60

With Facebook login, my password had a form of uppercase letters, lowercase letter and numbers. Not strong, but it did the job. For example

hunTer2

Recently, I was told by an acquaintance that I could do these as well

HunTer2
HUNtER2

I have tried other combinations but they do not seem to work. Is there a reason Facebook allows these alternative passwords?

Improve this question
1

2 Answers 2

Reset to default
64

It's because of caps lock key on/off to prevent double entering password.

Per http://www.zdnet.com/blog/facebook/facebook-passwords-are-not-case-sensitive-update/3612

Facebook actually accepts three forms of your password:

  1. Your original password.

  2. Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.

  3. Your original password with the case reversed, for those with a caps lock key on.

The third case is the one I stumbled upon today. Wolens told me Facebook has had this implemented “for a while” although he couldn’t say for exactly how long. He also noted that Facebook doesn’t believe this impact the security of the user’s passwords, since the characters are still unique, just flipped.

Improve this answer
8
  • Which is an enormous real-world problem, which I can attest to after having seen our support department deal with many issues related to this since our platform moved to case-sensitive passwords.
    – jlarson
    May 2, 2012 at 21:10
  • 1
    @larson4 which could be OK, provided they store three hashes and never the original password to modify. I'd assume they store three hashes of the three forms of the password, per codinghorror.com/blog/2007/09/…
    – Jeff Atwood
    May 2, 2012 at 21:14
  • 25
    @JeffAtwood: You only have to store one hash. Then compute three hashes for the password the user submits. If one of them matches, it's OK.
    – Andomar
    May 2, 2012 at 21:34
  • 1
    @jeff I was not involved in the implementation, and was not aware of this technique. But then, though I am working on reading the entire Internet, I hadn't reached this Coding Horror post yet.
    – jlarson
    May 2, 2012 at 21:56
  • @larson4 - Waitasecond. Your platform didn't have case-sensitive passwords before?
    – Kevin Vermeer
    May 2, 2012 at 22:00
2

Facebook also accept one more password type.

Your current password + any single character

Improve this answer
5
  • Do you have any source for this?
    – serenesat
    Jan 24, 2019 at 6:40
  • You can verify it by logging into your Facebook account. If your Facebook account password is "Password" then try "Password1" "Password@" etc.
    – abhishek bundela
    Jan 24, 2019 at 13:09
  • I don't have source of it but I think they made this feature to provide better user experience.
    – abhishek bundela
    Jan 24, 2019 at 13:09
  • I am a source -- I just found this out myself by mistake. Still working as of today.
    – Moustache
    Sep 20, 2019 at 23:05
  • Do you have any source for this?[2] I can login on fb with 2 passwords and they differ with only 1 letter at the end (second password is first pass + 1 letter that I set). But I can't just put any other character after first password and login, it only works with the one I set before.
    – Aditya Yadav
    Feb 25, 2021 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.