ScrubDrop › Guides

Excel sheet protection is not encryption: what a protected workbook still lets anyone read

Last updated: 28 October 2026

This page is for people who send a workbook with some of it locked or hidden: a price list with the cost column hidden, a budget template with a protected calculation sheet, a report whose working sheets are hidden and the structure locked. It explains what each kind of Excel protection does, what stays readable in the file, and how encryption with a password is different. For finding hidden sheets and the other places a workbook keeps data, see hidden sheets, defined names and personal information in Excel and hidden rows, columns and personal data in cells.

Three different things called protection

Microsoft's page Protection and security in Excel sets the three levels side by side: file-level, where "File encryption" lets you "specify a password and lock the Excel file"; workbook-level, which locks the structure; and worksheet-level, which controls "how a user can work within worksheets". It lists a password to open or modify a file separately, for when "you need to give Read-only or edit access to different users". The same page warns: "You should not assume that just because you protect a workbook or worksheet with a password that it is secure".

Protect Sheet: what it stops, and what it does not

Microsoft's page Protect a worksheet describes sheet protection as a way "to prevent other users from accidentally or deliberately changing, moving, or deleting data in a worksheet", and follows it with a warning box: "Worksheet level protection isn't intended as a security feature. It simply prevents users from modifying locked cells within the worksheet. Protecting a worksheet is not the same as protecting an Excel file or a workbook with a password."

Protection is a set of permissions in Excel. With Format columns and Format rows not allowed, people cannot use the row and column formatting commands, which include hiding, in Excel; with a cell's Hidden box ticked, Microsoft's page Display or hide formulas shows how to "Prevent a formula from displaying in the formula bar". None of this changes what is saved. In the .xlsx, the sheet's cells, including those in hidden rows and columns and the formulas behind hidden-formula cells, are in the sheet's part (xl/worksheets/sheet1.xml and so on), and its text is usually in xl/sharedStrings.xml, in plain XML. Protection adds one element to the sheet, sheetProtection, which records the permissions and, if you set a password, a hash of it.

The file format standard, ISO/IEC 29500, which Microsoft's Open XML documentation quotes for workbookProtection, says that worksheet or workbook element protection "should not be confused with file security" and "cannot protect it from malicious modification". If you have used a hidden formula to keep a calculation private, see also defined names and hidden formulas.

Protect Workbook: hidden sheets stay in the file

Microsoft's page Protect a workbook says that, to prevent others "from viewing hidden worksheets, adding, moving, deleting, or hiding worksheets, and renaming worksheets, you can protect the structure of your Excel workbook with a password". With the structure locked, Unhide is unavailable in Excel. The page adds that the password is optional: "If you do not supply a password, any user can unprotect and change the workbook."

A hidden sheet is still a sheet of the workbook. Microsoft's page Hide or unhide worksheets says: "The data in hidden worksheets is not visible, but it can still be referenced from other worksheets and workbooks". In the .xlsx, xl/workbook.xml lists every sheet with its name, and a hidden one has state="hidden" or state="veryHidden"; its cells are in its own part under xl/worksheets, whatever the structure protection says. Locking the structure records a workbookProtection element in workbook.xml; it does not move or encrypt the hidden sheet. For that element, the standard adds: "This protection can be ignored by applications which choose not to support this optional protection mechanism."

Encrypt with Password: what changes, and what does not

Microsoft's page Protect an Excel file gives the route, File › Info › Protect Workbook › Encrypt with Password, and says it "covers file-level protection only, and not workbook or worksheet protection." An encrypted workbook is a different kind of file: Microsoft's file format documentation, [MS-OFFCRYPTO], says encrypted documents "contain the entire document as a single stream" in an OLE compound file, and that this \EncryptedPackage stream is "an encrypted stream" of bytes "containing the entire ECMA-376 source file". Without the password, the copy cannot be unzipped and its parts cannot be read.

Encryption does not remove anything. Whoever has the password opens the whole workbook: its hidden sheets, hidden rows and columns, comments, properties and the rest, exactly as you saved them. The page also warns: "It's not always secure to distribute password-protected files that contain sensitive information such as credit card numbers", and "Be cautious when sharing files or passwords with other users." It adds that "Microsoft cannot retrieve forgotten passwords". The same page reminds you that "locking a file with a password does not necessarily protect your file from malicious intent." Encryption keeps the file from people who do not have the password; it is not a way to keep part of the workbook from the person you give the password to.

What to do instead

• Delete what the recipient should not have. Work on a copy. Delete hidden sheets you do not mean to send, delete hidden rows and columns rather than hide them, and replace formulas that reveal a calculation with their values. Then check the other places a workbook keeps data, such as comments, defined names and pivot caches (see find hidden data in Excel).
• Protect, if you want to prevent edits. Sheet and structure protection are useful for a form or a template that people fill in. Use them for that, after the deletions, not to hide data.
• Encrypt, if the file needs a lock on its way. Encrypt with Password keeps the file from people who do not have the password. Send the password by a different route from the file.

How to check a protected workbook

1. In Excel, look at the Review tab: Unprotect Sheet or a highlighted Protect Workbook shows protection is on. Look for row numbers or column letters that skip. Do not rely on the Unhide command: with the structure locked it is unavailable whether or not a sheet is hidden, and very hidden sheets never appear under it. The file itself tells you (step 3).
2. Make a copy of the .xlsx, rename it to .zip and unzip it. If it will not unzip, it may be encrypted: Excel asks for a password when you open it.
3. Open xl/workbook.xml in a text editor and read the sheet entries: each name, and any state="hidden" or state="veryHidden". Look for workbookProtection.
4. Open each part in xl/worksheets: look for hidden="1" on row and col entries, and for sheetProtection. Read the values in the c elements, the formulas in f, and the text in xl/sharedStrings.xml.
5. Anything you find there, the recipient can find too.

What ScrubDrop does

ScrubDrop reads the .xlsx in your browser; the file is not uploaded. Sheet and workbook protection do not stop it reading: it lists hidden sheets (including very hidden ones) and counts the cells in hidden rows and hidden columns, with examples by sheet and cell, on protected sheets as on any other, with the other kinds of hidden data it supports. For free, one file at a time, it removes properties, comments and tracked changes. ScrubDrop Pro also removes hidden sheets and empties the cells of hidden rows and columns (the rows and columns stay, hidden and empty, and formulas on the sheets that stay are replaced by their last saved results); in some arrangements, such as a table on a sheet with hidden rows or columns, it refuses and says what to change in Excel first. It does not look for formulas hidden with a cell's Hidden box, so check those yourself.

ScrubDrop does not change protection. The sheetProtection and workbookProtection settings, including a stored password hash, are kept as they are in both versions, so a protected sheet stays protected in the cleaned copy. An encrypted workbook is refused with a message, because ScrubDrop cannot read it without the password: save a copy without the password, check that copy, and encrypt the cleaned result if you need to. The cleaned file is read again with separate parsers before it is offered.

Questions

Sources: the Microsoft pages linked on this page were checked on 28 October 2026. ScrubDrop is not affiliated with Microsoft.