3

I'm trying to change my Hotmail password after a breach in LastPass but it doesn't seem to work. So I'm curious if Microsoft has a limit of 16 characters for a password?

If so, this is very insecure and I'm getting this warning from LastPass:

enter image description here

Note that I am using LastPass to generate a secure password. It's just if I make it longer than 16 symbols Hotmail doesn't seem to accept it.

Improve this question
4
  • 1
    If a 16 character password is being flagged as weak, it probably isn't due to the number of characters being too low. It's more likely due to the nature of the password, like 16 of the same character; or lack of various character types, like lower and upper case letters plus numbers plus symbols; or using a repeated string of a common word; etc.
    – fixer1234
    Jun 17, 2015 at 2:39
  • @fixer1234: No, it's not. It was something like this nV%u6cMIbK11ZU91 And, I agree with LastPass' assessment, 16 characters is somewhat weak these days. Google and pretty much any other service doesn't put a limit on the password length. I usually go with 32 at least.
    – MikeF
    Jun 17, 2015 at 2:45
  • I am voting to migrate this to Web Applications SE since its about the password length for a web application specifically Outlook/Hotmail accounts. 16 character password is secure. If you are that worried use 2-factor authenication. If you change the password every 90 days, the only possible attack, is brute force and Microsoft will lock/disable the account down before that happens.
    – Ramhound
    Jun 17, 2015 at 11:08
  • Change your LastPass master password, they got hacked...threatpost.com/…
    – Moab
    Jun 17, 2015 at 13:08

2 Answers 2

Reset to default
4

Microsoft now no longer restricts password length for the Windows Live accounts unless you want to sign in to Xbox Live on the Xbox 360:

Microsoft Account - Change password page

I successfully set a 32 character password with a password manager, and signing in to Windows Live does not work unless I enter the full password, so it seems they are not limiting to the first 16 characters anymore.

Improve this answer
3
  • As another note, passwords longer than 16 characters are not permitted in games that use Games For Windows Live. So, if you want to play Bulletstorm, you'd have to reduce your password length or install the crack that removes GFWL.
    – Synchrondyne
    Jan 4, 2017 at 6:09
  • Very nice. They eventually learned it. ... Too bad I switched to Gmail :)
    – MikeF
    Oct 26, 2017 at 2:36
  • I just tried what I believe is the new maximum of 256 characters, and found that although the password change screen accepted it, I could not later login with that same password. I then reset to a 60 character password and that worked fine. So somewhere between 60 and 256 is the current practical limit.
    – Mike
    May 20, 2020 at 13:49
2

Yes, the hotmail password is limited to 16 characters.

A few Reason for Maximum Password Length gives some reasons as to why some providers choose a maximum length.

See also Why are passwords limited to 16 characters?.

Source Outlook webmail passwords restricted to 16 chars - how does that compare with Yahoo and Gmail?

It seems that Outlook.com won't let you have a password of longer than 16 characters. (The same was true of Hotmail).

enter image description here

Improve this answer
3
  • Good one. Thanks. No offence to malwaretech, but I trust Information Security guys' opinion. So it seems like my concerns were correct. They must be using some outdated and broken hash like MD5. That's seriously one of the most probable reasons to limit password length... In other words, it's time to move to Gmail. (Note, NOT Yahoo!)
    – MikeF
    Jun 18, 2015 at 7:42
  • At least Yahoo is 32 characters.
    – DavidPostill
    Jun 18, 2015 at 7:48
  • 2
    Good point. Although their latest SMS-based "TFA" (note in quotes) is something that would make me stay away from them: pcworld.com/article/2897332/… It doesn't seem like they understand security that well. (Pretty much like Hotmail people.)
    – MikeF
    Jun 18, 2015 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.