ExcelAnalyzerClient-side file inspector

Check XLSM macros without opening them

Verify that no file leaves your browser

Local check

What this page can tell you

An .xlsm or .xlsb file can contain xl/vbaProject.bin, a compound file inside the ZIP package. This checker reports whether that part exists, whether the content types mark the workbook as macro-enabled, which module names it can read from the PROJECT stream, and whether the project bytes contain auto-start names such as Auto_Open or Workbook_Open. That is an inventory. It is not antivirus, it is not a sandbox, and it is not a promise that the file is safe to enable.

What auto-start means

Excel can run code when a workbook opens, before you click a button. Workbook_Open in ThisWorkbook and Auto_Open in a module are the usual hooks. Worksheet_Change and Workbook_SheetActivate are not the same as “runs at open”, but they run in response to ordinary actions, so they are listed when the names are present in the project. Finding the name means the text is in the VBA project. It does not mean the procedure is malicious, and it does not mean a similarly named harmless stub is absent. Absence of these names does not prove the project is harmless. Code can be called from a button, a shape, or a method this list does not name.

The repair steps live in the guide on what this inventory does not prove.

Module names

The PROJECT stream is plain text inside the compound file and includes a workspace section with module names. This page shows those names when the stream can be read. It does not decompile every procedure, and it does not pretty-print the source. If the compound file is damaged, you still get the fact that vbaProject.bin is present, plus a note that the directory could not be read. Presence alone is enough reason to leave macros disabled until you know the sender.

How to act on the inventory

If you were not expecting a macro, do not enable content. Ask the sender for a macro-free .xlsx if the workbook is only data. If you were expecting a macro, the module list should match what the author told you. An extra module, or an auto-start procedure nobody mentioned, is a reason to open the file in Excel with macros disabled and read the project on a machine you can afford to rebuild. This website cannot do that reading for you beyond the names above.

The boundary, in one place

Inspection only. A clean inventory is not a security guarantee. A worrying inventory is not a conviction. Company mail filters, Excel’s Trust Center, and a current anti-malware product are the controls that belong in front of an untrusted workbook. This page exists so you can see the project without double-clicking the file open and enabling it by habit.

Also check

Questions people ask before trusting the result

Is an .xlsx ever macro-enabled?

It should not be. If this checker finds vbaProject.bin inside a file named .xlsx, treat it as a macro file regardless of the extension.

Do you scan for viruses?

No. There is no signature database and no behavioral scan. The terms page says the same thing. Do not skip your normal security tools.

Why are some modules missing?

Only names in the PROJECT workspace are listed. Code that is not a standard module, or a project the parser cannot open, will not appear as a friendly name.

Can I read the macro source here?

No. Source in the VBA project is compressed, and showing it would turn this page into a macro viewer. The inventory stops at names and auto-start markers.

Does a very hidden sheet mean there is a macro?

No. Visibility and VBA are separate. Check both. A very hidden sheet is often created by VBA, and it can also be created once and left behind after the code is gone.

Last updated 5 November 2026. Initial release of this audit.