enter image description here

I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.)

I have a 20+ digit password, however there's apparently a new requirement for Microsoft accounts for password to be no more than 16 digits in length. If I type in the first 16 digits of my password, I'm able to log in.

That got me thinking: if passwords are being stored as one-way hashes, a hash from a 16-digit password and a 20-digit one are not remotely similar. You cannot validate a 20-digit hash using only the first 16 digits.

If Microsoft is properly-storing passwords (salt & hash), how can they validate a shorter version of my password?


3 Answers 3


Three possibilities:

  1. Microsoft was always truncating it and you just were not aware. Can you use the old system with a 16 character password and wrong characters at the end?

  2. They were storing the passwords in plaintext (or equivalently encrypting the passwords, allowing them to decrypt the password to truncate it).

  3. When you first migrated accounts (or secretly in anticipation of you eventually migrating), they required you to enter the full 18-character password, checked that you were who you said you were against that, and then created and stored a new 16-character hash of the truncated password for the new system. This is unlikely but possible.

Regardless, truncating passwords or forcing short password lengths is bad password policy. It prevents easy-to-remember moderately strong passphrases; e.g., correct horse battery staple which is 28 characters long. Password lengths should not be truncated until at least ~50 characters or so. If your database requires a fixed maximum length, it probably makes sense to truncate somewhere around 100 characters or so at which point it is allows passphrases which probably have more entropy than can fit into a 128/256 bit hash which are perfectly strong hash lengths.

  • I can't find a Microsoft service which lets me enter my old password anymore, all of them ask for the first 16 characters.
    – orange
    Aug 21, 2012 at 20:53
  • Having a limit on the length of the password is a bit suspicious already, especially nowadays. But given how long MS accounts have been around, 1. is quite plausible - it used to be a lot more common in the past to truncate the password for whatever reason, even if you hashed it afterwards. Maybe there was even a good reason for it, but I'm not aware of any...
    – Luaan
    Jun 8, 2015 at 7:16
  • 1
    "If your database requires a fixed maximum length, it probably makes sense to truncate somewhere around 100 characters or so" What does that have to do with anything? If you're hashing your passwords then only length of the hash should matter, right?
    – Ajedi32
    Jan 19, 2016 at 20:12

This is possible in a couple ways. First if the password is being stored using some kind of reversible encryption allowing a plaintext comparison. Second if the hashing algorithm used to store the password only acts on the first 16 characters.


Whilst I have no direct knowledge of Microsofts password storage policy, I would suggest a couple of likely scenarios

  1. Most likely - They're truncating the password before they hash it. So if your password is 'iamaverylongpasswordandover16characters' the site just cuts it down to the first 16 chars before running it through the hashing function. TBH not a huge reduction in security, but still not desirable as it weakens peoples passwords
  2. less likely - They're storing in the clear. Obvious bad practice.
  3. even less likely - They're using an HSM and storing them in there with 2-way encryption, so they can retrieve the plain text to compare the first 16 chars.

If I were a betting man, my money would be on number 1.

  • 1
    But they don't ask you to enter your old password the first time, so is your assumption that they've always truncated the password and now it's just official? Aug 21, 2012 at 21:37
  • yep it's an assumption but it makes sense. I've seen quite a few systems that silently truncate passwords due to backend restrictions.. Aug 22, 2012 at 8:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .