The DOCM file (.docm)

DOCM is the format Word uses for documents that contain macros: small programs written in VBA (Visual Basic for Applications) that automate the document, for example filling in fields, formatting a report or adding a custom button. When you add a macro to a document and save it, Word asks you to save it as a Word Macro-Enabled Document, with the extension .docm.

Microsoft introduced it with Office 2007, alongside DOCX. The older DOC format used one extension whether or not there were macros inside. With the XML formats, Microsoft split them: a .docx can't hold macros, and a .docm can. The point was to make files with code in them easy to recognise.

• It's a DOCX with one difference. Same ZIP package, same XML. The main part has a different content type, and the package may contain a VBA project.
• "Macro-enabled" doesn't mean "has macros". It means the file is allowed to. Our samples are DOCM files with no VBA project at all.
• Opening it doesn't run the macros by itself. Whether they run is decided by Office's macro settings, Windows' Mark of the Web and the choices you make, explained below.

The macros sit in one part, usually named word/vbaProject.bin. Unlike the rest of the package, it isn't XML. It's an OLE compound file, the "file system inside a file" that Office used before 2007, laid out as [MS-OVBA] specifies:

Word links the document to the project with a relationship of type …/2006/relationships/vbaProject, declares the content type application/vnd.ms-office.vbaProject for it, and adds a small XML part, word/vbaData.xml, with Word-specific data about the macros. A signed project also carries a signature part.

Converting a DOCM to a DOCX in code is the reverse: Microsoft's Open XML SDK guide removes the vbaProject part, changes the document type to a normal document, which rewrites the main content type, and only then renames the file. Deleting the part alone isn't enough.

Word checks that the extension of an Office Open XML file agrees with the content type of its main part. Cisco Talos described this check in 2016: a DOCX renamed to .docm makes Word show an error instead of opening it. The check works both ways, so a DOCM renamed to .docx is refused too, with its macros still inside. Renaming changes nothing in the package.

To remove macros for real, open the document in Word and save it as a Word Document (.docx). Word warns that the VBA project can't be saved in a macro-free document and leaves it out if you continue.

Macros have been one of the most common ways to spread malware through email for decades, so Office doesn't run them just because a document contains them. Since 2022, Office on Windows blocks macros in files that came from the internet by default. It recognises those files by the Mark of the Web: a note Windows attaches to a file saved from a browser or an email attachment, recording that it came from the Internet zone.

When you open a DOCM with macros, Office on Windows checks, in this order:

1. 1Trusted Location. A file in a folder set as a Trusted Location opens with macros enabled.
2. 2Digital signature. Macros signed by a publisher whose certificate is in your Trusted Publishers list are enabled.
3. 3Policy. Group Policy or cloud policy set by an organisation can block or allow macros.
4. 4Mark of the Web. If the file came from the internet and none of the above applies, the macros are blocked and a red Security Risk banner appears. It has no button to enable them.
5. 5Otherwise (a file you made, or from your own network), the usual yellow Security Warning bar appears, with an Enable Content button.

Before any of that, a document from the internet usually opens in Protected View: read-only, with most editing turned off, until you choose Enable Editing. That is a separate safeguard for every Office file, with or without macros.

• To unblock a file you trust: right-click it, choose Properties and tick Unblock on the General tab, or run Unblock-File in PowerShell. Both remove the Mark of the Web.
• Not affected by the 2022 change: Office for Mac, Office on iPhone, iPad and Android, and Office on the web. The web versions don't run VBA anyway.
• Documents that ask you to enable content are the classic trick: the text claims the document is "protected" or "created in a newer version" and tells you to click Enable Content. Don't.

You don't need to open a document in Word to see whether it contains macros, and you shouldn't open a suspicious one there anyway. Two ways that never run any code:

• List the parts. unzip -l file.docm, or rename a copy to .zip and open it. A vbaProject.bin anywhere in the package means there is a VBA project.
• Use olevba. It's part of oletools, a free Python package for analysing Office files (pip install oletools). It extracts the VBA source code without running it and flags auto-run macros, such as AutoOpen and Document_Open, and suspicious keywords. Its companion mraptor gives a quick verdict on whether macros look malicious.

$ olevba sample-document.docm
olevba 0.60.2 on Python 3.13.16 - http://decalage.info/python/oletools
===============================================================================
FILE: sample-document.docm
Type: OpenXML
No VBA or XLM macros found.

If a document does have macros you want to read, open it in Word with macros disabled and press Alt+F11 for the VBA editor. Reading the code there doesn't run it.

If a document only needs to be read, send it as DOCX or PDF: many organisations' mail filters block macro-enabled attachments, and the reader can't run the macros from an email anyway. Keep DOCM for documents whose macros the reader needs, and tell them what the macros do. Macros meant for every document belong in a DOTM template instead.

• Microsoft Word on Windows and Mac opens and saves DOCM, with full VBA support.
• Word for the web opens the document but doesn't run VBA macros.
• LibreOffice Writer opens DOCM files and can keep the VBA project, but it has its own macro security settings and runs only part of the VBA language.
• Convert to DOCX: in Word, File, Save As, Word Document (.docx). The VBA project is left out.
• Convert to PDF: File, Save As, PDF in Word, or soffice --headless --convert-to pdf file.docm on a server. Neither runs the macros.
• In code: python-docx's Document() refuses a DOCM with "is not a Word file", because it accepts only the DOCX content type. Lower-level libraries such as the Open XML SDK open it and expose the VBA part.

• "Microsoft has blocked macros from running because the source of this file is untrusted." The file has the Mark of the Web. If you trust it and need the macros, unblock it in its Properties, or ask your IT team for a Trusted Location or a signed version.
• Word refuses a file after you renamed it. The extension no longer matches the content type. Rename it back to .docm, then save it as .docx from Word if you want it without macros.
• My macros disappeared. The document was saved as .docx, which can't hold them. Use the .docm copy, or a backup.
• The attachment was blocked or stripped. Many mail systems block macro-enabled Office files. Share it as a link or as a zipped file, if your organisation allows it, or send a DOCX or PDF.
• A converter or library rejects it. Some tools accept only the DOCX content type. Use one that supports macro-enabled documents, or convert to DOCX first in Word.