Is it good practice to warn users that capslock is enabled when entering passwords?

Question

Most websites that I have seen don't warn users when they type their passwords with capslock on. Given that it is possible to implement that function, why is this not a common practice?

Answer 1

It is not a common practice because, sadly, most of the web developers aren't actually concerned about the user experience and improving it.

One interesting approach, besides warning the user about the caps lock, is Facebook's "case insensitive" system.

Facebook actually accepts three forms of your password:

1. Your original password.
2. Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.
3. Your original password with the case reversed, for those with a caps lock key on.

Answer 2

While it is true that many sites and applications don't use the capslock capture, the idea has been around for years (especially amongst enterprise level applications).

Regarding your question whether it's a good idea or not, let me ask a question back:

Is it good UX to help the user avoid a fail state?

My answer would be yes.

Answer 3

Some browsers (at least Safari, Chrome and IE10) have the feature built-in. If you have caps lock on when you're typing a password, they show an icon in the password field.

The feature works in every web site without them having to implement it separately (<input type="password"> in HTML).

Answer 4

It is good practice to warn that CAPSLOCK is enabled because user with enabled capslock will try to enter same password each time until he notice enabled capslock. If the user cannot see what he is typing it would be good to warn user about CAPSLOCK enabled, about current keyboard language and about last typed letter.

But the easier way to avoid errors while entering password is just to unmask the password at all.

Jacob Nilsen about stop masking the password:

• Users make more errors when they can't see what they're typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business. (Or, in the case of intranets, increased support calls.)
• The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security.

So the best practice for user is just unmasking the password.

There is a WordPress plugin which unmasks password field. So you may try it if you want to.