Can an Excel file give you a virus?
Short answer: yes — but not the way most people assume. The data in a spreadsheet can't hurt you. If you have a specific file you're worried about right now, drop it in below — no reading required.
The short answer
Yes — but only through macros, and only if you enable them. A spreadsheet that contains only data and formulas cannot infect your computer by being opened; the data in a file doesn't run. The risk comes entirely from VBA (Visual Basic for Applications) macros — small programs embedded in the file — and even then, modern Excel blocks them until you take a deliberate action to allow them. So if you're worried about a specific file, the useful move is to find out whether it contains macros at all before you do anything else.
Check the file before you decide
Drop your file in the box at the top of this page. It reads the file's internal structure — the same way you can list files inside a ZIP without running them — and tells you whether macros are present and what kind. Nothing in the file executes during the check. If no macros are found, the file is a standard spreadsheet and there's nothing there that can run.
Spreadsheet data is not the threat
Numbers, text, even complex formulas — none of that can do anything to your computer just by being opened. A spreadsheet of prices or a roster of employee names is completely inert. The file is data; it doesn't run.
This is different from executable files (.exe, .bat, .ps1) where opening the file IS running a program. A standard .xlsx spreadsheet isn't a program.
Where the actual risk comes from: macros
Excel has a built-in programming language called VBA (Visual Basic for Applications) that lets people write code — called macros — directly into a spreadsheet. These macros run inside Excel and can automate almost anything: calculating, formatting, generating reports. They can also interact with the rest of your computer: create files, download data from the internet, run programs.
That last capability is what makes macro-enabled spreadsheets a delivery mechanism for malware. A malicious macro, once allowed to run, can silently download and install software, steal files, or make changes to your system. For about a decade, macro-based attacks were one of the most common ways attackers delivered ransomware and credential stealers through email.
What stops a macro from running automatically
Excel doesn't just let macros run on their own from an unknown file. There are two layers of protection:
- Protected View — files that came from the internet or email open in a sandboxed mode where macros can't execute and you can't edit anything. You'll see a yellow bar saying "Be careful — files from the Internet can contain viruses."
- Macro block (newer Excel) — since 2022, files from the internet show a red bar: "Microsoft has blocked macros from running because the source of this file is untrusted." There is no Enable Content button. You have to take a deliberate extra step to unblock the file.
Both protections exist specifically because macros are the vector. Getting around them takes a conscious action from you — which is why phishing emails go out of their way to create urgency ("you must enable macros to see your invoice").
Can you get infected just by opening the file?
In the normal case, no. Protected View keeps you safe as long as you don't click past the warnings. There have been extremely rare exploits that compromised older, unpatched versions of Excel without user interaction, but those are patched quickly and require running an outdated version of the software. For a fully updated, modern version of Excel, you have to actively approve macro execution for anything to run.
The attack vector that actually works is social engineering: the attacker convinces you the file needs macros enabled to display correctly, or that the warning is a bug, or that this is a trusted document from your bank.