How does Microsoft Word password protection work?This blog will guide you through the process of protecting a Word document, but we’ll also answer an important question: is Microsoft Word password protection suitable in a business environment?
How does Microsoft Word password protection work?
Despite heavy competition from the likes of Google Docs, Microsoft Word has remained the text editor of choice for many businesses. It’s used for anything from note-taking to documentation, contracts, reports, and legal documents. Given the sensitive nature of some of these documents, it’s natural that businesses want to secure them. Microsoft Word uses simple yet effective encryption for its document protection. While the document remains encrypted, it cannot be read – presenting itself as a jumble of numbers and letters to anybody who does not hold the decryption key. Entering the password allows a user to decrypt the document and therefore view and edit it.
Microsoft Word has another, lesser-used password protection that controls whether or not users can edit. This does not use encryption and is instead enforced by the software, which disables the ability to type, delete characters, and modify formatting. We’ll talk about both methods today.
The problem with password-based encryption
The issue shared by all password-based encryption mechanisms is that they take a strong encryption algorithm (such as AES) and make it far less secure. Instead of requiring a long, complex, and randomly generated encryption key, all an attacker needs is a human-created, often short and simple, encryption password.
This fact applies to Word documents as well as when you password protect Excel, PDFs, password-based folder encryption, etc. And make no mistake – after decades of passwords being used for everything from social media to bank accounts, tools have become very effective at cracking them.
The bigger issue, however, is not that passwords are crackable, but that they are shareable. Any legitimate user that you give the document to, along with the password, can share both of those things with an unauthorized party. This could be intentional, in the case of an internal leak, or unintentionally, through social engineering, the storage of the password in an insecure location, etc.
The same applies to the contents of the document itself. If there are no additional editing or copy protection controls, a user with the password can just copy the content to another file or into an email or text chat and share the file that way.
Ultimately, then, password encryption only protects documents from being intercepted and when they are sitting on the recipient’s PC, unopened. But even then, due to the human nature present in password choice, it is of limited effectiveness.
So, what about Word’s in-built editing protection? Is that effective at preventing sharing?
Restrict editing in Word: is it effective?
As you would expect, Word’s restrict editing feature has the same issue as any other password protection: sharing and cracking. However, in this case it’s worse than that because the document has already been decrypted. A user can easily:
The restrict editing tool, then, is mostly there to prevent somebody from editing a document accidentally, rather than offering any real protection.
Why password protected links do not work
Another popular way to create and share a password protected Word doc is using OneDrive. Users can upload their document to the cloud service, share it as a link, and then modify the link sharing settings to require a password. 
This makes fundamentally no difference to security. It has the same flaw as any other password protection: users can share the password along with the link.
OneDrive’s editing and copying controls are also flawed. On regular versions of OneDrive, you cannot prevent downloads and downloaded copies have no protection. While enterprises with a SharePoint license do have the ability to stop downloads, users can still copy and paste or screenshot, as covered in SharePoint security.
How to password protect a Word document to prevent opening
Though as we discussed password-protecting a document in Word will not stop leaks or unauthorized sharing, it can be useful to protect documents before they are opened. Here’s how to encrypt a Word document with a password:
How to password protect a Word document to restrict editing
Microsoft Word’s editing protection isn’t good for much (it does not use encryption), but it will stop you or a recipient from accidentally changing the contents of a document. You can also enable it very quickly via the “Review” tab.
How to hack a password-protected Word document
If you forgot the password to your password-encrypted Word document, it is possible to recover the file. In fact, if you only applied a password to restrict editing, this is trivial. For documents that were encrypted using a password, the process will be much lengthier, requiring a brute force attack. Let’s start with the easy option.
How to unlock an edit-restricted Word document without a passwordThe easiest way to unlock a Word document with Restrict editing applied is to not unlock it all. Though Word disables editing, it doesn’t disable other functionality that enables you to bypass editing restrictions.
It’s as easy as that. Any of these methods will remove the protection in less than a minute.
