VBA Input Box for Password: Masking and Safer Options

VBA’s built-in InputBox cannot mask a password: characters appear as the user types. To show dots or asterisks instead, create a VBA UserForm with a TextBox whose PasswordChar property is set; remember that masking only hides characters on screen and does not make password handling secure.

What the built-in VBA InputBox does

The VBA InputBox function opens a small dialog with a prompt and a text field. It is useful for collecting ordinary, short pieces of text, such as a search term, a project code, or a sheet name. It has no password or masking option, so it is not suitable when the characters should be concealed while being entered.

For example, this ordinary prompt displays whatever the user types. It reports only the length in the message box, but the text is still visible in the prompt while it is being entered:

Sub AskForProjectCode()
    Dim answer As String

    ' Ask for ordinary text; InputBox does not mask characters.
    answer = InputBox("Enter a project code:", "Project code")

    If Len(answer) = 0 Then
        MsgBox "No text was entered, or the prompt was cancelled."
    Else
        MsgBox "Received " & Len(answer) & " characters."
    End If
End Sub

The built-in function returns a string. If the user clicks Cancel, it returns a zero-length string, just as it does if the user clicks OK without entering anything. That ambiguity can matter in a form, but the larger issue for passwords is that the built-in dialog offers no way to hide the typed characters.

How to mask input with a UserForm

A VBA UserForm gives you a TextBox control that can conceal entered characters. In the TextBox properties, set PasswordChar to a character such as an asterisk. The value remains text inside the running macro; the property changes how it is displayed, not how it is stored or protected.

In Excel for Microsoft 365 on Windows, open the Visual Basic Editor with Alt+F11, then choose Insert > UserForm. Add a TextBox and two CommandButtons from the Toolbox. In the Properties window, give the controls these names:

• TextBox: txtPassword
• OK button: cmdOK
• Cancel button: cmdCancel

Set the button captions to OK and Cancel. The form itself can be named frmPassword. Set the TextBox’s PasswordChar property to * in the Properties window, or set it in the form’s initialization code. Asterisks are only an example; the control displays the chosen character in place of the actual input.

Example UserForm code

Place this code in the code module for frmPassword. The public variables let the calling procedure retrieve the result and determine whether the user cancelled. The form starts in the cancelled state, so closing it with its X button is treated as cancellation too.

Public PasswordText As String
Public WasCancelled As Boolean

Private Sub UserForm_Initialize()
    ' Hide typed characters and default to a safe cancelled state.
    Me.txtPassword.PasswordChar = "*"
    Me.PasswordText = vbNullString
    Me.WasCancelled = True
End Sub

Private Sub cmdOK_Click()
    ' Copy the value for the caller, then clear the visible control.
    Me.PasswordText = CStr(Me.txtPassword.Value)
    Me.WasCancelled = False
    Me.txtPassword.Value = vbNullString
    Me.Hide
End Sub

Private Sub cmdCancel_Click()
    ' Do not return text when the user cancels.
    Me.PasswordText = vbNullString
    Me.WasCancelled = True
    Me.txtPassword.Value = vbNullString
    Me.Hide
End Sub

Private Sub UserForm_QueryClose(Cancel As Integer, CloseMode As Integer)
    ' Treat the title-bar X like Cancel, keeping the form available to the caller.
    If CloseMode = vbFormControlMenu Then
        Cancel = True
        Me.PasswordText = vbNullString
        Me.WasCancelled = True
        Me.Hide
    End If
End Sub

In a standard module, call the form like this. Save a copy of the workbook before running a macro: VBA actions generally cannot be reversed with Ctrl+Z.

Sub RequestPassword()
    Dim dlg As frmPassword
    Dim enteredText As String

    ' Display the form modally so the user must close it before continuing.
    Set dlg = New frmPassword
    dlg.Show vbModal

    If dlg.WasCancelled Then
        MsgBox "Password entry was cancelled."
    Else
        enteredText = dlg.PasswordText
        MsgBox "A password was entered with " & Len(enteredText) & " characters."
        ' Use enteredText only for the intended operation; do not display it.
    End If

    ' Remove the form instance and release the local reference.
    Unload dlg
    Set dlg = Nothing
End Sub

This is a demonstration of concealed entry, not a complete login system. The example deliberately does not display the password or compare it with a password written into the macro. If your application needs to check credentials, choose an authentication method designed for that purpose rather than treating this form as a security boundary.

Handling empty input and cancellation

A password form should make its expected behavior clear. Decide whether an empty entry is allowed, how the user can cancel, and what happens after either choice. In the sample, Cancel and the title-bar X return a cancellation status, while clicking OK returns the entered text—even if that text is empty. If empty passwords are not acceptable for your task, check the length after the form closes and ask again or show a clear message.

Do not rely on Len(enteredText) = 0 alone to tell whether someone cancelled. A user might intentionally submit an empty value, and the built-in InputBox also uses an empty string for both a blank submission and Cancel. Keeping a separate Boolean status, as the UserForm example does, distinguishes those outcomes.

If you use Excel’s Application.InputBox instead, it still does not mask typed characters. It can return a Boolean False when the user cancels, which can help distinguish cancellation from text input when the return value is held in a Variant. That behavior improves the result handling, not the privacy of the visible input.

