XLS Padlock Changelog

The XLS Padlock changelog offers a detailed, chronological history of all published versions. Each entry lists new features, enhancements, bug fixes, and other significant changes. The most recent version is always at the top.

Released September 4, 2026. This maintenance release adds an Exclude credentials option to Azure Artifact Signing, fixes a crash of protected applications when a Windows file dialog opens, restores the correct recalculation of protected formulas that reference other cells and the per-cell Cell Dependencies choice (2026.0 regressions), hides Excel’s Automate tab again when Office Scripts are not allowed, translates the Web Update wizard and the Launcher welcome screen, and repairs several Designer buttons. Protected applications must be re-packed with this release to receive the runtime fixes listed below. Existing activation keys and offline license keys keep working unchanged.

• New Azure Artifact Signing Exclude Credentials: The EXE Code Signing page has a new optional “Exclude credentials” field for the Azure Artifact Signing method, so credential types that fail before the Azure CLI credential is tried can be skipped, as documented by Microsoft. Entries are checked against the nine valid credential type names, and the “Exclude all except Azure CLI” button fills in the recommended list for a computer authenticated with az login. Leaving the field empty produces the same signing metadata as previous releases. See How to Code Sign Your EXE File.
• Fixed Crash When a File Dialog Opens: On some computers, a protected application (and Excel with it) could close instantly, with no error message, as soon as a Windows file dialog opened, such as the secure “Save As” dialog or Insert > Pictures > This Device. This long-standing issue, more frequent when some security software was active, is fixed in the runtime, and the secure save dialog is the standard Windows file dialog again. Re-pack the workbook with this release to fix deployed applications.
• Fixed Protected Formula Recalculation: In applications created with XLS Padlock 2026.0 or 2026.1, a protected formula that references other cells could return a wrong but plausible value with no error, because the compiled workbook no longer told Excel which cells the formula depends on and protected cells could be recalculated in the wrong order. XLS Padlock now derives each protected formula’s dependencies from the formula itself at compile time, whichever formula protection method is used, and declares them by default for every protected cell (see the next entry). Re-pack the workbook with this release to fix deployed applications.
• Fixed Cell Dependencies Choice Applied Again: In the Protect Formulas window, the per-cell Cell Dependencies choice (“Detect Cell Dependencies” or “No Dependency”) was accepted and displayed since 2026.0 but was not saved with the cell list, so it never reached the compiler and every cell behaved as if “No Dependency” had been selected. The choice is saved and applied again. Dependency detection is now the default for every cell, including cells added with 2026.0 or 2026.1 whose setting was lost, and the choice is stored in a language-independent form so it survives a change of interface language. Selecting “No Dependency” remains supported when you deliberately do not want XLS Padlock to declare a formula’s dependencies.
• Fixed More Accurate Dependency Detection: When working out the cells a protected formula depends on, XLS Padlock no longer mistakes Excel function names containing digits (LOG10, ATAN2, DAYS360), worksheet names in cross-sheet references, table names in structured references, or text inside quoted strings for cell references, which could produce a dependency list that Excel rejected in the compiled application. Named ranges keep being detected as before. Re-pack the workbook with this release to apply the fix.
• Fixed Automate Tab Suppression: In protected applications built with “Disable all ribbons and toolbars” enabled and “Allow Office Scripts and Power Automate” disabled on the Cloud & AI page, an unnamed ribbon tab containing Excel’s Automate commands (Office Scripts, Power Automate) could still appear next to File. The tab is now hidden as intended, as it was before XLS Padlock 2026.0, while enabling “Allow Office Scripts and Power Automate” still shows the fully functional tab. Re-pack the workbook with this release to fix deployed applications.
• Fixed Localized Web Update Wizard: The Web Update wizard, opened by the “Check for Updates” button or by the automatic check at startup, now appears in the language selected for the protected application, using the translations already embedded in it. Previously its buttons and messages stayed in English even when the rest of the application was translated. Re-pack the workbook with this release to fix deployed applications.
• Fixed Launcher Welcome Screen Language: In the EXE + XPLAPP bundle format, the welcome screen shown when the Launcher EXE is started without its .xplapp file now appears in the Windows display language, in any of the 10 supported languages, instead of English only. Once the protected application is opened, the language selected on the Localization page applies as before. Re-pack the workbook with this release to fix deployed applications.
• Fixed Loading a Save File from Another Application: When an end user opened a .XLSC save file created by a different protected application, or a corrupted save file, the protected application could close with a Windows error instead of explaining the problem. It now displays the “Storage file is corrupted” message and lets the user choose another save file or start from the original workbook. Re-pack the workbook with this release to fix deployed applications.
• Fixed Copy Buttons for Application Master Key and Security Private Key: On the Licensing Options page, the Copy button next to the Application Master Key field (Activation Settings tab) and the one next to the Security Private Key field (Online Activation tab) did nothing, leaving the clipboard unchanged. Both buttons now copy the field value to the clipboard. The Copy buttons for the Application GUID and Application Secret Key also copy more reliably, including right after clicking Generate.
• Fixed PFX File Browse Button: On the EXE Code Signing page, the browse button next to the “PFX File Path” field did nothing since XLS Padlock 2025.2, so the path had to be typed or pasted by hand. Clicking it now opens the file selection dialog as intended.
• Fixed SignTool Commands Output Folder Marker: With the “SignTool Commands” code signing method, the {$OUTPUTFOLDER$} marker is now replaced wherever it appears in a command, including when it is directly followed by a backslash or a closing quote, or placed at the end of the line. Previously it was only replaced when followed by a space, so a command such as "{$OUTPUTFOLDER$}\my-metadata.json" passed the literal marker to SignTool and signing failed. The {$OUTPUTFILE$} marker was not affected. Sign the EXE file again with this release to apply the fix.

