Password rules · checked 2026-10-06
Microsoft Account Password Requirements
The password rules Microsoft documents for work and school accounts, what is known about personal accounts, and a live check of your password against them.
Type a password above to check it against these rules.
Also required, but not checkable here:
- - When changing it: not the same as the last password
Source: Microsoft Learn: Self-service password reset policies (Microsoft Entra ID) (checked 2026-10-06)
Checked in your browser. Your password is never sent or stored. Verify it
The Microsoft Account Password Rules
Microsoft work or school account (Entra ID) requires 8 to 256 characters, with at least 3 of the 4 character types, only a-z, a-z, 0-9, the listed symbols and spaces (no other unicode characters).
| Requirements | Microsoft work or school account (Entra ID) requires 8 to 256 characters, with at least 3 of the 4 character types, only a-z, a-z, 0-9, the listed symbols and spaces (no other unicode characters). |
|---|---|
| Recommendations | None published. |
| Maximum length | 256 characters |
| Also | When changing it: not the same as the last password |
| Source | Microsoft Learn: Self-service password reset policies (Microsoft Entra ID) (checked 2026-10-06) |
Services change their rules. If Microsoft work or school account (Entra ID)'s own sign-up or password form says something different, the form is right - and this page is out of date.
Personal Accounts and Work or School Accounts
"Microsoft account" covers two different things. A personal account is the one behind Outlook.com, Xbox and Windows sign-in at home. A work or school account is managed by an organisation in Microsoft Entra ID (formerly Azure Active Directory).
Microsoft documents the password policy for work or school accounts in Microsoft Learn: 8 to 256 characters, at least three of the four character types (lowercase, uppercase, numbers, symbols), no characters outside the listed set, and - when you change it - not the same as your last password. That is what the check above tests. For personal accounts Microsoft publishes no rules in its support articles, so they are not guessed here.
Microsoft's own security advice for personal accounts focuses on going passwordless - signing in with the Microsoft Authenticator app instead of a password. Where you keep a password, make it unique and long.
How to Create a Password Microsoft Account Accepts
The quickest way is to let a generator do it. "Generate a password that meets these rules" opens the password generator with every character type switched on and 16 characters - within Microsoft work or school account (Entra ID)'s limits and at or above NIST's 15-character baseline. The generator guarantees that each enabled character type appears, so the password meets type rules on the first try.
Then save it in a password manager rather than writing it down, use it for Microsoft Account only, and switch on two-factor authentication if Microsoft work or school account (Entra ID) offers it - see what 2FA is.
Microsoft Account Password FAQs
What are the Microsoft Account password requirements?
Microsoft work or school account (Entra ID) requires 8 to 256 characters, with at least 3 of the 4 character types, only a-z, a-z, 0-9, the listed symbols and spaces (no other unicode characters). The source is Microsoft Learn: Self-service password reset policies (Microsoft Entra ID), checked on 2026-10-06.
Does Microsoft Account require special characters?
Not always: a symbol is one of the 4 character types, and 3 of them are required.
Is there a maximum password length for Microsoft Account?
Yes: 256 characters. NIST asks services to accept at least 64 characters, so a long passphrase should normally fit.
Is a password that meets the Microsoft Account rules strong enough?
Meeting the rules only means the form accepts it. NIST's current guidance asks for at least 15 characters when the password is the only factor; Microsoft work or school account (Entra ID)'s minimum of 8 is below that. A generated password of 16 characters is far harder to guess than a word bent to fit the rules.
Is it safe to check my Microsoft Account password on this page?
The check runs in your browser: the password is not sent, saved or put in the address, and the field is cleared when you leave. Even so, you never need to type a real password into any website other than the service itself - checking a new password before you set it is the safer habit.
How often should I change my Microsoft Account password?
Change it when it may have been exposed - after a breach, a phishing attempt or a suspicious sign-in - not on a calendar. NIST says services shall not force periodic changes. A unique password and two-factor authentication matter more.
Do the same rules apply to a personal Outlook.com or Xbox account?
Microsoft does not publish the rules for personal Microsoft accounts in its support articles; the sign-up and change-password forms show them when you type. The rules on this page are the ones Microsoft documents for work or school accounts in Microsoft Entra ID.
Can a Microsoft work account password contain non-English letters?
No. Microsoft's Entra documentation lists Unicode characters as not allowed: letters A-Z and a-z, numbers, the listed symbols and spaces only.