VBA Macro Inspector

About this tool

VBA Macro Inspector opens the macro project stored inside a Word, Excel or PowerPoint file and shows you the VBA source code — standard modules, class and document modules, and UserForms with an approximate preview of their design. The file is parsed as data, so nothing it contains is ever executed.

When to use it

Use it when a macro-enabled file arrives from outside and you want to read what it would do before you trust it, or when you need to recover code from an old workbook whose author is long gone.

How to use it

1. Open a macro-enabled file (.docm, .xlsm, .pptm and related — ordinary .docx or .xlsx files simply contain no macro project).
2. Browse the modules, grouped into standard modules, UserForms, and class or document modules.
3. Read or copy the code — a single module, or all of them at once.

Good to know

• Macros are never run. The file is treated purely as a container and read byte by byte, so opening something suspicious here is safe in a way that double-clicking it is not.
• UserForm previews are reconstructed from the stored layout, so fonts, colours and exact positions can differ from the VBA editor.
• Seeing readable code is not the same as proving a file is safe: the visible source can be made to differ from the compiled code the host actually runs, and a file may also carry non-VBA threats.

Common questions

Is it safe to open a suspicious file here?

Reading it here does not execute anything — no macro runs, and the file never reaches a server. That makes inspection far safer than opening the file in Office, but it is not a virus scan.

Why does the tool say the code might not be the whole story?

Office stores both the VBA source and a compiled copy. The two can be made to disagree, so an attacker can show harmless-looking source while a different compiled version runs. Treat the code as evidence, not proof.

Can it recover macros from a file I have lost the password to?

It can read the source in files whose VBA project is merely locked for viewing, because that lock is only a flag in the container. A file encrypted with a document password cannot be opened at all.