Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Is it appropriate to display the warning message "Caps Lock is on" when focus shifts to Password field?

In gmail and yahoo I don't see it. So, what does the standard say?

share|improve this question
add comment

5 Answers 5

What standard? Standard for Safari, Mac, Windows, Chrome, w3c, iso ...?

Some browsers do this automatically as 'standard'.

Some websites add the functionality so it's available in all browsers.

But it's not always possible (in all browsers on all platforms) to detect that caps lock is on whilst visiting a website although there is a workaround that requires the user to have already entered some text (based on the premise that if the user presses A, but shift was not down at the time, then caps lock must be on).

There's no standard that says you should do this, but I believe it's generally (ie not 100%!) accepted as a good thing to have, as its usefulness outweighs its existence.

share|improve this answer
    
Good answer, but I don't really understand "its usefulness outweighs its existence". What do you mean by that? Did you mean another word where you have existence? That would seem to make more sense to me. –  Charles Boyung Jul 11 '11 at 17:39
2  
sorry - I was going to use the term 'cognitive load' but inadvertently ended up using something less meaningful and didn't really finish the sentence properly :-) My point there was that if and when you do happen to see this in action, then the chances are that it's going to be useful. You might deliberately have caps lock on when entering a password - but for those cases when you do (and therefore maybe see the warning as unnecessary), the occurrence of those situations is more than outweighed by the number of useful cases where you did not mean to have caps lock on. –  Roger Attrill Jul 11 '11 at 17:49
    
That's what I thought you meant, and that's my thoughts on it exactly. –  Charles Boyung Jul 11 '11 at 17:53
    
@Roger @Charles How about "its utility outweighs its cost (in cognitive load)"? :) –  Patrick McElhaney Jul 14 '11 at 17:26
add comment

I haven't heard of a standard either, but I really like the way it is done in Mac OS X. It is very clear.

Caps lock on OSX password

In Windows, there's a warning text message. While this might be easier to understand, it is more obtrusive.

share|improve this answer
13  
There's a reason it is more obtrusive. That little icon in Mac OS means absolutely nothing to me as a user. The warning message in Windows is much better because it stands out. Caps lock is something that many people don't notice because in general, they aren't observant of the little things. That icon is another example of a "little thing". –  Charles Boyung Jul 11 '11 at 17:38
3  
+1, and the Windows message (if you mean the one at logon) only appears when the password is false, which is good imho because there are cases where the usage of caps lock is intended by the user (e.g. if his password only contains uppercase letters). –  wildpeaks Jul 12 '11 at 9:53
1  
But the Mac OS X (it didn't exist in Mac OS in the 90s) way is an idiomatic interface pattern. First time you see it you have to understand it, but most people do by trying, and then it will never bother you again, just help you. The Windows way is disturbing me every time. –  Martin Christensen Jul 12 '11 at 13:23
2  
Most people don't leave CAPSLOCK on very often, so it really doesn't annoy them very much. –  DJClayworth Jul 12 '11 at 21:59
1  
@Matt - nope, the windows way appears as soon as you hit the password field with capslock on - I just checked Windows 7, Vista and Server 2008. And that is not a very good icon at all, because I had to zoom in quite a bit to be able to tell that was an arrow and not an exclamation mark. The fact that it is not clear is more evidence that it is not a good indicator. –  Charles Boyung Jul 13 '11 at 18:05
show 8 more comments

You might want to do this, but only if the user has guessed his password wrong once already -- I believe this is how Windows normal login works, or worked at some point, at least. This way, you can protect users who use the caps lock key to type in their passwords (intentionally) from people with wandering eyes.

share|improve this answer
add comment

Instead of displaying a warning when Caps-Lock is on you could switch the letters if the first password fail first checking pASSWORD1234 and then Password1234 allowing the user to login as the user did input the right password, just mistakenly with a locked in modifier.

As Patrick McElhaney's edit to this answer clarified I'm not at all suggesting we should make our passwords case-insensitive. pASSWORD1234 would work, PASSword1234 and PassworD1234 would not.

The reason why this isn't really less secure is that for starters you would simply hash both pASSWORD1234 and Password1234 and check if they match your salted, crypto-strength hashed password in your database.

We are essentially giving the users 2 guesses per 1 input, but that doesn't mean this approach is vulnerable to brute forcing as the chance of guessing someones password after 100 attempts is minuscule to begin with. After you've had a large amount of bad guesses you would normally lock the user out either way.

share|improve this answer
2  
So, let's make passwords less secure as a way to get around capslock? Sorry, but no. –  Charles Boyung Jul 13 '11 at 17:40
    
@Patrick, I think what Charles was saying was that in secure password management systems, the service provider doesn't actually know what the password is, only the hash of the password. (This is why well-designed services will let users who forget their password reset their password, rather than email it to them; you can't mail what you don't have.) Implementing your idea would mean going against a major security best practice. –  Anirvan Jul 13 '11 at 21:43
    
@Anirvan That doesn't matter. The client would hash two versions of the password and try each of them. . –  Patrick McElhaney Jul 13 '11 at 21:51
    
@Patrick, that makes sense, I guess. It's still a lot of work to do at any scale, and increases the chance you'd mess something up on the security side (because you couldn't rely on standard pre-built authentication frameworks anymore). –  Anirvan Jul 14 '11 at 18:47
1  
@Anirvan - In anything I know I would just ask it to do login(password) and then login(invert(password)) to see which works. Alternatively wrap the default login which is about as much work. I'm not sure what it would be a lot of work to implement in. –  Kit Sunde Jul 15 '11 at 3:09
add comment

It really depends on your users in my opinion. If you are seeing a lot of users have multiple views on he login page, or if it's possible in your system, the validation error message page more than what you would expect then there may be something holding them back from logging in. It could be the caps lock or it could be something else.

I would look at your stats, and then decide if you are going to implement something. If you do go with the caps lock approach, implement it and then review stats again for a month or so and see if the hits on the pages has reduced to be closer to the unique visits. If it has increased or unchanged (which with this change I would think it would decreases) then maybe the caps lock solution isn't helping and another change is required.

I guess all I am saying is that if you are going to do this incremental changes that may or may not be a web standard then benchmark your stats first and then review.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.