I wanted to register a @live.com e-mail address, but it says it can't register an e-mail address having a password that contains more than 16 chars.

Why? So that it would be easier to get the real password? (if the password hashes were stolen . . .)

  • 1
    I've seen this max limit of 16 chars on other sites too. If the password is stored hashed then it should be the same size in the database no matter what the real password is, so why limit? I hope it's not because they are storing the passwords unhashed and 16 chars is the size of the database field. I really hope not. Jul 20, 2011 at 9:59
  • Bruteforceing a 16 char pass is more easy compared to brute-forcing a bigger one. (you know, there russian paying sites, those who specialize to brute-force hashes) Jul 20, 2011 at 10:26
  • This is interesting: IBM SQL & XML Data Limits The "Password access to a data source" row is 32 bytes maximum length which is the same size as a 16 character password after an MD5 hash is applied. Mar 6, 2012 at 20:48
  • Rincewind42 and Dez bring up really intereseting points; neither of those possibilities are secure. Mar 21, 2012 at 5:43
  • 2
    @Dez: Applying an MD5 to a 17 char password will still be 32 bytes. A more interesting point might be that 16 characters in Unicode would be 32 bytes.
    – musefan
    Mar 23, 2012 at 17:32

1 Answer 1


Actually because when you md5 a password it calculates a hash. Then the string is longer than 16 characters some "hashes" can collide between them.

For example if md5("noroof") gives 9ce405c98406f2f6d5326ee6b51d19cd it is possible that md5("ididntfixedmyroofwhenicould") could give the same hash 9ce405c98406f2f6d5326ee6b51d19cd. Remember that hashes are composed by with 32 characters of "0123456789abcdf" (for md5 in this case).

Maybe they force 16 character because the algorithm that computes the hash assures that will not have a collision in the database with a previously saved password.

  • 6
    A hash can always create a collision - as you say, it's possible that a 17+ character password would collide with a shorter password. But, it is just as unlikely to collide as a short password is unlikely to collide, and a long password is vanishingly unlikely to collide with a brute-force-guessable short password. There's no reason to believe that long passwords are more likely to collide than short passwords - if there was some reason to believe that, the hash would be effectively broken anyway.
    – Ronald
    Apr 9, 2012 at 17:13
  • 2
    Ronald is correct, the accepted answer is plain wrong. The likelihood of MD5 strings to collide does not depend on their length.
    – talkol
    Oct 4, 2012 at 18:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.