How to safely strip all vba macros from an excel workbook
- Step 1Open the VBA Macro Stripper — On a Developer-tier (or Enterprise) account, open the stripper at /excel-tools/excel-vba-macro-stripper. Lower tiers see the tool but are blocked with
VBA Macro Stripper requires Developer tier.when they run it. - Step 2Drop the macro-enabled file — Drag in one
.xlsm(or.xlam/.xltm) workbook, or click to browse. The picker filter shows.xlsx, .xls, .ods; choose the macro-enabled file from disk. Only one file is processed per run — there is no batch queue. - Step 3Run the strip — Click run. JSZip loads the workbook as a ZIP entirely in your browser tab. No bytes leave your machine and the VBA code is never executed — it is treated as opaque binary and deleted, not interpreted.
- Step 4Confirm what was removed — The result panel shows
N macro file(s) removed.The findings object lists every removed path (vbaProject.bin,vbaData.xml, anything underxl/macrosheets/). If it reports 0, the file had no macro parts to begin with. - Step 5Download the clean .xlsx — The output is a binary
.xlsxnamed<original>-no-macros.xlsx. Download it; the macro-enabled original on disk is never modified. - Step 6Open and verify in Excel — Open the result in Excel to confirm no Enable Content banner appears, then file it where you need it. The workbook now literally contains no executable code.
What the stripper removes vs preserves
The tool opens the workbook as an OOXML ZIP with JSZip and deletes only macro-bearing parts by path match. Every other part is repacked byte-for-byte. Path matching is case-insensitive substring matching.
| Container part | Action | Why |
|---|---|---|
xl/vbaProject.bin | Removed | The compiled VBA project — every Sub, Function, UserForm, and class module lives here. Deleting it removes all VBA code. |
xl/vbaProjectSignature.bin / *vbaData.xml | Removed | Digital-signature stub and the VBA data manifest. Any path containing vbadata.xml is dropped so no orphaned macro metadata remains. |
xl/macrosheets/… | Removed | Excel 4.0 / XLM macro sheets. The stripper deletes this folder, so legacy XLM auto-open macros are removed alongside VBA — not just VBA. |
xl/_rels/workbook.xml.rels | Edited | The <Relationship … vbaProject …> entry is stripped so the workbook does not reference the now-deleted binary. |
xl/printerSettings/printerSettings*.bin | Preserved | Binary print settings are explicitly kept — only macro binaries are targeted, not every .bin. |
Worksheet XML, sharedStrings.xml, styles, charts, pivots | Preserved | All data, formulas, formatting, charts, and pivot tables are repacked unchanged. The output is a faithful copy minus the code. |
docProps/core.xml / docProps/app.xml | Preserved | Author, company, and revision metadata are untouched. Use the Core/App metadata wipers if you also need those gone. |
Input formats — what actually unzips
The tool registers xlsx as its accepted format, so the file picker offers .xlsx, .xls, .ods. Under the hood it requires a valid OOXML ZIP. Pick the matching row before you upload — a file that is not a ZIP cannot be processed.
| File you have | ZIP-based? | Result |
|---|---|---|
.xlsm (macro-enabled workbook) | Yes | Primary use case. vbaProject.bin and xl/macrosheets/ are removed; you get a clean .xlsx. |
.xlsx that secretly carries a VBA project | Yes | Rare but real — a workbook renamed to .xlsx can still contain vbaProject.bin. The stripper finds and removes it. |
.xlam (macro-enabled add-in) | Yes | Same OOXML+VBA layout, so the macro binary is removed. Output is repacked as .xlsx. |
.xltm (macro-enabled template) | Yes | Unzips and strips like .xlsm. The template's cell content survives; its VBA does not. |
.xls (legacy BIFF8 binary) | No | Not a ZIP — JSZip.loadAsync throws. Re-save as .xlsm/.xlsx in Excel first, then strip. |
.ods (OpenDocument) | Yes (ZIP) | Unzips, but ODF stores macros under Basic/, not vbaProject.bin — nothing matches, so no macros are removed. |
Tier access and file-size limits
The VBA Macro Stripper is gated to Developer tier and above (it throws VBA Macro Stripper requires Developer tier. on lower tiers). One file per run — there is no batch queue. Row limits do not apply: this is a binary ZIP operation, so reported input/output rows are always 0.
