Microsoft password requirements at a glance
The answer depends on whether you use a personal Microsoft account or an organization-managed Microsoft Entra account. Outlook.com and Hotmail use the password for your personal Microsoft account.
| Account or guidance | Current answer |
|---|---|
| Personal Microsoft account | Microsoft's reviewed support pages do not publish a complete fixed validation checklist |
| Outlook.com and Hotmail | Use the associated personal Microsoft account password |
| Microsoft security recommendation | Use a unique password that is ideally at least 14 characters long |
| Cloud-only Microsoft Entra account | 8–256 characters; three of four character categories |
| Work or school account | The organization, synchronization setup, and account type can change the applicable policy |
| Additional account protection | Two-step verification and passwordless sign-in are available |
Bottom line: for a personal account, use a unique random password of at least 16 characters and let Microsoft's live form confirm it. For a work or school account, follow the live message and your administrator's policy.
Are Outlook and Hotmail password requirements different?
No separate Outlook.com or Hotmail password is normally required. Microsoft states that Outlook.com and Hotmail sign-in uses your Microsoft account username and password. Changing that password changes the credential used for the connected personal Microsoft services.
This is different from an Outlook desktop or mobile app connected to a third-party email provider. In that situation, the password rules come from the organization or email provider that owns the account.
What makes a strong Microsoft account password?
Microsoft's consumer security guidance recommends long passwords or phrases that mix uppercase letters, lowercase letters, numbers, and symbols, and says passwords should ideally be at least 14 characters long. It also advises against reusing the same password across accounts.
For a password-manager workflow, 16 or 20 independently random characters provide a practical margin above that recommendation. Do not include your name, Outlook address, birthday, employer, Xbox gamertag, or predictable substitutions from a familiar word.
Microsoft 365 and Entra password requirements
Microsoft publishes specific defaults for cloud-only accounts created directly in Microsoft Entra ID. The password must be 8–256 characters and use at least three of these four categories: lowercase letters, uppercase letters, numbers, and symbols. The documented allowed set includes ASCII letters, digits, listed ASCII punctuation, and blank spaces; Unicode characters are not accepted by that standard cloud policy.
Those rules are not universal for every work or school account. A synchronized on-premises account can be subject to its organization's Active Directory policy, and administrators can block organization-specific words. Guest users follow the policy of their home tenant. Treat the message on your actual password-change screen as authoritative.
Use a Microsoft password generator
- Open the 16-character password generator or 20-character generator.
- Keep uppercase, lowercase, numbers, and ASCII symbols enabled.
- Generate a fresh value instead of modifying an old Microsoft password.
- Enter the candidate on Microsoft's official password form and follow any live validation message.
- Store the accepted password in a trusted password manager.
Generation happens locally in your browser. The generator does not send or store the value, but only Microsoft or your organization can confirm the policy that applies to the account.
Why might Microsoft reject a password?
A new password may be rejected because it is too short, does not meet the account's required character categories, matches a current password, contains a globally or organization-blocked term, or conflicts with a synchronized on-premises policy. The exact reason depends on the account type.
If a symbol appears to be the problem, read the live message before weakening the password. A fresh candidate from the alphanumeric password generator may help with a narrower form, but an Entra policy requiring three character categories can still require both letter cases and numbers.
How to reset a forgotten Microsoft password
For a personal Microsoft account, choose the forgotten-password option on the Microsoft sign-in page, identify the account, and verify your identity using an available email address, phone number, or other configured method. Microsoft then lets you create a new password.
If the listed verification methods are unavailable, use Microsoft's sign-in helper or recovery form. Work and school users may need their organization's self-service password reset flow or IT administrator instead.
Use two-step verification or go passwordless
Microsoft supports two-step verification for personal accounts. It recommends keeping multiple pieces of security information on the account so a lost device or inaccessible method does not become a recovery dead end.
Personal Microsoft accounts can also remove the password and use Microsoft Authenticator, Outlook for Android, Windows Hello, a physical security key, or supported codes. Passwordless sign-in reduces the value of a stolen or phished password.
Sources, limits, and review date
This guide was reviewed on September 28, 2026. Microsoft can change its account forms and identity policies, and an organization can impose a different work or school policy. The live Microsoft form and the responsible administrator take priority.
- Microsoft Support: How to sign in to Outlook.com
- Microsoft Support: Password security guidance
- Microsoft Learn: Microsoft Entra password policies
- Microsoft Support: Reset a forgotten Microsoft account password
- Microsoft Support: Two-step verification
- Microsoft Support: Go passwordless
Generate My Password is not affiliated with Microsoft.