Search Apache POI

Apache POI - Encryption support


Apache POI contains support for reading few variants of encrypted office files:

  • XLS - RC4 Encryption
  • XML-based formats (XLSX, DOCX and etc) - AES and Agile Encryption

Some "write-protected" files are encrypted with build-in password, POI can read that files too.


When HSSF receive encrypted file, it tries to decode it with MSOffice build-in password. Use static method setCurrentUserPassword(String password) of org.apache.poi.hssf.record.crypto.Biff8EncryptionKey to set password. It sets thread local variable. Do not forget to reset it to null after text extraction.

XML-based formats - Decryption

XML-based formats are stored in OLE-package stream "EncryptedPackage". Use org.apache.poi.poifs.crypt.Decryptor to decode file:

EncryptionInfo info = new EncryptionInfo(filesystem);
Decryptor d = Decryptor.getInstance(info);

try {
    if (!d.verifyPassword(password)) {
        throw new RuntimeException("Unable to process: document is encrypted");

    InputStream dataStream = d.getDataStream(filesystem);

    // parse dataStream

} catch (GeneralSecurityException ex) {
    throw new RuntimeException("Unable to process encrypted document", ex);

If you want to read file encrypted with build-in password, use Decryptor.DEFAULT_PASSWORD.

XML-based formats - Encryption

Encrypting a file is similar to the above decryption process. Basically you'll need to choose between standard and agile encryption. Apart of the CipherMode, the EncryptionInfo class provides further parameters to specify the cipher and hashing algorithm to be used.

POIFSFileSystem fs = new POIFSFileSystem();
EncryptionInfo info = new EncryptionInfo(fs, EncryptionMode.agile);
// EncryptionInfo info = new EncryptionInfo(fs, EncryptionMode.agile, CipherAlgorithm.aes192, HashAlgorithm.sha384, -1, -1, null);

Encryptor enc = info.getEncryptor();

OPCPackage opc = File("..."), PackageAccess.READ_WRITE);
OutputStream os = enc.getDataStream(fs);;

FileOutputStream fos = new FileOutputStream("...");

XML-based formats - Signing (XML Signature)

An Office document can be digital signed by a XML Signature to protect it from unauthorized modifications, i.e. modifications without having the original certificate. The current implementation is based on the eID Applet which is dual-licensed to ASF/POI. Instead of using the internal JDK API this version is based on Apache Santuario.

The classes have been tested against the following libraries, which need to be included additionally to the default dependencies:

  • BouncyCastle bcpkix and bcprov (tested against 1.51)
  • Apache Santuario "xmlsec" (tested against 2.0.1)
  • and slf4j-api (tested against 1.7.7)

Depending on the configuration and the activated facets various XAdES levels are supported - the support for higher levels (XAdES-T+) depend on supporting services and although the code is adopted, the integration is not well tested ... please support us on integration (testing) with timestamp and revocation (OCSP) services.

Further test examples can be found in the corresponding test class.

Validating a signed office document

OPCPackage pkg =, PackageAccess.READ);
SignatureConfig sic = new SignatureConfig();
SignatureInfo si = new SignatureInfo();
boolean isValid = si.verifySignature();

Signing an office document

// loading the keystore - pkcs12 is used here, but of course jks & co are also valid
// the keystore needs to contain a private key and it's certificate having a
// 'digitalSignature' key usage
char password[] = "test".toCharArray();
File file = new File("test.pfx");
KeyStore keystore = KeyStore.getInstance("PKCS12");
FileInputStream fis = new FileInputStream(file);
keystore.load(fis, password);

// extracting private key and certificate
String alias = "xyz"; // alias of the keystore entry
Key key = keystore.getKey(alias, password);
X509Certificate x509 = (X509Certificate)keystore.getCertificate(alias);

// filling the SignatureConfig entries (minimum fields, more options are available ...)
SignatureConfig signatureConfig = new SignatureConfig();
OPCPackage pkg =, PackageAccess.READ_WRITE);

// adding the signature document to the package
SignatureInfo si = new SignatureInfo();
// optionally verify the generated signature
boolean b = si.verifySignature();
assert (b);
// write the changes back to disc
by Maxim Valyanskiy