User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.
Sign up to join this community
A lot of sites today don't have a username, just a "login email".
If a user opened an account as [email protected], and are now trying to login using [email protected] - should we accept this login as true? Should we just convert the email to lower case before storing and validating it?
Yes, you should accept it as a login but internally lowercase it to rule out matching problems in your database and to ensure you don't have unintended duplicates. If the user makes a typo or simply prefers to write [email protected], why not go ahead and let them? It doesn't affect you if you don't let it. :-)
Gmail does something similar. You can register an email address with a . in it and Gmail just ignores that for its internal email address. So you can get [email protected] and that's effectively the same email address as [email protected]. Back in 2004 when Gmail launched, I found this to be an especially user friendly feature of their email service and few competing services have yet to implement it themselves.
The important lesson here is that you shouldn't allow your internal application architecture to surface to the end user unless it benefits them in someway. If you can keep it invisible, do it.
Edit: concerning case sensitivity, here's what About.com has to say:
But Case Typically Does Not Matter
Since the case sensitivity of email addresses can create a lot of confusion, interoperability problems and widespread headaches, it would be foolish to require email addresses to be typed with the correct case. Hardly any email service or ISP does enforce case sensitive email addresses, returning messages whose recipient's email address was not typed correctly (in all upper case, for example).
This means that
- it does not typically matter what case you type an email address in when you send a message (If the recipient did give you an email address with distinct case, preserve it, however.)
- and you should always only use lower case characters when creating a new email address to rule out any confusion.
So if you want to comply with the email RFC, don't follow my advice. If you know what email addresses will be used in your system (for instance, for an intranet for your company), I would just lowercase everything.
Sounds like this question has mixed results. The de facto standard is to treat local mailboxes as case insensitive, but the official standard says case matters (though even the official standard mentions the de facto standard).
As other people have pointed out, it is possible that [email protected] and [email protected] are two different people, and both of them want to use your site. But on the other hand, it is far more likely that [email protected] and [email protected] are in fact the same person. If they type it one way one time, and another way another time, you probably want to let them in either way.
I'd suggest keeping track of both. Since using case insensitivity is so widespread, take their sign up email address and make it lower case. Whenever they try to log in, convert that to lowercase as well, for comparison purposes, when you go to see if the user exists. As far as sign up and sign in go, do a case insensitive comparison. If the person signs up as [email protected], you'll still want to allow them to sign in later with [email protected] or [email protected].
But you should also keep track of the email address that they signed up with in a case sensitive fashion. Any time you send an email to them, be sure to send it with that original casing. This allows the email server to handle it however it feels like it needs to. So even though the person may always be signing in to your site with [email protected], if they signed up as [email protected], you'll always send email to [email protected], just to be safe.
Some day, the de facto standard and the official standard will hopefully be the same. It's too bad we have to deal with this issue at all.
A couple of related side notes. The domain name (after the '@' sign) is always considered case insensitive, so you can always treat that in the same way. Second, just as important as the case sensitivity issue, you want to also be sure your site accepts all legal email addresses, which includes allowing all symbols that are allowed in email addresses. It is really frustrating for users who enter their legal email address, only to have the system say "the character '!' is not allowed." The standard defines what is allowed, but Wikipedia also has a good summary of this.
No. The local part of an email address must be treated as case-sensitive.
For example, [email protected] and [email protected] could specify different mailboxes. If you converted the email to lower case, [email protected] would be unable to use your site. Also, if a [email protected] mailbox existed, it would receive any emails your site should have sent to [email protected].
After [email protected] had created an account, one could create a [email protected] email account at the same mail service and use a password reset to use [email protected]'s account at your site.
No
I would never do that -- cannot say all mail IDs are going to stay case-agnostic. At some point you may have to rework the logic, and anything else dependent on it, if things do change.
