# Can websites tell if I'm using Caps Lock? **URL:** \ **Category:** Factual Questions\ **Created:** [February 1, 2019, 4:11pm UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792 "2019-02-01T16:11:11Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Mr\_Shine](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mr_shine/32/464_2.png) [@Mr\_Shine](https://boards.straightdope.com/u/Mr_Shine)\ **Post date:** [February 1, 2019, 4:11pm UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/1 "2019-02-01T16:11:11Z")
If my password on a website was MrShine999 but I kept entering mRsHINE999 due to accidentally leaving caps lock on, can the website tell the difference between me actually typing mRsHINE999 without caps lock and typing MrShine999 with caps lock? ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [February 1, 2019, 4:14pm UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/2 "2019-02-01T16:14:30Z")
No. The web site just sees the characters you send it. A capital “S” produced by holding the shift key is identical to the character produced when capslock is on. ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [February 1, 2019, 4:23pm UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/3 "2019-02-01T16:23:10Z")
Yes and no. Websites can absolutely detect capslock being on or off. A lot of account creation and login pages pages will pop up a warning box saying, essentially, “oops, caps lock is on, be careful when typing your password”. However, they can’t match your password this way, since the password field is going to just send the characters you entered in a hashed state and match that against the hash they have stored. Technically they could “assume” you meant to do it without caps lock and do a character case inversion before hashing if you hit “submit” while caps lock is on, but making that sort of assumption about user input is usually frustrating and ill advised. A solution a few places use, Blizzard being one, is to make passwords case insensitive by converting ALL letters to upper or lower case before hashing and sending it (presumably to cut down on “MY PASSWORD ISN’T WORKING WHY???” support tickets when it was just caps lock). ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [February 1, 2019, 4:27pm UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/4 "2019-02-01T16:27:08Z")
Yeah, let me qualify my answer. A “web site” can’t detect capslock but Javascript can. So if the website has a Javascript program running on your browser then it could. ---
**Author:** ![ticker](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@ticker](https://boards.straightdope.com/u/ticker)\ **Post date:** [February 1, 2019, 8:32pm UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/5 "2019-02-01T20:32:41Z")
> [@Jragon](#): > > …the password field is going to just send the characters you entered in a hashed state and match that against the hash they have stored. Nitpick: The password field is going to send the password (hopefully encrypted), not the hash. If they sent the hash then that hash would essentially be the password. A hacker who gains access to the sites list of hashed passwords could spoof the password field by just sending the hashes they have stolen. ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [February 1, 2019, 8:41pm UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/6 "2019-02-01T20:41:17Z")
> [@Mr\_Shine](#): > > … due to accidentally leaving caps lock on… Unless you actually use the Caps Lock key frequently, you can easily disable it, or change it to a regular Shift key or Ctrl key. Just search for “Disable Caps Lock” to find it. It does involve editing in the Registry, but you can also download a script to do this automatically. I did this years ago, converted it to be a regular (unlocked) Shift key, and have never regretted it. ---
**Author:** ![ThisSpaceForRent](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thisspaceforrent/32/345_2.png) [@ThisSpaceForRent](https://boards.straightdope.com/u/ThisSpaceForRent)\ **Post date:** [February 1, 2019, 8:47pm UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/7 "2019-02-01T20:47:38Z")
I just pry off the cap lock key on my keyboards…I have found it much more a a nuance than and asset. ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [February 1, 2019, 9:05pm UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/8 "2019-02-01T21:05:08Z")
i JUST LEAVE MINE ON ALL THE TIME. i HAVEN’T HAD ANY ISSUES. ---
**Author:** ![Dr.Strangelove](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dr.strangelove/32/6613_2.png) [@Dr.Strangelove](https://boards.straightdope.com/u/Dr.Strangelove)\ **Post date:** [February 2, 2019, 2:21am UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/9 "2019-02-02T02:21:52Z")
> [@ThisSpaceForRent](#): > > I have found it much more a a nuance than and asset. NOT A LOT OF NUANCE TO SHOUTING ALL THE TIME. To answer the OP, most websites employ JavaScript to perform input validation. As part of the keypress event, one can query the capslock state: ```auto function (event) { if (event.getModifierState("CapsLock")) { ... do something else ``` ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [February 2, 2019, 2:22am UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/10 "2019-02-02T02:22:31Z")
> [@ticker](#): > > Nitpick: The password field is going to send the password (hopefully encrypted), not the hash. If they sent the hash then that hash would essentially be the password. A hacker who gains access to the sites list of hashed passwords could spoof the password field by just sending the hashes they have stolen. Ah In fairness, I don’t do web dev so I’m not familiar with the finer details. I thought they hashed before sending, and the encryption was naturally handled by something like https. And this is why I will never roll my own crypto 😛 ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [February 2, 2019, 6:11am UTC](https://boards.straightdope.com/t/can-websites-tell-if-im-using-caps-lock/828792/11 "2019-02-02T06:11:34Z")
> [@Jragon](#): > > Ah > > In fairness, I don’t do web dev so I’m not familiar with the finer details. I thought they hashed before sending, and the encryption was naturally handled by something like https. > > And this is why I will never roll my own crypto 😛 I don’t know anything about web programming either, but ISTM that- in principle- a password authentication could be carried out using a socialist millionaires’ protocol so that nothing unencrypted is ever sent. In practice https using TLS with perfect forward secrecy should realize this style of secure communication; storing only salted hashed passwords on the server is protection against when the database inevitably gets hacked or stolen.