Skip to content
OnlineHashCrack

File conversion tool

Extract an Office hash for an authorized audit

Prepare an encrypted Word, Excel, PowerPoint or Access file for password testing and recovery. No local hash extraction tools are required.

Upload an encrypted Office file

This browser-based converter uses the established office2hashcat and office2john formats. Upload only data you are authorized to assess; files are deleted after extraction.

No file selected

Files are processed for extraction and deleted after extraction. Maximum upload size: 100 MB.

Supported versions and output

Office 2007, 2010, 2013 and later, plus legacy Office 97–2003 files, are supported. The result is a hash line compatible with Hashcat or John the Ripper for a controlled audit.

Use the result responsibly

Validate ownership or written authorization before testing credentials. Recovery results can help you reset weak passwords and document remediation.

Office hash formats

The extractor relies on office2hashcat and office2john, from the Hashcat and John the Ripper projects. The hash format depends on the Office version.

Office 2007

$office$*2007*20*128*16*411a51284e0d0200b131a8949aaaa5cc*117d532441c63968bee7647d9b7df7d6*df1d601ccf905b375575108f42ef838fb88e1cde

Office 2010

$office$*2010*100000*128*16*77233201017277788267221014757262*b2d0ca4854ba19cf95a2647d5eee906c*e30cbbb189575cafb6f142a90c2622fa9e78d293c5b0c001517b3f5b82993557

Office 2013 and later

$office$*2013*100000*256*16*7dd611d7eb4c899f74816d1dec817b3b*948dc0b2c2c6c32f14b5995a543ad037*0b7ee0e48e935f937192a59de48a7d561ef2691d5c8a3ba87ec2d04402a94895

Office 97-2003

Legacy files produce an MD5 + RC4 or a SHA1 + RC4 hash:

$oldoffice$1*04477077758555626246182730342136*b1b72ff351e41a7c68f6b45c4e938bd6*0d95331895e99f73ef8b6fbc4a78ac1a (MD5 + RC4)
or
$oldoffice$3*83328705222323020515404251156288*2855956a165ff6511bc7f4cd77b9e101*941861655e73a09c40f7b1e9dfd0c256ed285acd (SHA1 + RC4)

Responsible use

Hashcat and John the Ripper are powerful and can be misused. Use them only with permission, and follow local laws and organizational security policies. Misuse can have serious legal consequences.

Credits

Credits go to the Hashcat and John the Ripper projects.

Need a complete password audit?

Use the extracted value in an authorized test with OHC’s GPU-accelerated recovery service.

Start the authorized test