I am using Java and COM4j to communicate with Word. The approach I used here is brute force. I have a password protected .doc, and I forgot its password.

Complexity is (26)(maxPassLength). [a-z characters only]

Before I run this code and wait for 7-10 days here are my concerns.

My main concern is checking whether a generated string matches the password. Is there any alternative to this? Would you recommend threading to reduce the search space?

import com4j.Variant;
import java.util.HashMap;
import javax.swing.JOptionPane;
import word.Documents;
import word.WdOpenFormat;
import word._Application;
import word._Document;

public class DocPasswordFinder {

    public final static String filePath2 = "\\file\\abc.doc";
    private static HashMap<Integer, Character> mapC;
    private static final int passMaxLength;
    public static  _Application app;
    public static Documents doc;
    public static char[] arr;

    static {
    arr = new char[passMaxLength];
    app = word.ClassFactory.createApplication();
    doc = app.documents();
    mapC=new HashMap<>();
        for (int i = 0; i < 26; ++i) {
            mapC.put(i, (char) ('a' + i));

    public static void genPass(int start, int indx) {
        if (indx == passMaxLength) {
            String PASSWORD = String.valueOf(arr);
            try {                
        doc.open2000(filePath, false, true, false, PASSWORD, "", false,   
    PASSWORD, "", WdOpenFormat.wdOpenFormatAuto, false, false);
                JOptionPane.showMessageDialog(null, "FOUND: " + PASSWORD);
            } catch (com4j.ComException ex) {
        } else {
            if (indx < arr.length) {
                for (int i = start; i < 26; ++i) {
                    arr[indx] = mapC.get(i);
                    genPass(start, indx + 1);

    public static void main(String[] args) {
        genPass(0, 0);

Bottleneck appears to be the doc.open2000() part.


Complexity is (26)(maxPassLength).

You know that the password is only lower-case alpha characters?

Would you recommend threading to reduce the search space?

It's possible that threads wouldn't help. The doc.open2000 will be more expensive than anything else, and your communication with Word may (I don't know) be effectively single-threaded (i.e. talking to a single Word process/task).

You might get better performance from a Word emulator which is designed to run on a server, e.g. from http://www.aspose.com/

  • \$\begingroup\$ Yes i do know that. Hence 26(lower case alpha characters) in maxPassLength positions (26^maxPassLength). It is supposed to work for my doc file. \$\endgroup\$ – boxed__l Jan 31 '14 at 15:46
  • \$\begingroup\$ That sounds like 10^14 possible combinations. To do all those in 10 days you would need to do 2 x 10^7 per second. \$\endgroup\$ – ChrisW Jan 31 '14 at 15:51
  • 2
    \$\begingroup\$ @boxed__l I can't answer that question and it's off-topic on this site. You might find an answer here. \$\endgroup\$ – ChrisW Jan 31 '14 at 16:14
  • \$\begingroup\$ @boxed__l Its behaviour is allegedly described here: password-crackers.com/crack/guaword.html I think that implies something like: a) Know Word document format well enough to extract encrypted password from the document; b) Know the (one-way) encryption algorithm; c) Use the PC's GPU (video card) to iterate-and-encrypt 2^40 possible password guesses to find a password which (when encrypted) will match the document's encrypted password. \$\endgroup\$ – ChrisW Feb 1 '14 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.