Encryption type for password protected Office 97-2003 files
This policy-backed registry value specifies the cryptographic provider, encryption algorithm, and key length that Excel, PowerPoint, and Word use when encrypting password-protected files in the binary Office 97-2003 formats.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\common\security\defaultencryption12
This policy-backed registry value specifies the cryptographic provider, encryption algorithm, and key length that Excel, PowerPoint, and Word use when encrypting password-protected files in the binary Office 97-2003 formats.
defaultencryption12 is a string value (REG_SZ). Its data follows the format ‹Encryption Provider›,‹Encryption Algorithm›,‹Encryption Key Length›. The specified cryptographic service provider must be available on the computer where Office encrypts the file.
For example, the current Microsoft 365 Apps security baseline uses Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256. This is the security baseline’s configured value, not a statement of the general Office default.
Notes
Security
The setting determines the cryptographic strength applied to newly encrypted Office 97-2003 files. Effective protection also depends on the strength and confidentiality of the password.
RC4-based encryption methods for binary Office documents have documented cryptographic weaknesses. Microsoft considers Office Binary Document RC4 CryptoAPI Encryption insecure and recommends it only when backward compatibility is required.
This setting does not require users to password-protect files. It also grants no access rights and does not replace file-system permissions, device encryption, or rights management.
Possible side effects
Selecting a stronger or newer encryption method can reduce compatibility with older Office releases and third-party applications. Software that does not support the selected provider or algorithm might be unable to open affected files.
If the specified cryptographic provider is unavailable, or does not support the requested algorithm and key length, Office might be unable to apply the intended encryption method.
Notes
The setting is scoped to the current user and applies only to the older Office 97-2003 file formats. Password-protected Office Open XML files are governed by a separate policy.
Changing this registry value does not automatically re-encrypt existing files. It takes effect during a subsequent encryption or save operation performed by a supported Office application.
Microsoft documentation
Microsoft Learn: Microsoft 365 Apps for Enterprise security baseline settings reference
Microsoft Learn: Office Binary Document RC4 CryptoAPI Encryption