Should a password and username be case sensitive?

Question

We are developing a new website. Should a password and username be case sensitive? or is that more likely to cause our users problems?

Answer 1

The typical standard used is that the password should be case sensitive (since this has to be absolutely secure) whereas the user name should NOT be case sensitive (this is to make it easier for the user)

Answer 2

If you want a more secure system then yes make them both case sensitive. It means there are more permutations before people can break in.



That said, it is the norm that usernames are not case sensitive. For example, Active Directory, which is used to manage user accounts in Windows networks is case-insenstive for user names.



It is made up by forcing more stringent password requirements. Like

- At least one upper case letter

- At least one symbol or numeric

- At least 8 characters in length



So, since most systems don't force case sensitivity on usernames it is better if your website does. I know when I run into ones that do, especially when they force you to have an upper case letter in your user name, I constantly forget the details.

Answer 3

Username - No case sensitive ( single case)

=

Password - Case sensitive

Answer 4

As already stated, the username should not be case sensitive.



It is up to you whether you make the password case sensitive. Case sensitivity increases security and increases the number of characters that can be selected, especially if you allow numbers and non-alphanumeric characters.

Answer 5

just the password is usually sufficient and yes it will confuse many users to have the username case sensitive

Answer 6

Yes I agree with the previous answers, it is in your own interest to make your password as secure as possible. By making it case sensitive will add to the security.