| Tier | Can run this tool? | Max file size | Files per run |
|---|---|---|---|
| Free | No — blocked | 5 MB (family cap) | 1 |
| Pro | No — blocked | 50 MB (family cap) | 1 |
| Pro-media | No — blocked | 200 MB (family cap) | 1 |
| Developer | Yes | 500 MB | 1 |
| Enterprise | Yes | 2 GB (streaming) | 1 |
Cookbook
Concrete strip jobs against the kinds of macro-enabled workbooks that show up in real macro-security work. Each shows the upload, what the tool reports, and the resulting file.
Standard .xlsm with a VBA auto-open macro
A budget template with a Workbook_Open macro that pops a userform. Stripping removes the single vbaProject.bin and downgrades the extension to .xlsx.
Input: Q3-Budget-Template.xlsm (contains xl/vbaProject.bin) Result panel: 1 macro file(s) removed. findings.macroFiles = ["xl/vbaProject.bin"] Output: Q3-Budget-Template-no-macros.xlsx -> opens in Excel with no Enable Content banner
Workbook carrying both VBA and an XLM macro sheet
Older infected templates sometimes pair a VBA project with an Excel 4.0 macro sheet. Both are removed in one pass.
Input: Invoice.xlsm
xl/vbaProject.bin
xl/macrosheets/sheet1.xml <- Excel 4.0 (XLM)
Result panel:
2 macro file(s) removed.
findings.macroFiles = [
"xl/vbaProject.bin",
"xl/macrosheets/sheet1.xml"
]
Output: Invoice-no-macros.xlsx.xlsx that is secretly macro-enabled
Someone renamed an .xlsm to .xlsx hoping to slip it past a filter. The binary is still inside; the stripper finds it by path, not extension.
Input: report.xlsx (renamed from report.xlsm) $ unzip -l report.xlsx | grep vba xl/vbaProject.bin <- still there, still runnable Result panel: 1 macro file(s) removed. Output: report-no-macros.xlsx (genuinely clean)
Confirming a file is already clean
Run a plain .xlsx through to prove it has no macro parts. A zero count is a pass, not an error.
Input: clean-data.xlsx Result panel: 0 macro file(s) removed. Output: clean-data-no-macros.xlsx (byte-equivalent content, just repacked)
Strip first, then wipe the editing-app fingerprint
Macros gone, but app.xml still names the build tool. Chain the App Metadata Wiper for a fully sanitised file.
Step 1 VBA Macro Stripper: build.xlsm -> build-no-macros.xlsx Step 2 App Metadata Wiper (/excel-tools/excel-app-metadata-wiper): build-no-macros.xlsx -> app.xml Application/Company cleared Result: no macros AND no editing-app fingerprint
Edge cases and what actually happens
Legacy `.xls` (BIFF8 binary) uploaded
Fails — not a ZIPA true legacy .xls is a compound binary file, not a ZIP, so JSZip.loadAsync throws and no output is produced. Open it in Excel and Save As .xlsm (or .xlsx) first to convert it to the OOXML ZIP format, then run the stripper.
Password-encrypted workbook uploaded
Fails — encryptedExcel encryption wraps the OOXML package in an OLE/CFB container, so JSZip cannot read it as a ZIP and loading fails. Decrypt in Excel (File, Info, Protect Workbook, remove the password) first, then strip the macros from the decrypted copy.
`.xlsx` that secretly contains a VBA project
RemovedA workbook renamed from .xlsm to .xlsx can still carry vbaProject.bin inside the ZIP — and Excel will still run it. The stripper matches by ZIP path, not extension, so it finds and removes the binary regardless of the file's name.
`xl/macrosheets/` present (Excel 4.0 / XLM macros)
RemovedXLM macros are a classic malware vector that does not live in vbaProject.bin. Because the stripper deletes anything under xl/macrosheets/, these are removed too — the findings list will name each macrosheet part it dropped.
