Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With Facebook login, my password had a form of uppercase letters, lowercase letter and numbers. Not strong, but it did the job. For example


Recently, I was told by an acquaintance that I could do these as well


I have tried other combinations but they do not seem to work. Is there a reason Facebook allows these alternative passwords?

share|improve this question
+1 For "hunter2". bash.org/?244321 – FreeAsInBeer Sep 24 '14 at 15:40
up vote 62 down vote accepted

It's because of caps lock key on/off to prevent double entering password.

Per http://www.zdnet.com/blog/facebook/facebook-passwords-are-not-case-sensitive-update/3612

Facebook actually accepts three forms of your password:

  1. Your original password.

  2. Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.

  3. Your original password with the case reversed, for those with a caps lock key on.

The third case is the one I stumbled upon today. Wolens told me Facebook has had this implemented “for a while” although he couldn’t say for exactly how long. He also noted that Facebook doesn’t believe this impact the security of the user’s passwords, since the characters are still unique, just flipped.

share|improve this answer
Which is an enormous real-world problem, which I can attest to after having seen our support department deal with many issues related to this since our platform moved to case-sensitive passwords. – jlarson May 2 '12 at 21:10
@larson4 which could be OK, provided they store three hashes and never the original password to modify. I'd assume they store three hashes of the three forms of the password, per codinghorror.com/blog/2007/09/… – Jeff Atwood May 2 '12 at 21:14
@JeffAtwood: You only have to store one hash. Then compute three hashes for the password the user submits. If one of them matches, it's OK. – Andomar May 2 '12 at 21:34
@jeff I was not involved in the implementation, and was not aware of this technique. But then, though I am working on reading the entire Internet, I hadn't reached this Coding Horror post yet. – jlarson May 2 '12 at 21:56
@larson4 - Waitasecond. Your platform didn't have case-sensitive passwords before? – Kevin Vermeer May 2 '12 at 22:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.