2

I'm trying to change my Hotmail password after a breach in LastPass but it doesn't seem to work. So I'm curious if Microsoft has a limit of 16 characters for a password?

If so, this is very insecure and I'm getting this warning from LastPass:

enter image description here

Note that I am using LastPass to generate a secure password. It's just if I make it longer than 16 symbols Hotmail doesn't seem to accept it.

migrated from superuser.com Jun 18 '15 at 15:34

This question came from our site for computer enthusiasts and power users.

  • 1
    If a 16 character password is being flagged as weak, it probably isn't due to the number of characters being too low. It's more likely due to the nature of the password, like 16 of the same character; or lack of various character types, like lower and upper case letters plus numbers plus symbols; or using a repeated string of a common word; etc. – fixer1234 Jun 17 '15 at 2:39
  • @fixer1234: No, it's not. It was something like this nV%u6cMIbK11ZU91 And, I agree with LastPass' assessment, 16 characters is somewhat weak these days. Google and pretty much any other service doesn't put a limit on the password length. I usually go with 32 at least. – MikeF Jun 17 '15 at 2:45
  • I am voting to migrate this to Web Applications SE since its about the password length for a web application specifically Outlook/Hotmail accounts. 16 character password is secure. If you are that worried use 2-factor authenication. If you change the password every 90 days, the only possible attack, is brute force and Microsoft will lock/disable the account down before that happens. – Ramhound Jun 17 '15 at 11:08
  • Change your LastPass master password, they got hacked...threatpost.com/… – Moab Jun 17 '15 at 13:08
4

Microsoft now no longer restricts password length for the Windows Live accounts unless you want to sign in to Xbox Live on the Xbox 360:

Microsoft Account - Change password page

I successfully set a 32 character password with a password manager, and signing in to Windows Live does not work unless I enter the full password, so it seems they are not limiting to the first 16 characters anymore.

  • As another note, passwords longer than 16 characters are not permitted in games that use Games For Windows Live. So, if you want to play Bulletstorm, you'd have to reduce your password length or install the crack that removes GFWL. – Peter Jan 4 '17 at 6:09
  • Very nice. They eventually learned it. ... Too bad I switched to Gmail :) – MikeF Oct 26 '17 at 2:36
2

Yes, the hotmail password is limited to 16 characters.

A few Reason for Maximum Password Length gives some reasons as to why some providers choose a maximum length.

See also Why are passwords limited to 16 characters?.


Source Outlook webmail passwords restricted to 16 chars - how does that compare with Yahoo and Gmail?

It seems that Outlook.com won't let you have a password of longer than 16 characters. (The same was true of Hotmail).

enter image description here

  • Good one. Thanks. No offence to malwaretech, but I trust Information Security guys' opinion. So it seems like my concerns were correct. They must be using some outdated and broken hash like MD5. That's seriously one of the most probable reasons to limit password length... In other words, it's time to move to Gmail. (Note, NOT Yahoo!) – MikeF Jun 18 '15 at 7:42
  • At least Yahoo is 32 characters. – DavidPostill Jun 18 '15 at 7:48
  • 2
    Good point. Although their latest SMS-based "TFA" (note in quotes) is something that would make me stay away from them: pcworld.com/article/2897332/… It doesn't seem like they understand security that well. (Pretty much like Hotmail people.) – MikeF Jun 18 '15 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.