Permissions, and who can see what you hid

Established onExcel 365 and 2016 and later: sheet protection, file encryptionGoogle Sheets, web: server-enforced, view means every sheetBoth: hiding is a display convenience

Four features are described as protection and they do different jobs. Confusing them is how confidential data ends up in a file somebody forwarded.

Hiding

Prevents nothing. A hidden sheet, row or column is present in the file and one menu item away from being visible. It is a display convenience and was never anything else.

Sheet protection

Prevents editing through the interface, optionally behind a password. It is not encryption: the workbook is an archive of structured text, the protection is a setting inside it, and removing that setting removes the protection without knowing the password.

The vendor's own documentation says that worksheet protection is not a security feature and is intended to prevent accidental change. It is a useful thing for exactly that purpose and is regularly relied on for a different one.

Server-enforced access

Where the file lives on a service rather than as a file, permissions are enforced by the service, so a person without edit rights genuinely cannot edit.

With one large caveat: viewing rights are rights to the whole document. A person who can view a spreadsheet can view every sheet in it, including the hidden ones, by making a copy, by exporting it, or through the programming interface. Hiding remains a display convenience on this side too.

File encryption

Encrypting a workbook with a password encrypts its contents with a modern cipher, and without the password the bytes are not readable. This is the only one of the four that is about who can read the data.

It is also the one used least, because it makes the file inconvenient, which is the ordinary trade in this area and worth stating plainly rather than pretending otherwise.

Sharing links

A link that grants access to anybody holding it is a credential. It is forwarded in messages, pasted into tickets and included in meeting invitations, and every recipient has the access it carries.

Nothing about the link records who was intended to have it, so the question of who can open a document shared this way has no answer.

What to do when data must not travel

Do not send the file. Send an extract containing only what the recipient needs, produced by copying values into a new workbook rather than by deleting things from a copy of the original.

Deleting is the failure mode: it leaves hidden material, cached copies and metadata behind, which the next entry is about. Starting from an empty file and adding what should be there is the only reliable direction.

The password on a sheet, in practice

Use it, and understand what it buys. It stops a colleague typing over a formula by accident, which is a real and common problem worth solving. It does not stop anybody who wants the data, and treating it as though it does is the actual risk.

Checking what a file grants before sending

Three questions, none of which takes long. What is on the sheets that are not visible. What the file's properties record about who made it and where its links point. And whether anything in it caches data from somewhere else.

The next entry is the list of places to look.

What we cannot verify

The vendor documents that worksheet protection is not a security mechanism, and that file encryption uses a modern cipher; both statements are published. That workbook protection settings can be removed from the archive is widely demonstrated and we have not reproduced it here. Google Sheets access enforcement and the scope of view permissions are documented by the vendor.

The password that protects the file from you

File encryption has one property worth stating before anybody adopts it: there is no recovery. A forgotten password on an encrypted workbook means the contents are gone, and the vendor cannot help.

Which is the correct behaviour and is a genuine operational risk. Where encryption is used for anything the organisation depends on, the password belongs in whatever system holds the organisation's other credentials, not in somebody's memory.

The question that settles it

Ask what you are protecting against: an accident, a curious colleague, or somebody who wants the data. The first is solved by sheet protection, the second by not sending the file, and the third by encryption or by the data not being in a spreadsheet at all.

The workbook that opens read-only

Excel offers a recommendation that a file be opened read-only, which displays a prompt the reader can decline. It is a request rather than a restriction and it belongs on this list because it is regularly mistaken for one.