If for whatever reason you want to keep the original document intact, you can unlock the edit restricted document using a password recovery app instead. There are various paid options out there – just google “Word password recovery”, but we’ll be using Passware because its free trial allows you to see if the unlock was successful before you purchase.
Unlocking a Word document using such software is easy. After installing the trial, just:
You can buy the software to gain access to the file. It should be able to remove the restrict editing password 100% of the time, as there is no encryption involved in Microsoft Word’s controls.
How to unlock an open password encrypted Word documentUnlocking a password-protected Word document that uses encryption is going to take time if you do not already know the password. How much time will depend entirely on how long and complex the password was used to protect the document. Either way, you’ll have to use paid software to do so, such as Elcomsoft Advanced Office Password Recovery, though it does not have to be too expensive.
We’ll be using Passware because its free trial tells you part of the password for free, allowing you to be sure the document can be unlocked before paying. Here’s how to use it:
Depending on the password length, how much information you’re able to provide, and your PC’s specs, this process could take anywhere between seconds and years. In our testing, the software was able to crack a simple four-character password in about four seconds.
Of course, the easiest way to crack longer passwords will usually be to either ask somebody who knows it or perform a social engineering/phishing attack.
How to encrypt a Word document for email
If you want to encrypt a Word document for email, you can just password-protect it in Microsoft Word and then send it using any email application such as Outlook, Gmail, etc. However, you also have to find a way of securely transmitting the password to the recipient so they can open the encrypted Word document. This can become cumbersome if you have multiple files to encrypt and send to multiple recipients.
A more secure way of encrypting a Word document for email would be to use PGP encryption (it uses public key technology instead of passwords) and encrypt the Word document as an attachment. Alternatively you can use a dedicated secure email app or service such as Hushmail.
If you want to encrypt a Word document and control how it can be used after it has been decrypted (i.e. prevent the user passing it on, copying text, printing it, etc.) then the only way you can achieve this is by using DRM or Digital Rights Management restrictions. See How to send a secure PDF file or attachment by email for how to achieve this.
A better way to encrypt and protect documents
The protection Microsoft Word can provide is not suitable for document sharing in a business environment. It is definitely not suitable for the protection of confidential and sensitive information. Its editing protection is basically useless, and its password encryption is only suitable when the document is in transit or at rest.
For serious protection of sensitive and confidential documents, organizations should use a document DRM solution instead. Document DRM is designed to protect your file in all situations while retaining modular controls. Here’s how Locklizard PDF DRM works:
The licensing server transfers the decryption keys from the server securely, transparently, and only to authorized users that hold a valid license file. Once received, the keys are saved in an encrypted keystore that cannot be shared with other devices.
As a result, users without a valid license cannot decrypt and view the file. Those who do have permission to view the file cannot edit or otherwise share it, as its contents are only ever decrypted in memory and the secure viewer application prevents editing, copying, screenshotting, and printing (if desired).
Of course, while PDF DRM like Locklizard offers far better protection it’s also an additional cost. So you need to decide: how important is document security to your business? Do you often share sensitive documents with untrusted parties, or will simple password protection do? Ultimately, only you can decide – but do not underestimate the impact of a leaked document on your business or how far people are willing to go to break your security.
FAQs
All Office files (Office 2016 and above) that you password-protect are encrypted with AES 256-bit. Office 2010 and above uses AES 128-bit. Older versions of Microsoft Office use a proprietary encryption algorithm.
How secure Word encryption is depends on what you are trying to achieve:
This option enables users to view a Microsoft word document but not edit it. However, it does not prevent users copying content into another Word doc, saving it to another format or printing it to a file driver – all of which defeats the purpose of a read-only mode.
You select read-only mode in the Restrict Editing section.
A digital signature is an invisible signature used for authentication purposes. It differs from an electronic signature (a visible image of your written signature) but can be used in conjunction with it. A digital signature is an encrypted stamp of authentication and is created by using a signing certificate, which if issued by a reputable Certificate Authority, proves identity.
