Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

A lot of sites today don't have a username, just a "login email".

If a user opened an account as foo@mymail.com, and are now trying to login using FoO@mYmAiL.cOm - should we accept this login as true? Should we just convert the email to lower case before storing and validating it?

share|improve this question
add comment

4 Answers

up vote 12 down vote accepted

Yes, you should accept it as a login but internally lowercase it to rule out matching problems in your database and to ensure you don't have unintended duplicates. If the user makes a typo or simply prefers to write FirstnameSurname@gmail.com, why not go ahead and let them? It doesn't affect you if you don't let it. :-)

Gmail does something similar. You can register an email address with a . in it and Gmail just ignores that for its internal email address. So you can get Firstname.Surname@gmail.com and that's effectively the same email address as FirstnameSurname@gmail.com. Back in 2004 when Gmail launched, I found this to be an especially user friendly feature of their email service and few competing services have yet to implement it themselves.

The important lesson here is that you shouldn't allow your internal application architecture to surface to the end user unless it benefits them in someway. If you can keep it invisible, do it.

Edit: concerning case sensitivity, here's what About.com has to say:

But Case Typically Does Not Matter

Since the case sensitivity of email addresses can create a lot of confusion, interoperability problems and widespread headaches, it would be foolish to require email addresses to be typed with the correct case. Hardly any email service or ISP does enforce case sensitive email addresses, returning messages whose recipient's email address was not typed correctly (in all upper case, for example).

This means that

  • it does not typically matter what case you type an email address in when you send a message (If the recipient did give you an email address with distinct case, preserve it, however.)
  • and you should always only use lower case characters when creating a new email address to rule out any confusion.

So if you want to comply with the email RFC, don't follow my advice. If you know what email addresses will be used in your system (for instance, for an intranet for your company), I would just lowercase everything.

share|improve this answer
    
From a pure 'User Experience' point of view I would totally agree. Otherwise you'll have to label all the email fields with 'Caution: This is CASE SENSITIVE' and other such instructions that would annoy the user. Also, I believe that RFC 5321 is trying to discourage sensitivity of case anyway: tools.ietf.org/html/rfc5321: "However, exploiting the case sensitivity of mailbox local-parts impedes interoperability and is discouraged. Mailbox domains follow normal DNS rules and are hence not case sensitive." –  JonW Feb 3 '12 at 9:03
    
Case is rarely a matching issue in databases; every common SQL engine comes with case sensitive matching off by default. There's still no reason I can imagine to store it case sensitive though; for displaying the email I'd just always lowercase it and not sweat what the user enters in though. –  Ben Brocka Feb 3 '12 at 14:39
1  
Why lowercase the email? If you need to show it you would not be displaying the case that they recognise. According to your own reasoning you should keep your functionality invisible, so why not store the case they entered but make your checks (and uniqueness) case insensitive? –  JamesRyan Sep 27 '13 at 9:47
add comment

Sounds like this question has mixed results. The de facto standard is to treat local mailboxes as case insensitive, but the official standard says case matters (though even the official standard mentions the de facto standard).

As other people have pointed out, it is possible that Steve@example.com and steve@example.com are two different people, and both of them want to use your site. But on the other hand, it is far more likely that Steve@example.com and steve@example.com are in fact the same person. If they type it one way one time, and another way another time, you probably want to let them in either way.

I'd suggest keeping track of both. Since using case insensitivity is so widespread, take their sign up email address and make it lower case. Whenever they try to log in, convert that to lowercase as well, for comparison purposes, when you go to see if the user exists. As far as sign up and sign in go, do a case insensitive comparison. If the person signs up as Steve@example.com, you'll still want to allow them to sign in later with steve@example.com or sTeVE@example.com.

But you should also keep track of the email address that they signed up with in a case sensitive fashion. Any time you send an email to them, be sure to send it with that original casing. This allows the email server to handle it however it feels like it needs to. So even though the person may always be signing in to your site with steve@example.com, if they signed up as Steve@example.com, you'll always send email to Steve@example.com, just to be safe.

Some day, the de facto standard and the official standard will hopefully be the same. It's too bad we have to deal with this issue at all.

A couple of related side notes. The domain name (after the '@' sign) is always considered case insensitive, so you can always treat that in the same way. Second, just as important as the case sensitivity issue, you want to also be sure your site accepts all legal email addresses, which includes allowing all symbols that are allowed in email addresses. It is really frustrating for users who enter their legal email address, only to have the system say "the character '!' is not allowed." The standard defines what is allowed, but Wikipedia also has a good summary of this.

share|improve this answer
add comment

No. The local part of an email address must be treated as case-sensitive.

For example, smith@case-sensitive.com and SMITH@case-sensitive.com could specify different mailboxes. If you converted the email to lower case, SMITH@case-sensitive.com would be unable to use your site. Also, if a smith@case-sensitive.com mailbox existed, it would receive any emails your site should have sent to SMITH@case-sensitive.com.

After SMITH@case-sensitive.com had created an account, one could create a smith@case-sensitive.com email account at the same mail service and use a password reset to use SMITH@case-sensitive.com's account at your site.

share|improve this answer
5  
Technically true although it also goes on to say However, exploiting the case sensitivity of mailbox local-parts impedes interoperability and is discouraged. Thus providing case insensitivity would be the desirable course of action, while enforcing the case sensitvity would be just unnecessary. –  Roger Attrill Feb 3 '12 at 9:13
    
@Roger Attrill See my edits about how one could reset the password of an account whose login/email address had upper case characters in a case-sensitive mail service. –  Artur Gaspar Feb 3 '12 at 9:33
    
This could be a good reason to reject the "login email" concept. Another would be that it enforces "one account per email" as a technical matter without considering whether this is a desired policy or not. –  Random832 Feb 3 '12 at 14:13
add comment

No

I would never do that -- cannot say all mail IDs are going to stay case-agnostic. At some point you may have to rework the logic, and anything else dependent on it, if things do change.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.