Three possibilities: 1). Microsoft was always truncating it and you just were not aware. Can you use the old system with a 16 character password and wrong characters at the end? 2). They were storing the passwords in plaintext (or equivalently encrypting them while giving them an option to decrypt them). 3). When you first migrated accounts (or secretly in anticipation of you eventually migrating), they required you to enter the full 18-character password, checked that you were who you said you were against that, and then created and stored a new 16-character hash of the truncated password. Regardless, truncating passwords or forcing short password lengths (especially as it prevents [passphrases](http://xkcd.com/936/) -- `correct horse battery staple` is 28 characters long) is bad password policy on Microsoft's part.