What is a case-sensitive password?
Definition
A case-sensitive password is one where upper and lowercase letters count as different characters, so "Password" and "password" don't match.
- Category
- Security
- Also called
- case sensitive password, passwords are case sensitive
- Last updated
When a site says your password is case-sensitive, it means capital letters matter. Merriam-Webster defines case-sensitive as requiring the correct input of uppercase and lowercase letters. NIST defines a password as a string of characters, such as characters of any kind, used to authenticate an identity or verify access. Put the two together and "Sunrise7" and "sunrise7" are two different passwords.
The practical effect
If you set "Blue-Fox-92" and later type "blue-fox-92", the login fails. The usual cause is caps lock left on, or a phone keyboard that capitalizes the first letter on its own.
Why sites do it
Counting uppercase and lowercase as different characters gives more possible combinations for the same length, which makes guessing harder. Length helps more than capitals, though.
What isn't case-sensitive
Usernames and email addresses often aren't. Many sites treat "Anna@example.com" and "anna@example.com" as the same account. Some sites do treat usernames as case-sensitive, so use what you registered with.
Spotting the problem
If a login fails and the letters look right, check caps lock first. A password manager sidesteps all of it by pasting the exact saved string.
How to protect yourself
- 1
Use length, not just capitals
Aim for a long passphrase of several unrelated words. Adding one capital letter to a short password barely helps.
- 2
Let a password manager type it
It stores the exact characters, capitals included, so you never mistype. See password manager.
- 3
Check caps lock before you reset
Failed logins can lock accounts. Before you try again, check caps lock and your phone's auto-capitalize setting.
- 4
Never reuse a password
Case-sensitivity doesn't protect a password that's already leaked. Use a different password on every account.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Are all passwords case-sensitive?
Most, though not every system. If a site is unclear, type the password exactly as you set it.
Are usernames case-sensitive?
Some sites ignore case in usernames and some don't. Use the exact form you registered.
Does adding capital letters make a password strong?
A little. Length matters more: a long passphrase of unrelated words beats a short password with one capital.
Sources
Something wrong or out of date? Tell us and we'll re-check it.