Office 2013-2026 AES-128 SHA-512 — Hashcat Mode 9600

Agile Encryption explained

Office 2013 made Agile Encryption the default; Office 2010 had offered it as an option. Agile uses an XML-described KeyEncryptor inside the EncryptionInfo stream. That XML specifies the hash function, hash size, key size, iteration count, salt, and cipher chaining mode.

The Office 2013 default values are hashAlgorithm=SHA512, hashSize=64, keyBits=128, spinCount=100000, blockSize=16, cipherAlgorithm=AES, cipherChaining=ChainingModeCBC. That is what Hashcat mode 9600 targets.

Office 2016, 2019, 2021 and Microsoft 365 all use the same defaults — so any password-protected .docx, .xlsx or .pptx created from 2013 onwards is most likely mode 9600 unless the user deliberately chose other settings.

• Encryption scheme: Agile
• Cipher: AES-128 in CBC mode (not AES-256 by default)
• Hash function in KDF: SHA-512
• KDF iteration count: 100,000
• Default in Office 2013 through Microsoft 365

Why SHA-512 makes mode 9600 harder than mode 9500

SHA-512 is more expensive than SHA-1 on most hardware: it processes 1024-bit blocks instead of 512-bit, uses 64-bit operations, and has 80 rounds with heavier operations. On commodity GPUs, SHA-512 throughput is roughly 30-50% of SHA-1 throughput per cycle.

Combined with the same 100,000 iterations as mode 9500, mode 9600 verifies passwords about 2-3 times slower than mode 9500 on identical hardware. Recovery wall-clock time for the same search space scales linearly with that slowdown.

For a typical 8-10 character human-chosen password, the difference might mean hours instead of an hour. For a strong random 14-character password it is irrelevant — the search space is out of reach regardless of derivation cost.

Why Microsoft kept AES-128 instead of moving to AES-256

Office 2013 supports AES-256 through Agile Encryption, but the default stayed AES-128. The reasoning: AES-128 is already secure beyond any feasible brute force, and it is faster in hardware (10 rounds against 14), which keeps legitimate file opening responsive.

Users can configure AES-256 via Group Policy or by saving with custom encryption settings. In practice almost nobody does — the default is what virtually everyone uses, so mode 9600 with AES-128 covers the vast majority of modern password-protected Office files.

Identifying mode 9600 files

Same OOXML container as 9400 and 9500. The EncryptionInfo XML inside the OLE2 wrapper specifies the Agile parameters. Tools such as office2john print a hash string starting with $office$*2013* for mode 9600.

Office 2016, 2019, 2021 and 365 produce an identical hash format — Hashcat treats them all as mode 9600. There is no per-version distinction because the encryption parameters are identical.

Files in this category in 2026

Mode 9600 is the dominant generation for Office documents from 2014 to 2026. Almost any password-protected .docx, .xlsx or .pptx created in the last decade is in this mode. Common sources: enterprise document management exports, freshly created HR, legal and financial documents, and archive exports from corporate file servers.

Microsoft 365 defaults to mode 9600 for password-protected exports. Anyone who adds a password through File → Info → Protect Document → Encrypt with Password produces a mode 9600 file.

Recovery realism

For modern Office files the recovery question is even more password-dependent than for older modes, because each attempt costs more. Short or predictable passwords — under 8 characters, dictionary words, year-plus-word patterns — remain recoverable. Strong random passwords from a manager are not realistically recoverable on any reasonable budget.

The honest position: many corporate Office files use predictable passwords (department name plus year, project codename, a company-standard pattern), and those are recoverable. Personal manager-generated passwords typically are not. We show what the free check found before any paid attempt.