Released July 15, 2026. This maintenance release fixes several issues in protected applications created with XLS Padlock 2026.0, improves Web Update reliability, and smooths the Azure Artifact Signing workflow in the Designer. Protected applications must be re-packed with this release to receive the runtime fixes listed below. Existing activation keys and offline license keys keep working unchanged.

• Improved Hardened Offline License-Key Validation: Offline license-key validation has been strengthened without changing the license-key format. Keys already issued by the legitimate generators keep working unchanged.
• Fixed License Agreement Persistence: Protected applications that combine a license agreement with activation keys stored in the registry no longer ask the end user to accept the license agreement at every launch. Re-pack the workbook with this release to fix deployed applications.
• Fixed Web Update Control File: Fixed cases where Web Update could fail with “WUPDATE.INI not found” in protected applications created with XLS Padlock 2026.0. Re-pack the workbook with this release to fix deployed applications.
• Fixed Web Update for Administrator Installs: Web Update now works correctly when a protected application is installed in a folder that requires administrator rights, such as Program Files, and the end user approves the update with a different administrator account.
• Fixed Web Update Restart Sequence: When an update is downloaded at startup, the protected application now exits immediately so the update installer can replace files before the updated version starts. The installer also retries briefly when a file is still locked by application shutdown or security software.
• Fixed Azure Artifact Signing Status: The Code Signing page now loads stored Global Preferences at Designer startup, so a valid Azure Artifact Signing configuration no longer shows a red status until the Preferences dialog is opened.
• Fixed Automatic Signing: The “Automatically sign my exe file” option now works with Azure Artifact Signing, custom SignTool commands, and JSign configurations that do not use the local certificate field.
• Fixed Dual 32-bit and 64-bit Signing: In the “32-bit and 64-bit (two separate EXE files)” packaging mode, the “Sign EXE file now” command now signs both generated EXE files.

Released June 11, 2026. This major release modernizes XLS Padlock’s internal engines, hardens protected workbooks against new Microsoft 365 cloud surfaces and other plugins for Excel like Claude for Excel, and offers several new features and speed improvements.