`printerSettings.bin` in the package
PreservedThe filter targets only macro binaries (vbaproject.bin, vbadata.xml, xl/macrosheets/). Other .bin parts such as printerSettings1.bin are left in place, so your page setup survives the strip.
File had no macros at all
ExpectedNothing matches the macro filter, so the result reports 0 macro file(s) removed and you still receive a repacked .xlsx. It is a clean no-op, not a failure — handy as a confidence check that a file is already macro-free.
`docProps/app.xml` still lists the original editing app
By designThe stripper only removes macro parts; document metadata is preserved. If the editing-app fingerprint or author also needs to go, chain the App Metadata Wiper or the Core Metadata Wiper after stripping.
Workbook contains hidden or very-hidden sheets
PreservedHidden sheets are worksheet XML, not macro code, so they are kept exactly as-is. Removing macros does not unhide or delete them — use the Hidden Sheet Destroyer for that.
Run attempted on Free, Pro, or Pro-media tier
403 tier blockedThe processor checks the tier first and throws VBA Macro Stripper requires Developer tier. before any unzip happens. Upgrade to Developer or Enterprise to run it.
`.ods` (OpenDocument) uploaded
No macros matchedAn .ods is a ZIP and will unzip, but ODF stores Basic macros under Basic/, not vbaProject.bin. Nothing matches the filter, so 0 is reported and no macro code is actually removed.
Frequently asked questions
Does the macro code ever run while it is being removed?
No. The tool opens the workbook with JSZip and treats vbaProject.bin as opaque binary to delete. It is never loaded into a VBA host or interpreted, so an auto-open or Workbook_Open payload cannot fire during processing.
Is the file uploaded anywhere?
No. Processing happens entirely in your browser tab. The bytes are read locally, unzipped in memory, repacked, and offered as a download. Nothing is sent to a server.
What exactly gets deleted?
Any ZIP entry whose path contains vbaproject.bin, vbadata.xml, or xl/macrosheets/ (case-insensitive), plus the vbaProject relationship in xl/_rels/workbook.xml.rels. Everything else is preserved.
Does it remove Excel 4.0 (XLM) macros too?
Yes. XLM macro sheets live under xl/macrosheets/, not in vbaProject.bin, and the stripper deletes that folder. Many tools that only target VBA leave XLM behind — this one removes both.
Will my formulas, charts, and formatting survive?
Yes. Cell values, formulas, data validation, named ranges, conditional formatting, charts, and pivot tables are all repacked unchanged. Only the macro parts are dropped.
Why does the output extension change to .xlsx?
The .xlsm extension is Excel's promise that the file may contain macros. Once the macro parts are gone, the honest extension is .xlsx. The tool names the result <original>-no-macros.xlsx.
Does it modify my original file?
No. The original on disk is never touched. The tool produces a separate downloaded copy, so you keep the macro-enabled source until you choose to delete it.
What tier do I need?
Developer tier or higher. Free, Pro, and Pro-media accounts can see the tool but are blocked at run time with VBA Macro Stripper requires Developer tier.
What is the file-size limit?
Developer tier allows up to 500 MB per file; Enterprise allows up to 2 GB. There is no row limit because this is a binary ZIP operation, not a row-by-row transform.
Can I strip several workbooks at once?
Not in one click — the tool processes one file per run (the upload control is single-file). Run them sequentially, or script your own JSZip loop if you need true batch.
What happens if the file has no macros?
It still works: nothing matches, so the result reports 0 macro file(s) removed and you get a repacked .xlsx. It is a safe no-op rather than an error.
It also handles a few related cleanup jobs — where do those live?
Macros are only one kind of risky payload. For author/company fields use the Core Metadata Wiper; for the editing-app fingerprint use the App Metadata Wiper; for buried sheets use the Hidden Sheet Destroyer; and to audit risky links use the External Link Auditor.
Privacy first
Every JAD Excel tool runs entirely in your browser using SheetJS and ExcelJS. Your spreadsheets, formulas, and data never leave your device — verified by zero outbound network requests during processing.