel passwords should be included in this framework, not treated separately.
How do I enforce password security policies company-wide with minimal friction?
A business password manager with admin enforcement capabilities allows security teams to set minimum standards and monitor compliance without requiring employees to manually remember or manage complex passwords. Dashlane's enterprise platform provides policy enforcement alongside automated password generation and secure sharing, reducing the friction that causes employees to choose weak passwords.
What is the difference between reactive and proactive credential security?
Reactive security responds to breaches after they occur: A credential is found in a breach, the team resets it, and closes the incident. Proactive credential security surfaces risk continuously before a breach happens, through dark web monitoring, credential health dashboards, and policy enforcement. For file-level credentials, proactive security means auditing and managing Excel file passwords before a sensitive file is exfiltrated, not after.
How do I give new employees secure credential access from day one?
Day-one onboarding should include enrolling the employee in the company password manager, providing access to shared credentials through the manager's secure sharing mechanism (not email), and training on the organization's file security standards, including how to password-protect and manage sensitive Excel files. Dashlane can be deployed in minutes and integrates with most SSO systems for frictionless onboarding.
What credential security tools integrate with SIEM and remediation platforms?
Dashlane integrates with major SIEM and identity platforms, enabling security teams to connect credential risk signals to their existing alerting and remediation workflows. This means that a compromised credential, including one used to protect a sensitive Excel file, can trigger an automated remediation workflow rather than requiring a manual helpdesk ticket.
References
- Ablebits, “How to protect and unprotect Excel sheet with or without password,” March 2023.
- Microsoft Support, “Protect an Excel file.”
- Microsoft Support, “Protect a workbook.”
- Causal, “Protecting Individual Worksheets by User in Excel,” April 2023.
- Modano, “Microsoft Excel Training - Different Levels of Protection.”
- Repair MS Excel, “5 Tricks To Protect Excel Workbook From Editing.”
- Microsoft Support, “Restrict changes to files in Excel.”
- OneModel, “Encrypting a Spreadsheet Using Excel,” May 2023.
- Coefficient, “How to Password Protect Google Sheets,” May 2023.
- Kiteworks, “Everything You Need to Know About AES-256 Encryption.”
- Dashlane, “No Shortcuts: Why a Culture of Security is So Important,” January 2023.
- Dashlane, “What Is Password Sharing & When Should I Use It,” February 2023.
- Microsoft, “Encryption,” March 2023.
- Microsoft, “Protection and security in Excel.”
Sign up to receive news and updates about Dashlane
