Office Macro Inspector
Extracts VBA projects from .docm/.xlsm/.pptm and legacy .doc/.xls, shows each module’s source with auto-run procedures and risky calls highlighted, and lists external links, DDE fields and Excel 4.0 macro sheets.
A macro-enabled document does not tell you what it will do when you click “enable content”; that decision has to be made before the code runs. This extracts the VBA project without opening the document in Office and shows you the source, along with the other places a document can carry executable behaviour.
The file is opened only inside your browser. No macro is executed and nothing is sent anywhere. This is structural inspection, not antivirus — it tells you what shape the document has, not whether it is known malware.
Drop an Office file
Macro documents such as .docm .xlsm .pptm .dotm .xlam, and the legacy .doc .xls. A .docx or .xlsx is accepted too, and confirms it holds no macros.
How to use it
Drop the document in
`.docm`, `.xlsm`, `.pptm` and the legacy `.doc`/`.xls` OLE formats are all read. The document is never handed to Office, so nothing executes.
Look for the auto-run entry points
`AutoOpen`, `Document_Open`, `Workbook_Open` and their relatives run without a further click once macros are enabled. They are highlighted because they are where a hostile document starts.
Read the flagged calls
`Shell`, `CreateObject`, `WScript`, `URLDownloadToFile`, obfuscated string concatenation — the tool highlights them, and the source is there in full so you can read what they actually do.
Check the non-VBA channels too
External links, DDE fields and Excel 4.0 macro sheets all execute without a VBA project existing at all. They are listed separately for that reason.
Common questions
Will it tell me whether the document is malicious?
No. It lists what the document contains; the judgement is yours. There is no verdict, no score and no signature database, because a tool that said “safe” would be wrong in exactly the cases that matter.
It found no macros. Is the file clean?
It means no VBA project, DDE field or Excel 4.0 sheet was found. A document can still carry an embedded object, a remote template reference or an exploit in the parser itself, none of which this looks for.
Is it safe to drop a suspicious file here?
The file is parsed as bytes in your browser and nothing in it is executed or uploaded. It is considerably safer than opening it in Office, which is the point of the tool.
The VBA source looks like nonsense.
Obfuscation is normal for hostile macros — split strings, `Chr()` arithmetic, dead code. The tool shows the source as stored rather than trying to deobfuscate it, so what you see is what the file contains.
Feed it from
Archive Inspector
Opens a zip without extracting it and flags path traversal entries, executables, macros and zip bombs.
File Encrypt & Decrypt
Encrypts any file with AES-256-GCM from a passphrase, and decrypts files it produced.
Metadata Scrubber
Removes author, device, GPS and revision metadata from documents, images, audio and video in one pass.
PGP Message Tool
Encrypts and decrypts OpenPGP messages with a passphrase, entirely in the browser — RFC 4880 symmetric mode (AES-256, SHA-256 S2K, MDC), interoperable with gpg -c. Public-key encryption and signatures are not built.
Next
These accept what this tool produces, so the result can go straight in.
Archive Inspector
Opens a zip without extracting it and flags path traversal entries, executables, macros and zip bombs.
File Checksum
Hashes files of any size in a streaming pass and compares the result against a pasted expected value.
Metadata Scrubber
Removes author, device, GPS and revision metadata from documents, images, audio and video in one pass.
Suspicious URL Check
Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
Breach Check
Checks whether a password appears in Have I Been Pwned’s breach data, sending only the first five characters of its SHA-1 hash from the browser (k-anonymity).