How easily can an Excel document password be cracked? [closed]

Question

Does Excel use strong cryptography like AES?

What file format would you choose to store a list of passwords?

Answer 1

There are dozens of password safes out there, such as passkeeper, PasswordKeeper, KeePass, etc. It is best to use an existing option than do extra work to develop your own.

If you are intent on just using a single file, try an encrypted sqlite3 database.

Answer 2

I would highly recommend KeePass. It has been ported to multiple platforms. You can handle database syncing with for example Dropbox, if you need it on multiple computers or in computer and mobile phone, for example.

Excel password protection isn't really strong. See for example this. Of course, it's good idea to keep that original file in a safe place, but even better if you can freely share it and password protects it.

Note however, normal password (something like 8 characters) is way too short to protect against offline cracking. In many web services it's long enough, because attacker can try passwords only few per second. Otherwise service provider (usually) automatically blocks attempts for some time. Testing passwords on local file (for example password protected Excel/ZIP), you can typically try many thousand alternatives per second, using normal desktop machine. And you can get even more speed by distributing cracking to multiple computers.

So: if you want it to be secure, don't use Excel. If security is important, choose long enough passphrase, that's complicated enough (can't be easily guessed with dictionary attacks or otherwise).

Answer 3

One of the most secure and open source password safes out there, this one or Keypass are the only ones to use.

http://passwordsafe.sourceforge.net/

Answer 4

My password list is not secure (xls with a simple password only) but the passwords are not written in clear there. I follow a few combined rules I defined and I won't forget to write passwords so even with the password list, nobody will guess the real passwords. For example, if I write kr, it means a special word or number (always the same), if kr- it's the same reverted, kr-2 is the same reverted but using only 1st of each group of 2 letters or numbers. If I write a number it's the 1st number of a sequence constructed always the same way and I can apply the previous - and 2 modifiers (and some others I defined). Anyways all words in my passwords have always missing or repeating letters (always in the same place so I can remember which one) to harden a little against dictionary attacks.

This looks a bit complicated but it's quick to get used to and after that it will be easy to find your passwords and you will never have to rely on a master password or 'safe' software (that can be cracked or guessed) to protect everything.