How to Reset Your Outlook.com Password

How difficult this is depends entirely on what you still have access to. If you know your password and just want a new one, it takes a minute. If you are locked out with no working phone or backup address, you are facing Microsoft's recovery process — and it is worth understanding what that can and cannot do before you spend a week on it.

Everything here applies equally to @outlook.com, @hotmail.com, @live.com and @msn.com addresses. They are all Microsoft accounts.

If you know your current password

1. Sign in to your Microsoft account.

2. Open your account security settings.

3. Choose to change your password.

4. Enter the current password, then the new one twice.

You may be asked to verify your identity first, even though you are already signed in. That is normal for a password change.

If you are locked out

1. On the sign-in page, enter your email address, then select Forgot password?

2. Choose a way to verify your identity — a code by text, or to a backup email address.

3. Enter the code you receive.

4. Choose a new password.

That works for most people, and is the end of it. The sections below are for when it does not.

If you do not recognise the verification options

Sometimes the reset page offers to send a code to a phone number or address you do not recognise — an old number, or one an attacker added.

If two-step verification is not switched on for your account, Microsoft's Sign-in Helper is the tool for this. It looks at the account, identifies the common problems, and either guides you through a reset or hands you to the recovery form.

Try the Sign-in Helper before the recovery form. The form is long, and the helper often resolves things without it.

The account recovery form

When no verification method works, the recovery form is the route. It is a set of questions designed so that only the real owner can answer them — old passwords you have used, contacts you email often, subject lines of recent messages, billing details if you have ever bought anything from Microsoft.

Microsoft reviews the answers and sends the result within 24 hours to whatever working email address you provide at the start.

Filling it in so that it works

People often submit the form three or four times and get rejected each time, because the things that actually matter are not obvious.

• Use a device and network you have used with the account before. Familiarity is weighed heavily. The same laptop on your home connection is materially better than a new device elsewhere.

• Answer everything you can, and guess rather than skip. A wrong guess is not fatal. A blank contributes nothing.

• Old passwords carry weight. List every one you can remember having used, even from years ago.

• Be specific about contacts and subject lines. Exact addresses of people you email regularly, and real subject lines from recent messages, are strong evidence.

• Attempts are limited to roughly two a day. Do not fire off repeated submissions — beyond the limit, you risk a temporary lockout. Take time over each one.

The situation Microsoft cannot fix

This needs saying plainly, because a great deal of published advice avoids it.

If you turned on two-step verification and you have lost access to every second-factor method — phone, backup email, authenticator app, security key, recovery code — then Microsoft's own documentation says: "we cannot help you, sorry."

The recovery form does not apply in that case. Support agents cannot override it. There is no escalation, no special department, no phone number that changes the answer. Two-step verification exists precisely so that possession of the password is not enough — and that protection cannot be selectively removed for the account owner without removing it for everyone.

If that is your situation, the practical step is to create a new account and contact Microsoft about transferring any subscriptions or purchases attached to the old one. That is a poor outcome, but it is the real one, and knowing it early saves weeks of attempts that were never going to succeed.

Beware of fake Microsoft support

People locked out of email are heavily targeted by scams, and this is exactly where they appear.

Microsoft's documentation is unambiguous: support agents are not allowed to send password reset links or to access and change account details. So anyone who offers to reset your password, restore your account, or "escalate" it for you is not Microsoft — regardless of what their page looks like or how convincing the caller sounds.

If a page about account recovery displays a phone number to call, treat it as a scam. If anyone asks you to read out a security code, stop immediately. That code is the account.

After you get back in

The 30-day restriction

If you changed security details through recovery, the account is typically restricted for around 30 days before you can remove old verification methods. It is a deliberate hold, it cannot be shortened, and it exists so that an attacker who gets through recovery cannot immediately lock out the real owner. Frustrating if it is you; valuable if it is not.

Tidy up your security information

Once you are in, and once any restriction has passed:

• Add at least two current ways to verify — a phone number and a backup address.

• Remove anything you do not recognise, especially if you suspect the account was accessed by someone else.

• Generate a recovery code and store it away from your phone. It is a single code that gets you in when everything else fails, and it is the difference between an inconvenience and a permanent loss.

Update your other devices

Changing the password signs you out elsewhere. Any mail client, phone or tablet using the account will ask for the new one before it syncs again.

If someone else has your account

If mail is being sent that you did not write, or your security details have changed without you, work quickly. Reset the password if you still can, then remove every verification method you do not recognise. If the attacker has already changed the recovery email and switched on two-step verification, honesty compels the same answer as above: recovery may no longer be possible.

This is the strongest argument for setting up recovery properly while you still can. Every one of these paths is decided by what was in place before anything went wrong.