• New New Multilingual Engine (GNU gettext): XLS Padlock and the protected applications now use the industry-standard gettext format (.po / .mo) for all 10 supported languages (English, French, Spanish, Portuguese, Dutch, German, Arabic, Italian, Simplified Chinese, Traditional Chinese), with correct right-to-left mirroring for Arabic.
• New End-User Translation Override: You can choose a single .po file to translate the protected application’s interface. XLS Padlock compiles it natively into the protected application, with no external tools required for your customers.
• New New In-House VBA Engine: A new VBA engine replaces the previous third-party scripter. It produces universal bytecode that runs unchanged in both 32-bit and 64-bit protected workbooks (a single compilation pass instead of separate 32-bit and 64-bit compilers), with faster startup and a smaller runtime.
• New Run as a VBA-Only App (Excel Window Fully Hidden): A new option on the Splash Screen page lets your application run entirely from your VBA UserForms, with the Excel main window and its taskbar icon never appearing at any point. Excel is hidden from the very start of launch, so there is no flash and no Excel splash before your first form is shown. It combines naturally with the splash screen and the option to hide the loading dialog for a fully silent, fully branded startup.
• New Microsoft 365 Cloud and AI Lockdown: Protected workbooks now block, by default, the Microsoft 365 cloud and AI surfaces that can read or send out workbook data: Office JS web add-ins (for example the Claude for Excel plugin and other third-party JS add-ins), Office Scripts and Power Automate, and Microsoft connected experiences such as Copilot, Python in Excel, Smart Lookup, and Translator. The matching ribbon entry points (the Home tab Add-ins flyout, the Automate tab, and the Copilot button) are hidden as well. Each capability stays off unless you enable it, only for what your customers genuinely need, from the new Cloud & AI options page.
• New Stronger Save-File Encryption: XLSC and XLSCE save files now use AES-256-CTR encryption with HKDF-SHA256 key derivation and HMAC-SHA256 authentication, replacing the legacy scheme. Save files written by older versions keep opening unchanged.
• New Signed Online Activation Responses (Optional): A new opt-in upgrade has the protected application cryptographically verify the activation server’s response with an Ed25519 signature before trusting any field, including the status and error messages shown to the end user. This protects against tampering on the network path even over HTTPS (for example, a proxy or security product that injects its own trusted root). A compatibility option, checked by default, preserves the previous behavior; enabling the new mode requires the 2026 version of your activation kit (Activation Kit, WooCommerce Integration Kit, or FastSpring Subscription Kit), which serves both old and new protected applications from the same install.
• New Enhanced Hardware Fingerprint (Optional): A new option on the Hardware ID Options dialog reinforces the System ID computation. The System ID format is unchanged (XXXX-XXXX-XXXX). It is on by default for new projects and off for projects created with earlier versions, since enabling it rotates the System ID and invalidates previously issued activation keys.
• New Launcher Welcome Screen and Version Check: The application launcher now shows a welcome dialog at startup and clearly rejects bundles produced by versions older than 2026, instead of failing with a cryptic error.
• Improved Hardened Application Startup: The protected application’s startup loader has been hardened against local tampering, DLL search-order hijacking, and symbolic-link or junction redirection, and it now verifies that its runtime components are signed by G.D.G. Software before loading them. Modern exploit mitigations (Control Flow Guard and CET shadow stack) are enabled.
• Improved Locale-Aware Cell Value Restoration: When restoring cell values from a XLSCE save file, numbers are now interpreted using Excel’s interface language rather than the Windows regional settings, fixing cases where values could be restored as text and break dependent formulas.
• Improved Reliable Startup on Deeply Nested Profiles: Fixed silent startup failures on corporate or domain-joined profiles whose AppData path exceeds the historical 260-character limit.
• Fixed Python in Excel Workbooks: Packing a workbook that contains Python in Excel (=PY()) cells used to silently drop the Python content, leaving a protected workbook that Excel refused to open. XLS Padlock now detects this at the start of compilation and offers to enable the option that preserves Python content (formula protection through Excel Automation).
• Fixed Azure Artifact Signing Detection: The Code Signing page now refreshes its SignTool extension status as soon as you close Global Preferences, and Auto-detect no longer overwrites a valid custom path with a non-existent suggestion. It also probes the current Azure Artifact Signing per-user install location.
• Fixed Deactivation and Relaunch from VBA on 64-bit Excel: Calling the deactivation or relaunch helpers from VBA could silently fail for workbooks distributed in the bundle format and opened under 64-bit Excel. This now works correctly.
• Fixed Save Mode Migration: Switching between Full Save (XLSC) and Cell Values (XLSCE) modes between two releases no longer traps users who have existing save files in a loop of “not compatible” messages; the original embedded workbook now loads automatically.
• Fixed Cell Values Recalculation: Formulas that depend on values restored from a XLSCE save file now recalculate automatically on opening, instead of showing stale values until F9 was pressed.
• Fixed Cell Values Save Files Open Correctly: Fixed cases where XLSCE save files could report “corrupted” even when intact, by always selecting the correct decryption algorithm recorded in the save file.
• Fixed Atomic Save Operations: Excel “Replace” and “Move” save operations now round-trip content correctly, fixing cases where external tools (anti-virus scanners, OneDrive or SharePoint sync clients) could index or sync empty files.
• Fixed Compatibility with Older 32-bit Add-ins: Third-party add-ins that open workbook paths through the older ANSI file API no longer crash on protected workbooks.
• Removed Pre-2026 application files are not compatible: Protected applications and .xplapp bundles produced by XLS Padlock 2026.0 require a 2026.0 or newer runtime, and files produced by older versions are rejected by the new launcher. Re-pack any workbook you want to distribute with this release.
• Removed VBA named constants from the previous scripter: VBA scripts that relied on named constants such as xlAll, xlAutomatic, or xlByRows must now use their literal numeric values or rely on the late-bound Application object (which still resolves Excel enums automatically). This follows the move to the new in-house VBA engine.
• Removed Legacy .sil translation format: Custom translations now use the gettext .po / .mo format. The previous .sil format is no longer used at runtime.

