Why warn about caps lock for passwords, instead of ignoring caps lock for password characters?

Question

Many login screens warn the user if the caps lock key is switched on. Most prominently the windows login screen.

Does this offer any advantage compared to simply ignoring the caps lock key and detecting the key-presses for the password as if caps lock were disabled?

Why is the warning apparently best practice? Are there uses cases that require caps lock to work inside password fields? Is there a significant fraction of users that choose to enter a password with enabled caps lock?

---

The reason for the warning is apparent: Since the password characters are hidden, the user may not notice when caps lock is accidentally switched on, causing their login to fail.
There are ways to work around this, such as not hiding the password, or accepting multiple uppercase/lowercase variants of the password. These work even in situations such as web forms, where detecting caps lock state may be difficult.

But assuming that

• hidden characters and case-sensitive passwords are desired, and
• the target application is capable of detecting caps lock state

Why should I display a warning instead of silently solving the issue by disabling the caps lock functionality in password fields?

Answer 1

The core reason that you don't want to do this is because, as a general rule, any time you override the standard behavior of a users device, you open yourself up to a bad user experience . . . particularly if you do it without any kind of notification.

Overall, within your application, standard control behaviors should continue to behave the way that the user expects them to behave.

---

Now, in this case, the change would not likely be known, since the password generally stays masked, but, both technically and experientially, there are ways that it could become apparent.

Example 1: many new technologies are allowing you the "show password" when entering it. This would quickly expose the altered behavior (sans any explanation). Best case, this causes confusion, worst case, they conclude that their keyboard is broken.

Example 2: if a users password were "abc123XYZ", there may be times when the user were to use caps lock for the last 3 characters (e.g., on a mobile device) and others when they want to hold down the shift key (e.g., when using a full keyboard).

If the caps lock were suppressed when the password was created, there is potential that the password was actually set to "abc123xyz", without the user ever knowing it, because they expected the key to function normally. Best case, this causes confusion, worst case, their account gets locked due to too many "bad login attempts", despite having entered in what should have been the correct characters.

Answer 2

It's a good practice because any good UI should tell you of its current state; It's not so much of a warning, more of a notification.

Accepting multiple variants of the password is really bad; you're essentially reducing the complexity of the password.

By disabling caps lock you're taking control away from the user and the only reason seems to be just to not show that warning/notification.

Answer 3

EDIT: oops, I misunderstood the question.

You don't want to 'disable' Caps Lock because how exactly would you communicate to users that this mode is unachievable? Some users may not know how to use Shift to temporarily enforce uppercase, and may not be able to type their password anymore.

Besides, it seems unintuitive that a functionality of your keyboard becomes unavailable when using an input field on a website on a specific application. How would you go about programmatically disabling Caps Lock on the user's system, so that the keyboard's mode feedback is properly aligned? It would pose serious security issues if websites were able to do such things with JS code.

---

Old answer (offtopic)

Uppercase letters are distinct from lowercase ones in passwords because of a thing called password entropy, aka. the number of significant bits of information in a password. Having a larger alphabet of symbols to draw from increases the entropy of the passwords*.

By removing uppercase symbols, you would thus lower the security of your passwords. Because the caps lock switch is a mode that is maintained on its own without continuous user action, it is necessary to display feedback in situations where the user must be aware the mode is enabled in order to fulfil their task successfully.

---

(* this is an overly simplistic view, many people in security research miscalculate password entropies by not taking into account the relative probabilities of some symbols appearing at some positions of some passwords. Still, the general concept is that more characters to choose from lead to a potentially higher overall entropy of passwords)

Answer 4

The answer to this is that windows should accept the password if you enter it in the correct case, or, exactly the incorrect case (if CAPS is on).

e.g. abc123XYZ or ABC123xyz (if CAPS was on) would be accepted.

As a CAD user I often have caps lock on, and find it so annoying having to type the password twice because the machine hasn't been smart enough to realise - that caps lock is on - that I've typed my password correctly had caps lock been off

It's not rocket science.

Answer 5

SIMPLE SOLUTION: The Operating System simply need to recognize the CAP LOCK ON the whole time or OFF the whole time. Example: Correct password is abc123XYZ therefore ABC123xyz will be accepted (but abc123xyz will NOT be accepted).