Check an Office file for active content

Inventory an Office document's active content: VBA projects, macro sheets, OLE objects, ActiveX controls and declared external references, part by part.

officedocxxlsxpptx

Questions people ask

Which document formats does this cover?: OOXML packages: .docx, .xlsx and .pptx plus the macro-enabled variants .docm, .xlsm and .pptm. Legacy binary formats (.doc, .xls, .ppt) are not ZIP packages at all, so they are refused with a clear error instead of a pretended audit, and password-protected packages are refused too.
Does the tool run a document's macros?: Never. The audit lists the parts that could carry macros or objects and reads nothing beyond content-type and relationship declarations. A macro project part is named with its declared size; its contents are never parsed, so nothing can execute even in principle.
What is the difference between the three verdict flags?: Macro indicators cover VBA projects, macro sheets and macro-enabled declarations. Embedded objects cover OLE and ActiveX parts. External references cover hyperlinks recorded outside the package and cached external data connections. They are reported separately because they mean different things: pasted data has different weight from a declared remote link.
What does indicators versus clean actually mean?: Indicators means the package declares at least one of the audited classes. Clean means none were found. Neither is a verdict on safety: this is a parts inventory, not an execution history, and a document can be dull to the inventory and still be inappropriate to open, or the reverse.
Are external links and connections contacted?: No. External relationships are parsed out of the relationship declarations and recorded with their scheme and target, and external data links are listed by part name. Nothing here has network access, so no target is ever fetched or resolved.
Can encrypted Office files be audited?: No. A password-protected Office package is a ZIP that wraps an encrypted payload, so the declarations needed for the audit do not exist in readable form. The tool refuses such a package with a clear error rather than producing a hollow report.

About this tool

An OOXML parts inventory with its meaning stated honestly: the tool names the parts that can carry active content and reads nothing that could execute. Findings carry a class, the owning part and a one-line detail, and external targets are recorded, never fetched. The report shows the audited classes separately, because a macro project, an OLE object and a declared remote link are different kinds of news. Technical details: the audit opens the package with the standard ZIP reader, reads [Content_Types].xml and every relationship part under a per-part read cap, and inventories all other parts by name, content type and declared size. VBA project and macro-sheet parts, OLE embedding parts, ActiveX parts, external data links and external relationships are the audited classes; XML entity declarations in the read set are refused before parsing. Honest limits: the inventory cannot read legacy binary formats, cannot open encrypted packages, and cannot tell you whether a macro has ever been run in the document's life before it reached you. It is not antivirus and it does not judge intent; use dedicated analysis tooling for questions the inventory cannot answer.

File limits

Exactly 1 file per job
Each at most 20 MiB
Result at most 4 MiB

Supported formats

DOCX XLSX PPTX VND.MS-WORD.DOCUMENT.MACROENABLED.12 VND.MS-EXCEL.SHEET.MACROENABLED.12 VND.MS-POWERPOINT.PRESENTATION.MACROENABLED.12

Capabilities

officedocxxlsxpptxmacrosaudit

Privacy & processing

Your file is processed in an isolated job on Tooley's own infrastructure. No third-party services are involved and nothing is stored beyond the result window.

Uploads are removed as soon as processing finishes. Results stay available for about 10 minutes, then they are deleted automatically.