Office 2010 AES-128 — Hashcat Mode 9500

Office 2010's incremental upgrade

Office 2010 made one focused change to password protection: the SHA-1 hash chain in the key derivation went from 50,000 iterations to 100,000. The cipher stayed AES-128 in CBC mode, and the format stayed OOXML inside an OLE2 container. The Standard Encryption scheme was structurally unchanged.

The doubled count was a direct response to how fast commodity GPUs grew between 2007 and 2010. Microsoft raised the per-password computational cost to keep pace with attacker hardware — a standard pattern in password-storage design.

Office 2010 also introduced Agile Encryption as a more flexible alternative, with XML-driven choices of derivation and cipher. But Standard Encryption with the new 100,000-iteration count was the default, and that default produces files mapped to Hashcat mode 9500.

• Same OOXML/OLE2 container as Office 2007
• Same AES-128 cipher
• KDF iteration count: 100,000 (up from 50,000)
• Hash function in KDF: SHA-1
• Default for Office 2010 password-protected files

What doubled iterations actually change

On the same hardware, mode 9500 verifies passwords roughly half as fast as mode 9400. A GPU that tests 4 million candidates per second against mode 9400 manages about 2 million against mode 9500. That linearly extends wall-clock recovery time for the same search space.

For typical human-chosen passwords — 8 to 10 characters, mixed case, a year or a word pattern — this is a meaningful but not transformative slowdown. For 12+ character random passwords the slowdown is irrelevant, because the search space is already out of reach. Most of the practical recovery curve simply shifts a little to the right.

From an owner's point of view, mode 9500 does not change the qualitative answer — 'my password is recoverable' or 'my password is too strong'. It only changes how long recovery takes if it succeeds.

Office 2007 versus 2010 detection

The extension cannot tell you: both versions produce .docx, .xlsx and .pptx. The difference is in the EncryptionInfo stream, where kdfIterations is either 50000 (Office 2007 default, mode 9400) or 100000 (Office 2010 default, mode 9500).

Tools such as office2john or msoffice-crypt extract that metadata and produce a hash string beginning with $office$*2010* for mode 9500. Browser-based analyzers can identify the mode without sending the file content anywhere.

Why Microsoft kept SHA-1

By 2010, SHA-1 was already showing weakness against collision attacks — the SHAttered collision was demonstrated in 2017 but was anticipated years earlier. Microsoft kept SHA-1 because the property a key derivation needs is one-way preimage resistance, not collision resistance, and SHA-1 still provides preimage resistance.

By Office 2013 Microsoft moved to SHA-512 in the derivation (mode 9600), addressing the iteration count and the long-term hash strength in one change. Mode 9500 remains a transitional generation that is still common in archives.

Files commonly in this generation

Office 2010 was widely deployed in enterprises through 2014-2015. Government, financial and healthcare organisations often produced documents in this version because of long Office support cycles. Files from 2010-2015 that are .docx, .xlsx or .pptx are commonly mode 9500.

Modern Office (2019, 2021, Microsoft 365) defaults to stronger derivations (mode 9600), so freshly encrypted files in 2026 are typically not in this category. But archived files from the 2010-2015 window remain plentiful — particularly in document management systems that preserve original encryption indefinitely.

What an owner should know before paying

The questions are the same as for mode 9400: do you remember the password's general shape — length, character classes, a likely word or year? Was it a personal password (recoverable) or a manager-generated random one (typically not)? How important is the document?

We do not publish specific recovery percentages. We tell you what the free check found before any paid attempt, so the decision rests on real data.