Home / Outlook & Hotmail Help / Forgot password

Password & recovery

Forgot Your Hotmail or Outlook Password?

Two different processes solve this, and picking the wrong one wastes hours. Which you need comes down to a single question: can you still reach a recovery contact?

By the MailFixly Editorial Team✓ Fact-checkedUpdated August 15, 2026

Quick answer

Go to account.live.com/password/reset on the provider's own site, enter your address, and choose a verification method you can still reach right now. If a code arrives, you are back in within about two minutes.

You can receive the code. Reset it and you are done.
You cannot receive the code. The reset page is a dead end. You need the account recovery form instead, and it is judged on how much you can prove.
The password is right but rejected. This is not a forgotten password at all. See the sign-in guide.

Thirty-second test: can you open the inbox, or read the texts, on the recovery contact Microsoft has on file? If yes, use the reset page. If no, skip straight to the recovery form and stop spending attempts on a page that cannot help.

Key takeaways

Resetting and recovering are two different processes with very different odds.
The recovery form is scored automatically, not reviewed by a person. Detail beats persistence.
Requesting code after code invalidates each previous one, which is why the process often looks broken when it is working.
Microsoft never restores account access by phone. Anyone offering to is defrauding you.

Which situation are you actually in?

Almost everyone who searches for a forgotten password lands on the same reset page, and for a large share of them that page cannot help at all. The route that works depends entirely on whether you still control a recovery contact.

What is true for you	Correct route	Realistic outcome
You can open the recovery inbox, or receive texts on the recovery phone	Password reset page	Back in within minutes
Recovery contact is an old address, or a number you no longer have	Account recovery form	Depends entirely on the detail you supply
You have an authenticator app on the account	Reset page, choose the app	Back in within minutes
Password is accepted, then the page bounces you back	Not a password problem	See the sign-in guide
A message says the account is locked or blocked	Clear the lock first, reset second	Order matters, see below

Check the address itself before anything else. A surprising share of forgotten-password cases are really the wrong username. Hotmail, Outlook, Live and MSN addresses all sign in through the same system, so [email protected] and [email protected] are separate accounts even if you only ever believed you had one.

Resetting when you can receive the code

This is the straightforward path. It takes about two minutes, and the only thing that commonly goes wrong is the code arriving somewhere you are not looking.

Open the official reset page. Type account.live.com/password/reset into the address bar yourself. Do not reach it through a link in an email, however genuine that email looks.
Enter the full email address. Include the domain exactly as it is, whether that is hotmail.com, outlook.com, live.com or msn.com.
Pick a method you can reach right now. The page lists partially masked options, such as the last two digits of a phone number. Choose the one you can actually open in the next few minutes, not the one you would prefer to use.
Retrieve the code and enter it. Codes expire quickly. If nothing arrives within about five minutes, check junk and spam first, then request one more.
Set a new password. It cannot match recent passwords on the account. Update it on every device that signs in automatically, or those devices will keep presenting the old one.

Do not request code after code. Each new request invalidates the one before it. People routinely enter a code that has already been superseded, conclude the reset is broken, and abandon a process that was working correctly.

What if the verification code never arrives?

Before concluding the recovery contact is unreachable, rule out the ordinary causes, in the order they usually turn out to be responsible:

It went to spam. Verification mail from an account provider is filtered far more often than people expect.
The recovery address is one you stopped checking. The masked hint shows only a few characters, so an old address can look like a current one.
The number belongs to a phone you no longer use. A number kept through a port still works. A number that lapsed does not.
Carrier filtering. Some networks silently drop automated short codes, particularly on prepaid plans and while roaming.
You are looking at the wrong account. If you hold more than one address, the code may have gone to a different account's recovery contact.

If none of those apply, the reset page genuinely cannot help you, and further attempts achieve nothing. Move to the recovery form.

The account recovery form, and how to actually pass it

The recovery form exists for people who cannot verify by any normal method. It is not a verification step. It is a scored questionnaire, and an automated system decides whether the answers look like the real owner. That single distinction explains almost every frustrating outcome people report with it.

You are asked for things only the owner would plausibly know: addresses you have emailed recently, subject lines of messages you sent, folder names you created, roughly when you opened the account, and billing details if a subscription was ever attached.

Fill it in from a device and location you have used before. A familiar device and network are themselves signals. Submitting from a brand-new device on an unfamiliar connection makes an otherwise strong submission look weaker than it is.

Gather details before you start. Old messages you sent from the account, names of people you wrote to, anything carrying a date. Guessing under time pressure is what sinks most submissions.
Answer everything you can, even approximately. Blank fields score nothing at all. An approximate date scores better than no date.
Give a working contact address for the result. The decision is sent there, so it must be something you can open.
Wait for the response. A decision typically arrives within about 24 hours. Submitting again while you wait does not speed it up.
If rejected, submit again with more detail. Repeat attempts are allowed and are scored independently, so a second attempt carrying genuinely new information can succeed where the first failed.