Masking is not password security

PasswordChar is a visual concealment feature. It can reduce casual viewing over someone’s shoulder, but the entered value is still available to VBA as ordinary text. Code can copy it, display it, write it to a cell, or save it in a file. Masking does not encrypt the value, validate a person’s identity, or prevent someone with access to the workbook or its VBA project from inspecting how the macro works.

Avoid hard-coding a real password in a macro, worksheet, named range, or hidden sheet. Hidden cells and worksheet protection are not secure storage for credentials. A password that must be sent to another service should be handled according to that service’s authentication design; do not put secrets directly into source code or leave them in logs, error messages, or workbook cells. Clear the UserForm TextBox after use, avoid showing the entered value in messages, and keep its lifetime as short as practical.

Excel’s workbook-open password encryption is a separate feature from a VBA prompt. In Windows Excel, workbook encryption is available through File > Info > Protect Workbook > Encrypt with Password. It protects access to the workbook file, rather than merely hiding characters in a macro dialog. It is not a substitute for an organization’s approved identity or access controls, and a password prompt written in VBA should not be presented as equivalent protection.

When to choose a different approach

Use a built-in InputBox for non-sensitive text when a quick, disposable prompt is enough. Choose a UserForm TextBox with PasswordChar when users need visual masking and you understand that it is only a presentation feature. Consider a different design when credentials protect valuable data, need to be shared across users, or must be verified securely.

• Ordinary input: Use InputBox for values such as a report name or a non-sensitive filter.
• Masked typing in a macro: Use a UserForm TextBox with PasswordChar, and keep the value out of the workbook and messages.
• Protecting a workbook file: Use Excel’s file encryption rather than a custom macro prompt.
• Work or organizational sign-in: Follow the organization’s approved authentication method instead of embedding or comparing a shared secret in VBA.

On Mac, Excel also supports VBA and UserForms, but menus, keyboard shortcuts, and some control behavior can differ from Windows. The Windows shortcut Alt+F11 may require Option+F11 or the Fn key on a Mac keyboard. Avoid Windows-specific API code in a solution intended to run on both platforms; the UserForm approach is generally preferable to relying on a Windows-only dialog workaround.

Common problems and fixes

• Characters still appear: Confirm that you set PasswordChar on the TextBox control, not on the form or a label. Check that the control name in code matches its actual name.
• The macro says the form is missing: Confirm that the UserForm’s (Name) property is frmPassword and that the code refers to that exact name.
• The form disappears but the caller has no result: Check that the OK button’s name is cmdOK and its click event contains the code that assigns PasswordText. A button caption alone does not create the matching event procedure.
• Cancel behaves like an empty password: Track cancellation with a separate Boolean flag instead of using an empty string as the only signal.
• The macro will not run: Save macro-enabled work as an .xlsm file and follow Excel’s macro security prompts and your organization’s policies. Do not enable macros in an untrusted workbook just to test a password form.

Frequently Asked Questions

Can VBA InputBox show asterisks instead of the password?
No. The built-in VBA InputBox has no password-mask setting. Use a UserForm TextBox and set its PasswordChar property to a character such as an asterisk.

Does PasswordChar encrypt the password?
No. It changes only the visible character in the TextBox. VBA can still read the underlying text, so do not treat masking as encryption or authentication.

Can Application.InputBox be used for passwords?
It can collect text, but it does not conceal what is typed. Its cancellation return value can be useful for distinguishing Cancel from text, but it does not make the prompt private.

How do I tell Cancel from a blank password?
Use a separate status variable, such as a Boolean cancellation flag, and set it in the Cancel button and form-close handling. Do not infer cancellation only from an empty string.

Will the UserForm method work on Mac?
Excel for Mac supports VBA UserForms, but some interface details and controls differ from Windows. Test the workbook on the Mac versions your users will run, and avoid Windows-only API code if the workbook must be cross-platform.

Related

• Merge Cells but Keep All Text in Excel: Safe Methods
• Microsoft Excel Always Not Responding? Causes and Fixes
• Merge Cells but Keep All Data in Excel: What Works

More in VBA & macros

• Excel Macro to Send Email: Setup, Code, and SafetyYes. In Excel for Microsoft 365 on Windows, a VBA macro can create an email in classic Outlook…
• Excel VBA Visible Worksheet Property: How to Set ItIn Excel VBA, a worksheet’s visibility is controlled by its Visible property. Set it to xlSheetVisible to show…
• VBA Find in Range: Search Cells and Return MatchesTo find a value in an Excel range with VBA, use the range’s Find method and check whether…
• Excel VBA Find Sheet by Name: Safe Code and ExamplesTo find a worksheet by its tab name in Excel VBA, use ThisWorkbook.Worksheets("Summary") and handle the error that…
• Excel VBA Or Operator: How It Works and When to Use ItIn Excel VBA, the Or operator combines conditions and returns True when at least one condition is True.…
• Access VBA Function Examples for Forms, Queries, and TablesAccess VBA functions are reusable procedures that return a value, such as a formatted name, a calculated amount,…

Sources: Function behaviour and menu paths: Microsoft Support documentation for Excel. Method & sources

Spotted an error in this guide? Let us know.