This version introduces compatibility with the latest Windows 11 update, resolves critical issues with the Web Update and Save As features, and includes several internal component updates for enhanced performance and security.

• New Windows 11 25H2 Compatibility: Full support and testing for the Windows 11 Version 25H2 update.
• New New Languages: Added full localization for Italian, Simplified Chinese, and Traditional Chinese.
• Improved Upgraded key internal components for improved performance, stability, and security.
• Improved Web Update Improvements: The web update has been improved, particularly with Universal EXE files.
• Improved Runtime File Cleanup: Old runtime DLLs are now removed from the AppData location.
• Improved Revamped Documentation: The entire documentation has been overhauled. It is still available online, as an offline help file, and as a downloadable PDF guide.
• Improved Internal update for Enky CT and LC dongles.
• Improved Minor improvements.
• Fixed Save As Dialog Path: Fixed a regression where the “Save As” dialog would incorrectly default to a previously used directory, ignoring the path optionally specified via the SetSecureWorkbookFilename VBA function.
• Fixed EXE Version Info: Fixed a bug where the CompanyName and InternalName fields in the EXE’s version information were not being set correctly during compilation.

This release focuses on performance improvements, new language support, and fixing several user-reported bugs for better stability and user experience.

• New New Languages: Added Simplified Chinese and Traditional Chinese localization files (.SIL) for compiled applications.
• New Improved Compression: The compression algorithm has been switched to Zstandard for faster compilation and execution.
• Improved Component Update: The internal spreadsheet engine has been updated for improved compatibility and performance.
• Improved The compilation process will now correctly stop if an error (such as an incorrect password) occurs while protecting the original workbook, preventing the creation of a non-functional application.
• Improved Added a check at compile time to prevent the use of duplicate companion file names.
• Improved Stability: The multithreading loop has been optimized for increased overall application stability.
• Improved Improved progress bar behavior during compression.
• Fixed Fixed a regression where a protected workbook could no longer be opened directly from Windows Explorer (via double-click or file association) in some cases.
• Fixed Resolved a conflict where the deactivation prompt could not appear when the “Save changes automatically” option was enabled.
• Fixed Fixed a focus-stealing issue where the application would switch to another window after saving a file.
• Fixed The PE (Portable Executable) checksum calculation has been fixed.
• Fixed Fixed an issue that could prevent the correct EXE format from being selected when creating a new project.

This is a landmark update packed with significant new capabilities, security enhancements, and a refined user experience to provide greater flexibility and protection for your Excel applications.

• New Comprehensive Multilingual Support:
  • The main XLS Padlock interface is now multilingual. It auto-detects your Windows display language or can be set manually.
  • Compiled applications now support multilingual user interfaces (dialogs, messages).
  • Current languages include: English, French, Spanish, Portuguese, Dutch, German, and Arabic (with RTL support).
• New New Standalone Package Format: A new standalone executable format using robust 7z compression. This results in smaller .exe files and significantly reduces antivirus false positives compared to the previous UPX-based method.
• New Enhanced Cloud Code Signing Support:
  • Added support for modern, cloud-based code signing certificates.
  • Includes built-in integration for Microsoft Azure Trusted Signing.
  • Integrates with Microsoft’s SignTool.exe, allowing the use of certificates stored on hardware tokens or in the cloud.
• Improved Modernized UI: The XLS Padlock interface has been given a fresh look, and UI control resizing issues have been resolved.
• Improved Updated Help System: Documentation is now delivered in a modern help viewer, and the context-sensitive help (F1 key) has been improved.
• Improved Simplified Bundle App Format: The 64-bit loader is now a distinct, digitally signed .bin64 file for improved recognition by security software.
• Improved Upgraded Signature Security: Dropped support for outdated SHA-1 signatures. XLS Padlock now relies exclusively on SHA-256 signatures as per Microsoft guidelines.
• Improved Improved OneDrive Handling: The software now provides clearer warnings when working with cloud-only OneDrive files.
• Improved Smoother Web Updates: Fixed the application restart logic after a web update when the “Allow one instance” option is active.
• Improved Refined Localization: Addressed untranslated text elements and improved overall language file handling.
• Fixed Fixed issues related to sheet protection.
• Fixed Fixed bugs affecting interaction with locked cells.
• Fixed Resolved an issue related to certificate deactivation.
• Fixed Fixed problems with the creation of universal icons for applications.
• Fixed General stability improvements and various other minor fixes.
• Removed Support for EnkySL dongles has been discontinued.
• Removed UPX compression is no longer used for creating executables.
• Removed Support for SHA-1 code signing has been removed.