What is an XLSM file?

XLSM is a container: a wrapper that holds streams encoded by something else. It is used for editing.

The extension is .xlsm, and the full name is Excel Macro-Enabled Workbook. Both matter less than what the file can hold, which is what the rest of this page is about.

Microsoft published it in 2007. The specification is ECMA-376.

Age is worth knowing here for one practical reason: the older a format is, the more programs have had time to learn it.

It is published in full, so anyone can implement it from the document rather than by inspection, which is why it turns up in so many programs and why files written twenty years ago still open. A published specification is not the same thing as a royalty-free one: where a format wraps a codec, the patent licensing is a separate question the standard does not settle.

XLSM is not limited to one page, which matters when converting to something that is: one conversion produces one file holding a single page — the first one, unless the page is something the converter lets you pick.

XLSM is allowed to carry executable code, and that is usually the reason somebody meets this extension at all: a mail gateway or a document portal rejected it. Converting to a format without macros is the usual way past that, and it does mean the macros are gone.

XLSM holds a spreadsheet: cells, formulas and the sheets around them.

That is what decides how it converts: a spreadsheet becomes a print area, and a print area is a decision somebody has to make about where the columns break.

Microsoft Excel reads it, and so do most programs of the same kind.

If a file will not open, the format is rarely the problem — it is more often that the program predates it. Converting to something older is the reliable way past that, and it is what the rest of this site is for.

No browser reads it.

That is the single most common reason to convert it: not that the format is bad, but that the place you want to show the file cannot read it.

XLSM is meant to be opened and changed. Keep the file in this format for as long as the work is going on, and export from it whenever a finished copy is needed.

XLSM and XLSX are the same format. Both are ZIP packages of XML, both hold the same sheets, formulas and formatting, and the only difference is that an XLSM may contain a VBA project and an XLSX may not.

That split was the point. Before 2007 a workbook could carry macros with nothing in the extension to say so, and spreadsheets were one of the most effective malware delivery routes ever used. Separating the extensions means a recipient can see, before opening anything, whether a file claims to contain a VBA project. That is narrower than safe — DDE formulas and embedded OLE objects live in an ordinary XLSX too — but it is the guarantee every intake rule is built on.

VBA is a full programming language with access to the file system, the network and other applications. A macro can read and write files anywhere the user can, send data out, launch programs, and modify other documents. It is not a formula language confined to the sheet.

That is the honest reason for the caution. The overwhelming majority of macros are somebody’s report automation, written by a colleague, doing exactly what it says. The minority that are not have the same capabilities, and the file gives no way to tell them apart short of reading the code.

Excel disables macros by default and shows a banner. If the file came from the internet or an email attachment, Windows additionally marks it with a zone flag, and since 2022 Excel blocks macros in such files outright — a red banner rather than an enable button.

The intended fix for a file you trust is to unblock it in the file’s properties, or to place it in a folder configured as a trusted location. What is worth resisting is the habit of clicking through: the block exists because that click was the last step in a very large number of real incidents.

The VBA project is stored inside the ZIP as a binary stream — the one part of an Office Open XML package that is not readable XML. Renaming the file to .zip and looking inside shows the sheets in plain text and the macro as an unreadable blob.

So inspecting a macro means opening the VBA editor in Excel or LibreOffice, which most people will not do and which is the only reliable way to know what a workbook does. It also means version control cannot show a meaningful diff of the code, which is why serious spreadsheet automation eventually leaves VBA for something that lives in text files.

Saving an XLSM as XLSX removes the VBA project and keeps everything else — sheets, formulas, formatting, charts, named ranges. Excel warns before doing it, and the warning is the whole transaction.

This is exactly what you want for a workbook received from outside that you only need to read the numbers in, and exactly what you do not want for a file whose automation is its purpose. The distinction is simple: if the workbook does something when you press a button, converting breaks it; if it just holds data, converting makes it safer.

PDF for anything being sent, filed or printed. The result is fixed, holds no executable content at all, and removes both the layout question and the macro question in one step. For circulating a report generated by a macro-driven workbook, this is nearly always the right output.

CSV when the target is a database, a script or an analysis pipeline. It carries one sheet of values and nothing else — no formulas, no formatting, no code — which is precisely why import routines and security-conscious systems ask for it by name.

A VBA project that has become the way a department works is a liability worth naming: the code is opaque to version control, it runs only where Excel runs, it breaks when a sheet is renamed, and it is usually maintained by one person who has since moved on.

Microsoft’s own direction is Office Scripts and Power Automate for that work, and outside the Microsoft world a small script in a language that reads the file directly does the same job in files you can diff. Neither is a reason to rewrite a macro that works. Both are worth knowing before writing a new one that a hundred people will depend on.