I forgot the password to open a Word document. How can I retrieve the password?

Question

I have a word document that prompts the user for a password to open it, the dialogue box is like below.

"Enter Password to open file" 

I found some code to break a password using brute force which is below (written it from with Excel). The only issue is when I use Documents.Open if the password is wrong word shows the dialogue box - is there anyway to get round this?

Private Sub PasswordBreakerWord()
'Author unknown but submitted by brettdj of www.experts-exchange.com


Dim objWord As Word.Application
Dim objDoc As Word.Document
Dim strPath As String
Dim passAtmp As String

strPath = "H:\My_Path\"

Set objWord = CreateObject("word.Application")
objWord.Visible = True

Dim i As Integer, j As Integer, k As Integer
Dim l As Integer, m As Integer, n As Integer
Dim i1 As Integer, i2 As Integer, i3 As Integer
Dim i4 As Integer, i5 As Integer, i6 As Integer
On Error Resume Next
For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126

  passAtmp = Chr(i) & Chr(j) & Chr(k) & Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)

 On Error Resume Next
  Set objDoc = objWord.Documents.Open(Filename:=strPath & "High Yield FMA Procedures.doc", PasswordTemplate:=passAtmp)
 If Err <> 0 Then
    On Error GoTo 0
 Else
    MsgBox "password is: " & passAtmp
    Debug.Print passAtmp
    Exit Sub
End If

Next: Next: Next: Next: Next: Next
Next: Next: Next: Next: Next: Next

Set objWord = Nothing

End Sub

Answer 1

The file needs to be in .docx format, if it is .doc convert it to .docx:

1. Create a back-up copy of the file.
2. Change the extension from .docx to .zip.
3. Open new .zip file and extract all files.
4. In the extracted folder go to to word\settings.xml.
5. Open settings.xml and remove the code from <w:documentProtection to /> and save the file.
6. Copy the new settings.xml to the original .zip file and overwrite the old one.
7. Rename the .zip to .docx and open file which is now protection free!

Answer 2

Use SendKeys "{ESC}" immediately before you try to open the file.

Answer 3

I adjusted your original code, so it's not dependent on the password being a certain length. Also it will now move from left to right, adding a new character with each pass, and prevents the popups when trying to open the document. This can be used for workbooks as well.

WARNING** The brute force method is really not even worth it. It takes a very long time to run. If it is an encrypted password, then this may be the best option without downloading a third party password breaker.

Sub PasswordBreakerWord()
Dim WordApp As Object
Dim WordDoc As Object
Dim strPath As String
Dim passAtmp As String

Application.DisplayAlerts = False
Application.ScreenUpdating = False

Set WordApp = CreateObject("Word.Application")
Set WordDoc = CreateObject("Word.Document")
strPath = Environ("USERPROFILE") & "\Desktop\blah.docx"

Dim i1 As Integer, i2 As Integer, i3 As Integer
Dim i4 As Integer, i5 As Integer, i6 As Integer
Dim i7 As Integer, i8 As Integer, i9 As Integer
Dim i10 As Integer, i11 As Integer, i12 As Integer

For i1 = 31 To 126: For i2 = 31 To 126: For i3 = 31 To 126
For i4 = 31 To 126: For i5 = 31 To 126: For i6 = 31 To 126
For i7 = 31 To 126: For i8 = 31 To 126: For i9 = 31 To 126
For i10 = 31 To 126: For i11 = 31 To 126: For i12 = 31 To 126

passAtmp = Chr(i12) & Chr(i11) & Chr(i10) & Chr(i9) & Chr(i8) & Chr(i7) & Chr(i6) & Chr(i5) & Chr(i4) & Chr(i3) & Chr(i2) & Chr(i1)
Debug.Print passAtmp

On Error Resume Next
Set WordDoc = WordApp.Documents.Open(strPath, , True, , passAtmp)
If Err <> 0 Then
    On Error GoTo 0
Else
    MsgBox "password is: " & passAtmp
    Debug.Print passAtmp
    WordApp.Quit
    Application.DisplayAlerts = True
    Application.ScreenUpdating = False
    Exit Sub
End If

Next: Next: Next: Next: Next: Next
Next: Next: Next: Next: Next: Next

End Sub

Answer 4

As "Matt" said simply converting the file extension to .zip and then editing the .xml file using notepad or notepad++, removing the entire line after w:documentprotection all the way to /> and then resaving the new .xml file inside the .zip folder will remove the password protection. Tried and tested in Word 2016. Just don't forget to rename the now edited zip folder back to .docx so its readable in Word. All credit to Matt.