Most websites that I have seen don't warn users when they type their passwords with capslock on. Given that it is possible to implement that function, why is this not a common practice?

  • That's very clever. I imagine more sites don't do it because it doesn't occur to them to figure out how to do it.
    – staticsan
    Jul 30, 2012 at 2:43

4 Answers 4


It is not a common practice because, sadly, most of the web developers aren't actually concerned about the user experience and improving it.

One interesting approach, besides warning the user about the caps lock, is Facebook's "case insensitive" system.

Facebook actually accepts three forms of your password:

  1. Your original password.
  2. Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.
  3. Your original password with the case reversed, for those with a caps lock key on.
  • 5
    +1 Interesting, I didn't know that. I really like that approach since it is designed around avoiding the pitfalls for a user who knows their password. Jul 30, 2012 at 8:56
  • 4
    @AndréParamés Not necessarily - it'd be easier to modify the unhashed password and compare the N versions to a single hash in the database.
    – JJJ
    Jul 30, 2012 at 11:46
  • 2
    Please note that by following Facebook's approach, you are weakening your password encryption scheme. If you take Juhana's approach, for instance, you are eliminating 26 characters (lowercase a to z) from the realm of possibilities for brute-forcing a password. It's best to just let the user know their caps-lock is on. Jul 30, 2012 at 21:24
  • 1
    @mciarrocchi I think Facebook has some very smart people who know how to protect their data and I know most places don't know how to protect their own data, so I can not possibly, in good conscience, recommend that course of action. Best practices are there for a reason and when you break one, you better have a damned good reason. Jul 31, 2012 at 5:39
  • 12
    @OmervanKloeten That's not correct since Facebook does not allow any combination of upper/lower case, but only the exact reverse and one more form. Their approach only eliminates 1 character (the lower/uppercase pendant of the current character) and 26 characters for the first character. This impact is negligible when brute-forcing.
    – Pascal
    Jul 31, 2012 at 14:10

While it is true that many sites and applications don't use the capslock capture, the idea has been around for years (especially amongst enterprise level applications).

Regarding your question whether it's a good idea or not, let me ask a question back:

Is it good UX to help the user avoid a fail state?

My answer would be yes.


Some browsers (at least Safari, Chrome and IE10) have the feature built-in. If you have caps lock on when you're typing a password, they show an icon in the password field.

Caps lock warning icon in Chrome

The feature works in every web site without them having to implement it separately (<input type="password"> in HTML).

  • 4
    That's an easy place to overlook, assuming a LTR layout. The logical place would be left, before the cursor, where people actually look. "Hey, why is there a thing where my cursor should be?".
    – MSalters
    Jul 30, 2012 at 13:24
  • 1
    I do not see this live in IE11 at all, on any password fields. Never seen it in Chrome either. Not sure where you found it? Or maybe it's just Safari? Apr 15, 2014 at 20:56
  • @JeffAtwood Maybe it's OS X specific.
    – JJJ
    Apr 15, 2014 at 20:58

It is good practice to warn that CAPSLOCK is enabled because user with enabled capslock will try to enter same password each time until he notice enabled capslock. If the user cannot see what he is typing it would be good to warn user about CAPSLOCK enabled, about current keyboard language and about last typed letter.

But the easier way to avoid errors while entering password is just to unmask the password at all.

Jacob Nilsen about stop masking the password:

  • Users make more errors when they can't see what they're typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business. (Or, in the case of intranets, increased support calls.)
  • The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security.

So the best practice for user is just unmasking the password.

There is a WordPress plugin which unmasks password field. So you may try it if you want to.

  • 1
    While you make a good point (and I agree that password masking is possibly and outdated and low-usability prospect) your point doesn't really fit with this question. The OP is asking why CapsLock detection isn't more commonly used; this answer does not cover this at all.
    – JonW
    Aug 1, 2012 at 20:24
  • thanks for your remark. I updated my answer. I hope now my point about passwords is more clear and I answered the question better.
    – webvitaly
    Aug 2, 2012 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.