How to Convert a Password-Protected PST File

The Problem: Your PST File Has a Password

Microsoft Outlook allows users to set a password on PST files to prevent unauthorized access. When a PST file is password-protected, Outlook prompts for the password every time you open it. If you need to convert this PST to another format — EML, MBOX, or MSG — the password protection adds an extra hurdle.

Common scenarios include:

• You set a password years ago and have forgotten it.
• You received a password-protected PST from a colleague or client.
• An IT department needs to convert archived PST files that were protected by former employees.
• A legal team needs to access password-protected archives during eDiscovery.

Understanding PST Password Protection

Before diving into solutions, it helps to understand how PST password protection actually works.

It Is Not Strong Encryption

PST password protection is surprisingly weak by modern security standards. The password is stored as a CRC-32 hash inside the PST file header. This is not the same as AES encryption or any robust cryptographic scheme. The password mechanism was designed to prevent casual access, not to withstand determined recovery efforts.

Important implications:

• The password does not encrypt the file contents. The emails, attachments, and metadata inside the PST are stored in their normal binary format. The password only controls access at the application level.
• Multiple passwords can produce the same CRC-32 hash, meaning password recovery tools can often find a working password (not necessarily the original one) quickly.
• Microsoft has publicly documented this mechanism in the MS-PST specification.

Compressible Encryption vs. High Encryption

Outlook offers two “encryption” levels when creating a PST:

• Compressible Encryption (default) — a basic byte-shifting cipher. Not true encryption.
• High Encryption — a slightly more complex cipher, but still based on XOR operations, not modern cryptographic standards.

Neither provides meaningful security against a determined attacker. The password is an additional layer on top of these ciphers.

Solution: Convert Password-Protected PST With MailtoPst

MailtoPst can handle PST files with standard Outlook password protection.

If You Know the Password

1. Go to mailtopst.com (or your preferred target format).
2. Upload the password-protected PST file.
3. Enter the password when prompted by the conversion tool.
4. Wait for processing — MailtoPst decrypts the password layer, parses the PST structure, and converts all messages.
5. Download the result.

The converted output (EML, MBOX, or MSG files) is not password-protected — the messages are in their standard, open format.

If You Forgot the Password

Because PST password protection is based on CRC-32 hashing rather than strong encryption, there are legitimate approaches to recover access:

1. Try common passwords — many users set simple passwords like “password,” “1234,” or their name on PST files.
2. Use a PST password recovery tool — several free and paid tools can calculate a working password from the CRC-32 hash stored in the PST header. This typically takes seconds.
3. Remove the password — some tools can clear the password hash from the PST header directly, making the file accessible without a password.
4. Contact MailtoPst support — for enterprise customers, the support team can advise on specific scenarios.

Important: Only recover passwords for PST files you own or are legally authorized to access. Unauthorized access to someone else’s email archive may violate privacy laws.

After Conversion

The converted files (EML, MBOX, MSG, or a new PST) do not carry over the password protection. If you need to protect the converted output, use filesystem-level encryption (BitLocker, FileVault) or a password-protected ZIP archive.

Why MailtoPst for Protected PST Files

• Built-in password handling — enter the password during upload and the tool handles decryption transparently.
• All output formats — convert to EML, MBOX, MSG, or an unprotected PST.
• Secure processing — your password and file data are encrypted via TLS, processed on EU servers, and auto-deleted. GDPR compliant.
• No software to install — everything runs in your browser.

Upload your file now and convert your password-protected PST. Try free — no credit card required.

Frequently Asked Questions

Can MailtoPst crack a PST password?

MailtoPst requires you to enter the correct password (or a CRC-32 equivalent) during upload. It does not brute-force passwords. For password recovery, use a dedicated PST password recovery tool first, then upload the file to MailtoPst with the recovered password.

Is it legal to remove a PST password?

If you are the owner of the PST file or have legal authorization to access it (IT administrator, legal team with proper authority), removing the password is legal. Unauthorized access to another person’s email may violate privacy laws depending on your jurisdiction.

Will the converted files also be password-protected?

No. The output files (EML, MBOX, MSG) are standard, unprotected formats. If you need to secure the output, use external encryption tools.

What if the PST uses S/MIME encrypted messages inside?

S/MIME encryption is applied at the individual message level, not the PST level. Even after converting the PST, individual S/MIME-encrypted messages will remain encrypted and require the recipient’s private key to decrypt. This is separate from PST password protection.

Can I convert a password-protected OST file?

OST files use profile-level encryption rather than user-set passwords. MailtoPst handles OST encryption as part of the OST to PST conversion process. No password entry is required for OST files.

Upload your file now and unlock your password-protected PST archive.