Your Windows password is the code you type to unlock your computer after it starts up

A Windows password is a string of characters — letters, numbers, symbols — that you create to prevent other people from using your computer. When you turn on your machine or wake it from sleep, Windows asks for this password before letting you access your files, programs, or settings. It is the first line of defense between your data and someone else sitting down at your keyboard.

This is different from passwords you use for websites, email accounts, or online services. Your Windows password lives on your computer itself. It does not get sent to Microsoft or stored in the cloud unless you specifically set up a Microsoft account login. If you set up a local account instead, the password stays entirely on your machine.

Key Takeaways

  • Your Windows password is the code you enter when your computer starts or wakes up, not a password for a website or online service.
  • You can create a local account password that stays only on your computer, or use a Microsoft account password that syncs across devices.
  • A strong password uses a mix of uppercase letters, lowercase letters, numbers, and symbols, and is at least 12 characters long.
  • If you forget your Windows password, you can reset it using a password reset disk, another admin account, or your Microsoft account recovery options.
  • Windows stores your password in encrypted form and does not display it on screen when you type it.

Local accounts versus Microsoft accounts

When you set up Windows, you choose between two types of accounts. A local account is one that exists only on your computer. You create a username and password, and Windows stores that password on your hard drive in encrypted form. No one else can access it unless they have physical access to your machine and know how to break encryption — which is not trivial.

A Microsoft account uses your email address and a password you manage through Microsoft's website. When you sign in with a Microsoft account, Windows syncs your settings, files, and preferences across any device where you log in with that same account. Your password is stored on Microsoft's servers, not just on your computer. This is useful if you own multiple Windows machines, but it also means your password is transmitted over the internet each time you sign in.

Most people use a Microsoft account because it ties into OneDrive, the Microsoft Store, and cloud backup. But if you prefer to keep everything local and offline, a local account works just as well for everyday use.

What makes a strong Windows password

Windows does not force you to use a strong password, but it should. A weak password — like your name, your birth year, or "password123" — can be guessed or cracked in seconds by someone with basic tools. A strong password is harder to guess and takes much longer to crack by brute force.

A strong Windows password includes uppercase letters, lowercase letters, numbers, and symbols. It is at least 12 characters long, and it does not contain your username, your real name, or common words. Examples of strong passwords: Tr0pic@lSunset#2024, BlueMoon$Whisper99, or Granite7!Compass&Fox. Examples of weak passwords: password, 123456, qwerty, YourName2024.

The longer and more random your password, the better. If you struggle to remember a complex password, consider using a password manager — a program like Bitwarden, 1Password, or KeePass that stores and fills in passwords for you. You only have to remember one strong master password to unlock the manager.

Where Windows stores your password

Windows does not store your password in plain text. Instead, it converts your password into a long string of characters called a hash using a mathematical function that only goes one direction. When you type your password at the login screen, Windows hashes what you typed and compares it to the stored hash. If they match, you are in. If they do not match, Windows locks you out.

This means even Microsoft employees cannot see your password. If you forget it, they cannot tell you what it is — they can only help you reset it, which creates a new password.

For a local account, the hash is stored in a file on your hard drive that only the Windows system can read. For a Microsoft account, the hash is stored on Microsoft's servers. In both cases, the actual password is never written down anywhere in a form that a person could read.

How to change your Windows password

If you want to change your password to something new, the steps depend on whether you use a local account or a Microsoft account.

For a local account: Open Settings, go to Accounts, then select Sign-in options. Under Password, click Change. Windows will ask you to type your current password, then your new password twice. Click Next, then Finish.

For a Microsoft account: Open Settings, go to Accounts, then select Sign-in options. Under Password, click Change. Windows will ask you to verify your identity — usually by sending a code to your email or phone. After you verify, you can create a new password. This new password will work on any device where you sign in with that Microsoft account.

You can also change your Microsoft account password directly on Microsoft's website without opening Windows at all. Go to account.microsoft.com, sign in, and look for Security or Password settings.

What to do if you forget your Windows password

If you forget your password, your options depend on what type of account you have and what you set up beforehand.

For a Microsoft account, click "I forgot my password" on the login screen. Windows will ask you to verify your identity using your phone number or recovery email. Microsoft will send you a code, you enter it, and then you can create a new password. This works as long as you still have access to the email address or phone number you registered with.

For a local account, the process is harder. If you created a password reset disk before you forgot your password, you can use it now. Plug in the disk, click "Reset password" on the login screen, and follow the prompts. If you did not create a reset disk, you will need another admin account on the same computer to reset the password. If no other admin account exists, you may need to reinstall Windows, which erases everything on your drive.

This is why it is worth creating a password reset disk for a local account as soon as you set it up. Go to Settings, Accounts, Sign-in options, and look for Password reset disk or Recovery options.

Why Windows asks for a password at all

Your Windows password is the main barrier between your private files and someone else. Without it, anyone who sits down at your computer can read your documents, access your email, see your browsing history, or install malware. If your computer is stolen, a password makes it much harder for a thief to use it or sell it.

A password is not perfect security — someone with physical access to your computer and enough time can sometimes break in — but it stops casual access and slows down determined attackers. Combined with encryption and other security features, a strong password is one of the simplest and most effective things you can do to protect your data.

Frequently Asked Questions

Can I sign into Windows without a password?

Yes. You can set up Windows to sign in automatically, or use Windows Hello — a feature that lets you unlock your computer with your face, fingerprint, or PIN instead of typing a password. However, this is less find than a password, especially if your computer is in a shared space or could be stolen.

What is the difference between my Windows password and my Microsoft account password?

If you use a local account, your Windows password is separate from any Microsoft account you own. If you use a Microsoft account to sign into Windows, your Windows password and your Microsoft account password are the same thing. Changing one changes the other.

Can I see my Windows password after I create it?

No. Windows hides your password as you type it and does not display it anywhere. This is intentional — it prevents someone looking over your shoulder from seeing what you typed. If you forget it, you cannot recover it; you can only reset it to something new.

Is my Windows password sent to Microsoft?

Only if you use a Microsoft account. With a local account, your password never leaves your computer. With a Microsoft account, your password is transmitted to Microsoft's servers over an encrypted connection when you sign in, but Microsoft does not store the password itself — only a hash of it.

What should I do if I think someone knows my Windows password?

Change it when ready using the steps above. If you use a Microsoft account, also check your account security page at account.microsoft.com to see if anyone has signed in from an unfamiliar location. Consider enabling two-factor authentication, which requires a code from your phone in addition to your password.