Somewhere on millions of computers sits a file named passwords.xlsx, or logins - Copy (2).xls, or a Google Sheet called "Important Info." Rows of sites, usernames, passwords - Sometimes lovingly color-coded. It feels responsible: no reuse, everything written down, all in one place.
That last phrase is the problem. A password spreadsheet is all your credentials, in one place, in plaintext, in a file format every attacker knows to look for. It concentrates your entire digital life into a single point of failure with none of the protections that make concentration survivable. Here's exactly how it goes wrong - And the one-hour exit ramp.
One file, total blast radius
Security design has a term for what a spreadsheet lacks: defense in depth. A password manager assumes bad days - Device theft, malware, a stolen laptop - And layers encryption, a separate master password, auto-locking and access logging against them. A spreadsheet assumes nothing bad ever happens.
So when something bad does happen, the failure is total and simultaneous. There's no "they got one password" scenario with a spreadsheet; there's only "they got the file." Every bank, every email, every account, labeled and sorted, often complete with the security-question answers in a helpful extra column. An attacker who obtains it doesn't need credential-stuffing infrastructure or cracking rigs - You've done the collation for them.
Malware shops for your file by name
This isn't a theoretical fear. The dominant malware families today are infostealers - Commodity tools that raid an infected machine in seconds - And their standard configuration includes a file grabber that sweeps user folders for documents matching keyword patterns: password, login, wallet, seed, 2fa. A file literally named passwords.xlsx is the exemplar target the feature was built for. Stolen files are bundled into logs and sold in bulk.
Renaming the file recipes.xlsx is the obvious dodge and a poor one: grabbers also sweep by file type and location, and any human reviewing the log opens spreadsheets first. Obscurity is not a lock.
The copies you forgot exist
Even without malware, a spreadsheet's lifecycle works against you. Files multiply:
- Cloud sync: OneDrive, iCloud, Google Drive and Dropbox replicate the file to servers and to every signed-in device - Including that old laptop in the closet with the outdated OS.
- Version history: Google Sheets and Office keep prior revisions. Deleting a password row today does not delete it from last month's version; most people never purge history, and shared-file viewers can often browse it.
- Backups and attachments: Time Machine snapshots, the copy you emailed yourself in 2021, the export in your Downloads folder. Each is a live credential database you're not guarding.
- Sharing drift: a Sheet shared "just once" with a spouse or coworker stays shared. Link-sharing set to "anyone with the link" is one forwarded URL from public. (There are safe ways to hand over a credential - Our guide to sharing passwords safely covers them - And a mailed spreadsheet is not one.)
A password manager is one encrypted vault you control. A password spreadsheet is an unknown number of plaintext copies you don't.
"But my spreadsheet has a password on it"
Office and Google offer several features that feel like protection and mostly aren't:
| Feature | What it actually does | Stops a thief? |
|---|---|---|
| Excel "Protect Sheet/Workbook" | Blocks accidental edits; trivially removable | No |
| Google Sheets "Protected ranges" | Edit permissions only - Viewers still read everything | No |
| Legacy .xls "password to open" | Weak RC4-era encryption, broken by cheap tools | No |
| Modern .xlsx "Encrypt with Password" | Real AES encryption - As strong as the password you pick | Partially |
| Renaming/hiding the file | Nothing | No |
The one defensible row is modern Office's Encrypt-with-Password, which since Office 2007+ uses genuine AES - The same cipher family we demystify in AES-256 encryption explained, and which you can experiment with using our AES-256 encryption tool. But even that best case inherits every other flaw on this page: no per-entry locking (open once, everything's exposed and re-savable in plaintext), no auto-lock, no phishing-resistant autofill, human-chosen passwords guarding it, and the version-and-copies sprawl untouched. Encrypting a fundamentally wrong design produces a well-encrypted wrong design.
And a subtler cost: spreadsheets can't fill logins for you, so every use means displaying the plaintext grid and retyping - Visible to shoulder surfers, capturable by keyloggers, and pasteable into look-alike phishing sites that a real autofill system would have refused to fill. Even the browser's built-in vault clears that bar, as we detail in storing passwords in your browser.
The one-hour migration
The fix is mechanical. Block out an hour:
- Pick the destination. Any reputable dedicated manager; our password manager guide compares approaches if you haven't chosen.
- Import the spreadsheet. Most managers import CSV directly - Export your sheet as CSV with columns for site, username, password, and map the fields. Your color-coded diligence transfers in minutes.
- Rotate the crown jewels. Treat every password that lived in the sheet as potentially exposed - You can't prove no copy leaked. Start with email and banking: generate replacements with a password generator at 16+ random characters each. Work down the priority list over the following week.
- Destroy the sheet - All of it. Delete the file and empty the trash; purge cloud copies and their version history; delete the emailed copies from Sent; revoke any shares. Then search your drives for
passwordin filenames to catch strays. - Delete the CSV export from step 2 - The classic migration mistake is leaving a fresh plaintext copy in Downloads.
FAQ
Is a Google Sheet safer than an Excel file on my desktop?
Different, not safer. Google's servers are well defended, but the sheet is protected only by your Google login - One phished password or hijacked session away from full exposure - Plus whatever sharing settings have drifted over the years, plus a version history that quietly retains deleted rows. The local Excel file trades those risks for malware and device-theft exposure. Both fail the same design test: plaintext, all-or-nothing, no independent lock.
What if I encrypt the spreadsheet with a strong password?
Modern Office encryption with a long random password is genuinely hard to crack, and it's the least-bad spreadsheet configuration. You still lose on everything operational: the whole file decrypts on open, nothing auto-locks, there's no phishing-matching autofill, history and stray copies persist, and one keylogged master unlock exposes the entire grid. At that point you're hand-building a worse password manager than the free real ones.
Is a printed password list better than a spreadsheet file?
Against remote attackers, dramatically better - Paper can't be exfiltrated by malware or synced to forgotten clouds, which is why a notebook at home is a defensible low-tech system. Its weaknesses are local (household access, loss, no backup) and practical (no autofill, painful updates). If you use paper, keep it away from the computer and never photograph it - The photo recreates the file problem in your camera roll.
How do attackers even find my spreadsheet?
Four routine paths: infostealer malware sweeping for credential-keyword filenames; account compromise of the cloud service or email where a copy lives; overshared links and lingering collaborator access; and physical or resale access to an old device with a synced copy. None are targeted at you personally - They're automated dragnets, which is exactly why the file's discoverable format matters more than your obscurity.
I only keep low-value logins in my sheet. Is that fine?
It's the most defensible version, but audit two assumptions. First, "low-value" drifts - Sheets accumulate a bank login or an email password over the years. Second, reused patterns leak: if your throwaway passwords share a formula with your serious ones, the sheet teaches it to whoever reads the file. If the sheet truly holds only unique junk-tier passwords, your real risk is just that the habit spreads.