Adding a digital signature to a Word doc confirms that the information originated from the signer and has not been altered. Recipients need your certificate and public key to verify the signature. So if users remove editing restrictions from an Office document and alter it after it has been digitally signed then you will be alerted to this.
No, you can restrict access and prevent editing, copying and printing by using Microsoft Rights Management Services (RMS). This uses cryptographic keys instead of passwords to protect content. Additional controls such as expiry, and tracking is also available in Azure RMS (the cloud version). However, Microsoft RMS can be bypassed by any user with view access via the use of a simple .exe file published by researchers years ago.
Follow the instructions in this guide:
Bear in mind that the security is pretty useless so should not be used for the protection of sensitive and confidential business documents.
Locklizard does not protect Office files in their native format. If you want to encrypt a Word document with DRM, then just like if you want to protect PowerPoint presentations, you have to convert Word to PDF and then protect it.
If you want to lock a Word document from editing, copying, copy paste, sharing and printing then save it as a PDF file before protecting it with Locklizard Safeguard. Wtih Locklizard you can also lock a Word document to a device and location, add expiry, and remotely revoke access.
There is no option in Word to make a document expire. You have to use MicroSoft RMS (used by Azure 365 and AD) or another form of DRM. The same applies if you want to prevent a Word document from being printed, copied, edited, or shared.
Locklizard enables you to expire Word docs that have been converted to PDF format. You can make a document expire on a fixed date, after a number of views, days or prints.
While you can recall sent emails and their attachments (see how to recall an email in Outlook), this functionality is much more limited than the revoke feature in a DRM solution such as Locklizard. The Outlook recall feature only works with emails that have not been opened, are sent to an Outlook or exchange address, and are within your organization. Gmail’s unsend feature requires you to act within thirty seconds of sending an email. In practice, these features aren’t very useful for document security.
Locklizard does not use passwords to protect Word documents, so there are no passwords for users to share or for tools to remove. We use secure and transparent key management with a licensing system, AES 256-bit encryption, and DRM controls.
Locklizard gives you full control over your documents:
Locklizard provides the same level of security for offline and online files, and there are no complex policies or keys to manage.
Free Trial“Fantastic product… outstanding support.”
“We would recommend Locklizard to others”
“The clear leader for PDF DRM protection”
“Our ebook sales have gone through the roof”
“Simple & secure – protects IPR from theft”
Protect IPRSee why thousands of companies use Locklizard to safeguard their documents and increase revenue streams.
How to expire Excel files
How to watermark in Excel
How to protect Excel files
Save a Google Doc as PDF
How to share a PDF online
How to insert PDF into Word
How to edit a protected PDF
How to convert ePub to PDF
How to prevent PDF download
How to share Google Docs
How to prevent PDF download
Enforce do not copy distribute
Share sell PDF in WordPress
How to remove a watermark
How to add security to PDF
Publish digital publications
How to share a PDF as a link
How to timestamp a PDF
Insert PDF into Google Doc
How to convert Word to PDF
How to convert PDF to Word
Share securely in SharePoint
How to encrypt email in Gmail
How to encrypt PDF files
How to recall unsend an email
How to watermark PowerPoint
How to lock a Word document
How to santize PDF files
How to lock a Google doc
Prevent PDF security removal
Protect Word without password
Add a dynamic watermark
Password protect Google Doc
Add a watermark in Word
Make a PDF non editable
How to create a stamped PDF
How to prevent ebook piracy
Password protect a Word doc
How to protect a PDF securely
How to revoke document access
Change PDF security settings
How to disable printing of PDFs
Sell online courses securely
How to add security to a PDF
Encrypt a PDF without Acrobat
Share documents securely
How to prevent PDF sharing
Protect confidential documents
How to publish ebooks securely
How to restrict PDF editing
How to password protect a PDF
How to protect ebooks
How to sell Reports securely
How to make a PDF read only
How to send a PDF securely
How to watermark a PDF
How to lock a PDF from editing
How to encrypt a PDF
How to make a PDF expire
How to password protect a PDF
How to protect online courses
How to email a PDF securely
