Open password-protected Excel and Word files in C#

Open supported encrypted Word, Excel and PowerPoint files with a known password; this does not recover passwords.

dotnet add package RecursiveAI.OneDocument.All

Requires .NET 10 (net10.0); .NET 9 and earlier aren’t supported.

using RecursiveAI.OneDocument;
using var file = Office.Open("secret.xls",
    new OpenContext(password: "example"));
Console.WriteLine("Opened secret.xls");

Prints:

Opened secret.xls

Unzip the example, then dotnet run.

Full program

The included secret.xls is a generated RC4 CryptoAPI workbook with password example. Its Summary sheet has A1 = Project summary and B1 = 42. The password is public sample data; replace it and the filename for your own file.

using RecursiveAI.OneDocument;
using RecursiveAI.OneDocument.Diagnostics;
 
try
{
    using var file = Office.Open("secret.xls",
        new OpenContext(password: "example"));
    Console.WriteLine("Opened secret.xls");
    Console.WriteLine(file.ExtractText().Trim());
}
catch (OfficeEncryptedException)
{
    Console.WriteLine("A correct password is required.");
}
catch (OfficeUnsupportedException)
{
    Console.WriteLine("This encryption scheme is not supported.");
}

dotnet run prints:

Opened secret.xls
Project summary

Missing or wrong passwords raise OfficeEncryptedException; unsupported schemes raise OfficeUnsupportedException. The encryption docs warn: “RC4 is weak: the legacy schemes protect against casual access only.”

Variations

Handle an incorrect password

This intentionally supplies the wrong password for the included workbook.

using RecursiveAI.OneDocument;
using RecursiveAI.OneDocument.Diagnostics;
 
try
{
    using var file = Office.Open("secret.xls",
        new OpenContext(password: "wrong-password"));
}
catch (OfficeEncryptedException)
{
    Console.WriteLine("A correct password is required.");
}

Output:

A correct password is required.

Open an encrypted Word document

The included secret.docx has password secret and begins with “Quarterly report” and a paragraph demonstrating character formatting. It is the public repository’s generated sample, redistributed under the MIT license included in the zip.

using RecursiveAI.OneDocument;
using RecursiveAI.OneDocument.Documents;
 
using var doc = Document.Open("secret.docx",
    new OpenContext(password: "secret"));
Console.WriteLine(doc.ExtractText().Trim());

Output:

Quarterly report
Plain, bold, italic, underlined and large red.
Centered paragraph
Indented with spacing
Item	42
Visit the site.
Before the break
 
After the break

Related recipes

• Read excel file
• Read word document

The short answer

Pass the known password in new OpenContext(password: ...) to Office.Open. The same context can be supplied to Document.Open, Workbook.Open or Presentation.Open when you already know the document kind. OneDocument reads supported encrypted Office formats; this is not a password-recovery API.

The included workbook uses a public example password. In an application, obtain the password from the user or your application’s secret source rather than copying that literal into production code. Dispose the returned file when you finish reading it.

How do I open a password-protected Excel document?

Supply the password on the open call, not after opening. OneDocument decrypts the input before passing its contents through the normal format reader. For supported modern Office files, this includes Agile and Standard encryption in the compound-file EncryptedPackage container. DOCX, XLSX, PPTX and XLSB can use those schemes, according to the encrypted-file documentation.

A filename alone does not identify the encryption scheme. Older XLS, DOC and PPT files can use RC4, and some XLS and DOC files use XOR obfuscation. The sample uses an encrypted XLS generated through the published package. Its decrypted contents are read into the normal workbook model; the original encrypted file is not rewritten by opening it.

The full program catches OfficeEncryptedException for missing or incorrect passwords and OfficeUnsupportedException for unsupported schemes. Those are different problems. Asking the user to retry a password cannot make a certificate-only or unsupported encryption scheme readable.

Supported desktop reads do not imply the same support in a browser. Browser WebAssembly lacks BCL AES and MD5 support at this release, so files requiring those primitives raise OfficeUnsupportedException. Certificate-only Agile files, extensible encryption, rights-managed protection, password-protected Word 6/95 documents and encrypted BIFF2–4 workbooks are among the documented gaps.

How do I unlock a password-protected Word file?

For an encrypted Word file whose password you know, use the same OpenContext on Document.Open or Office.Open. After decryption, an encrypted DOCX is processed as a DOCX. This lets you read and edit supported content through the usual document APIs.

Opening with a password and removing editing restrictions are different tasks. The reader tries Office’s built-in default passwords when no password is supplied for certain editing-only protected files. A supplied incorrect password is an error; it does not fall back to those defaults. This behavior is not a general way to bypass an unknown password.

Encryption on read also differs from encryption on write. Version 1.0.0 does not write encrypted OOXML or ODF files. The documented encrypted-write exception is XLS with RC4 CryptoAPI. Do not assume that saving an opened encrypted DOCX produces another encrypted DOCX, and do not distribute a new save as protected without checking the output operation’s documented behavior.

The reader checks the password verifier before decrypting the data. However, an Agile HMAC integrity mismatch is reported as the repaired defect encryption.integrity-mismatch and the data is still returned. A successful open is therefore not a claim that the file is undamaged or authentic. Malformed encryption headers instead raise OfficeFormatException with a record location. Keep these distinctions in error handling: wrong password, unsupported scheme and damaged input need different responses from the application.