Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Most websites that I have seen don't warn users when they type their passwords with capslock on. Given that it is possible to implement that function, why is this not a common practice?

share|improve this question
    
That's very clever. I imagine more sites don't do it because it doesn't occur to them to figure out how to do it. –  staticsan Jul 30 '12 at 2:43
add comment

4 Answers

up vote 34 down vote accepted

It is not a common practice because, sadly, most of the web developers aren't actually concerned about the user experience and improving it.

One interesting approach, besides warning the user about the caps lock, is Facebook's "case insensitive" system.

Facebook actually accepts three forms of your password:

  1. Your original password.
  2. Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.
  3. Your original password with the case reversed, for those with a caps lock key on.
share|improve this answer
5  
+1 Interesting, I didn't know that. I really like that approach since it is designed around avoiding the pitfalls for a user who knows their password. –  AndroidHustle Jul 30 '12 at 8:56
4  
@AndréParamés Not necessarily - it'd be easier to modify the unhashed password and compare the N versions to a single hash in the database. –  Juhana Jul 30 '12 at 11:46
2  
Please note that by following Facebook's approach, you are weakening your password encryption scheme. If you take Juhana's approach, for instance, you are eliminating 26 characters (lowercase a to z) from the realm of possibilities for brute-forcing a password. It's best to just let the user know their caps-lock is on. –  Omer van Kloeten Jul 30 '12 at 21:24
1  
@mciarrocchi I think Facebook has some very smart people who know how to protect their data and I know most places don't know how to protect their own data, so I can not possibly, in good conscience, recommend that course of action. Best practices are there for a reason and when you break one, you better have a damned good reason. –  Omer van Kloeten Jul 31 '12 at 5:39
11  
@OmervanKloeten That's not correct since Facebook does not allow any combination of upper/lower case, but only the exact reverse and one more form. Their approach only eliminates 1 character (the lower/uppercase pendant of the current character) and 26 characters for the first character. This impact is negligible when brute-forcing. –  Pascal Jul 31 '12 at 14:10
show 4 more comments

While it is true that many sites and applications don't use the capslock capture, the idea has been around for years (especially amongst enterprise level applications).

Regarding your question whether it's a good idea or not, let me ask a question back:

Is it good UX to help the user avoid a fail state?

My answer would be yes.

share|improve this answer
add comment

Some browsers (at least Safari, Chrome and IE10) have the feature built-in. If you have caps lock on when you're typing a password, they show an icon in the password field.

Caps lock warning icon in Chrome

The feature works in every web site without them having to implement it separately (<input type="password"> in HTML).

share|improve this answer
4  
That's an easy place to overlook, assuming a LTR layout. The logical place would be left, before the cursor, where people actually look. "Hey, why is there a thing where my cursor should be?". –  MSalters Jul 30 '12 at 13:24
    
I do not see this live in IE11 at all, on any password fields. Never seen it in Chrome either. Not sure where you found it? Or maybe it's just Safari? –  Jeff Atwood 22 hours ago
    
@JeffAtwood Maybe it's OS X specific. –  Juhana 22 hours ago
add comment

It is good practice to warn that CAPSLOCK is enabled because user with enabled capslock will try to enter same password each time until he notice enabled capslock. If the user cannot see what he is typing it would be good to warn user about CAPSLOCK enabled, about current keyboard language and about last typed letter.

But the easier way to avoid errors while entering password is just to unmask the password at all.

Jacob Nilsen about stop masking the password:

  • Users make more errors when they can't see what they're typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business. (Or, in the case of intranets, increased support calls.)
  • The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security.

So the best practice for user is just unmasking the password.

There is a WordPress plugin which unmasks password field. So you may try it if you want to.

share|improve this answer
1  
While you make a good point (and I agree that password masking is possibly and outdated and low-usability prospect) your point doesn't really fit with this question. The OP is asking why CapsLock detection isn't more commonly used; this answer does not cover this at all. –  JonW Aug 1 '12 at 20:24
    
thanks for your remark. I updated my answer. I hope now my point about passwords is more clear and I answered the question better. –  webvitaly Aug 2 '12 at 7:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.