Why was my recovery request rejected?

A rejection is not an accusation. It means the answers did not clear a confidence threshold. The usual reasons, and what to do differently:

Likely cause	What to change next time
Too many fields left blank	Answer every field, approximating where you must
Contacts and subject lines were guessed	Recover real examples from another mailbox that corresponded with the account
Submitted from an unfamiliar device or network	Use a device and connection the account has signed in from before
The account is dormant, with little history to describe	Lean on creation date and original setup details instead
Repeated near-identical submissions	Add genuinely new information rather than resending the same answers

There is a real end point, and we would rather say so. If several well-prepared attempts fail, the account may simply not be recoverable. At that stage the useful move is to protect what still depends on the address: change the contact address on your important accounts, tell the people who write to you, then set up a fresh account and move across.

What if the account is locked rather than forgotten?

These two look alike on screen and are handled completely differently. A lock is a protective state applied after unusual activity, and resetting the password will not clear it. Clear the lock first, then reset if you still need to.

The wording is the signal. A message about the account being locked, blocked or temporarily suspended is a lock. A message that the password is incorrect is not. The sign-in guide covers lock states in full, including the retry behaviour that quietly extends them.

Making sure this does not happen again

Once you are back in, ten minutes of setup removes most of the risk of a repeat. The recovery form is only ever needed because the easy routes were unavailable.

Do not plan around a phone number. Microsoft states that "for increased security, you can no longer add a phone number" as a verification method, and that it has begun phasing out SMS for authentication and account recovery on personal accounts. Numbers already on your account may still work for now, but a phone is no longer something you can add, and it is not a method to rely on. Most guides still tell you to add one. That advice is out of date.

The methods you can actually add today are an email address, an authenticator app, and a passkey using your face, fingerprint or device PIN. You can hold up to ten in total.

Add two methods, not one. An authenticator app plus a second email address, so losing one is not losing access.
Set up the authenticator app first. It works without signal and without carrier filtering, which removes the two most common delivery failures, and it is unaffected by the SMS phase-out.
Add a passkey if your device supports it. There is no code to deliver, intercept or miss.
Check your recovery email once a year. Recovery contacts go stale silently. Nothing tells you the address on file stopped working two years ago.
Sign in occasionally. Dormant accounts have thin history, and history is exactly what the recovery form scores.
Use a password manager. The most reliable fix for a forgotten password is never having to remember it.

Sources

Microsoft: How to reset your Microsoft account passwordThe reset flow described above.
Microsoft: Security info and verification codesWhich verification methods can be added, and the statement that phone numbers can no longer be.
Microsoft: Troubleshoot verification code issuesOfficial guidance for codes that never arrive.
Microsoft: Help us secure your accountWhat the account recovery form is and how it is assessed.

Frequently Asked Questions

Can I recover a Hotmail account without a phone number or recovery email?

Yes, through the account recovery form, but the outcome depends on how much account detail you can supply. The form is scored automatically rather than reviewed as proof of identity, so specific, accurate answers matter far more than the number of attempts.

How long does Microsoft account recovery take?

A decision on the recovery form usually arrives within about 24 hours, sent to the contact address you supplied. A straightforward password reset using a verification code is immediate. Submitting the form repeatedly while waiting does not speed it up.

Does resetting my password sign me out everywhere?

Yes. Every device using the old password stops working until you update it, including phone mail apps and desktop clients. Update them promptly, because devices retrying an old password can trigger a temporary block on the account.

Why does it say my password is incorrect when I know it is right?

That is usually not a password problem at all. The common causes are signing in to a different address than you think, a cached password on the device, or an account in a protective lock state. Our sign-in guide covers each cause separately.

Is there a phone number I can call to recover my account?

No. Microsoft does not restore account access over the phone, and any site or caller offering to do so for a fee is fraudulent. Recovery happens only through the official web forms. MailFixly cannot recover accounts either; we are an independent publisher with no access to any provider system.

What happens to my email if I can never recover the account?

The mailbox stays with the account and cannot be transferred out. Change the contact address on any service still pointing at it, tell the people who write to you, and set up a new account. Microsoft eventually closes accounts that stay inactive.

Why You Can Trust This Guide

MailFixly publishes plain-English fixes for email account problems. Every step is checked against the provider's current process and updated when their interface changes.

Independently written. Not affiliated with, endorsed by, or sponsored by Microsoft.
No credentials collected. Always sign in on Microsoft's own pages, never on a third-party form.
Reviewed before publishing and at every update. See our editorial policy.
Last reviewed: August 15, 2026.