The XLSM file (.xlsm)

XLSM is Excel's format for workbooks that contain macros. A macro is a program stored in the workbook that automates work: importing a file every morning, cleaning up data, building a report, or adding buttons and forms. Excel's own macro language is VBA (Visual Basic for Applications); older workbooks may also use Excel 4.0 macros, known as XLM.

Since Excel 2007 the standard workbook, XLSX, can't hold macros. If you save a workbook that has VBA code or Excel 4.0 macro sheets, Excel asks you to choose the macro-enabled format instead. The separate extension exists so that people and security tools can see from the name that a workbook may contain code.

• Same format, plus code. Sheets, formulas, charts and formatting are stored exactly as in an XLSX.
• Macros are optional. The extension says the workbook may contain macros. Our samples don't.
• Macros don't run by themselves. Excel's settings, Windows' Mark of the Web and your choices decide that.

Three things separate an XLSM with macros from an XLSX:

1. 1The content type of xl/workbook.xml in [Content_Types].xml is application/vnd.ms-excel.sheet.macroEnabled.main+xml. This is the only one that's always there.
2. 2A VBA project, usually xl/vbaProject.bin, with content type application/vnd.ms-office.vbaProject. It's an OLE compound file, the container of the old XLS format, with a storage for the project and one compressed stream of source code per module, as [MS-OVBA] specifies. A signed project adds a signature part.
3. 3Excel 4.0 macro sheets, if any, as their own parts next to the worksheets. They can be hidden, even "very hidden", like any sheet.

The VBA project also keeps compiled code for the Excel version that saved it. If that compiled code and the source disagree, a matching version of Excel may run code that isn't in the source you can read. Analysis tools such as olevba check for this mismatch, often called VBA stomping.

If the people you send a workbook to only need the data, send an XLSX or a CSV. Use XLSM when the macros are part of what the workbook does.

Spreadsheets with macros have long been a favourite way to deliver malware, which is why Excel is careful with them. On Windows, a workbook with macros goes through these checks:

• Protected View first. A workbook downloaded from the internet or opened from an email opens read-only until you choose Enable Editing.
• Mark of the Web. Since 2022, Office on Windows blocks macros in files that Windows has marked as coming from the internet, and shows a red Security Risk banner with no option to enable them. Trusted Locations, signatures from trusted publishers and organisation policies are checked first; the DOCM page lists the order.
• The usual warning. Workbooks without the mark show a yellow Security Warning bar with Enable Content.
• Excel 4.0 macros are disabled by default in Microsoft 365, separately from VBA.

Excel for Mac, Excel on phones and tablets, and Excel for the web aren't affected by the 2022 change. Excel for the web never runs VBA: you can open and edit a workbook with macros there, and the macros stay in the file, but to run, view or delete them you need the desktop app.

• Look in the package. unzip -l book.xlsm lists the parts. Look for vbaProject.bin and a macrosheets folder.
• Run olevba from the free oletools package (pip install oletools). It extracts VBA code and detects Excel 4.0 macros in XLSM, XLSB and XLS files without running anything, and flags auto-run entry points such as Workbook_Open and Auto_Open.
• In Excel, open the workbook with macros disabled and press Alt+F11 to see the VBA modules. Right-click the sheet tabs and choose Unhide to look for hidden macro sheets.

$ olevba sample-workbook.xlsm
olevba 0.60.2 on Python 3.13.16 - http://decalage.info/python/oletools
===============================================================================
FILE: sample-workbook.xlsm
Type: OpenXML
No VBA or XLM macros found.

• Excel on Windows and Mac opens, edits and runs XLSM workbooks. Show the Developer tab (File, Options, Customize Ribbon) to record and edit macros.
• Excel for the web opens and edits the data and keeps the macros, but doesn't run them.
• LibreOffice Calc opens XLSM files and can run some Excel VBA, under its own macro security settings.
• Google Sheets imports the data and formulas; it doesn't run VBA.
• Convert to XLSX: File, Save As, Excel Workbook (.xlsx). Excel warns that the VB project can't be saved in a macro-free workbook and leaves it out.
• To CSV or PDF: Save As, or soffice --headless --convert-to pdf book.xlsm on a server. Macros don't run during the conversion.

• "Microsoft has blocked macros from running because the source of this file is untrusted." The workbook came from the internet. If you trust it, close it, right-click the file, choose Properties, tick Unblock and open it again.
• "The file format or file extension is not valid." The extension doesn't match the content inside: an XLSM renamed to .xlsx, a file saved by a tool that wrote the wrong content type, or a download that stopped part-way.
• The macros are gone. The workbook was saved as XLSX, or edited by a program that doesn't keep VBA projects. Go back to the last .xlsm copy.
• Buttons do nothing. Macros are disabled or blocked, or you're in Excel for the web or another spreadsheet app that doesn't run VBA.
• Email or upload rejected. Many organisations block macro-enabled attachments. Share a link, or send an XLSX if the macros aren't needed.