Case Sensitivity in Passwords, URLs and Emails

What case sensitive means

A system is case sensitive when it treats a capital letter and the matching lowercase letter as different characters. In a case-sensitive system, Secret and secret are two different words. In a case-insensitive system, they are the same. Many everyday systems mix both behaviors, and that mixture causes surprises: a link that works when typed in lowercase and fails in capitals, or a login that works on a phone and fails on a computer because of automatic capitalization.

The rest of this article goes through the places where the difference matters most: passwords, usernames, domain names, web addresses, email addresses, files and databases. In each case, the rule comes from a standard, from the design of the system, or from the choice of its developers.

Passwords are case sensitive

Almost every password system is case sensitive. Mixed capitals are one reason that a long password is strong: using both uppercase and lowercase letters doubles the number of possible characters per position from 26 to 52, before digits and symbols are counted. If a service ignored case, it would be easier to guess passwords for that service.

A practical consequence is that you should never change the case of a password when you copy or store it. A converter or a text editor with automatic capitalization can silently break a password. If a password does not work, check whether Caps Lock is on, whether the first letter was capitalized automatically by a phone keyboard, and whether the password manager stored the right version. Turn off automatic capitalization when you type a password on a phone.

Usernames and handles

Usernames depend on the service. Many services treat them as case-insensitive and preserve the case you chose for display, so that Anna and anna are the same account. Others treat them as case-sensitive. Some systems, such as GitHub, compare usernames without regard to case but show them with the capitals the owner picked.

If you are building a login system, decide the rule early and apply it in two places: when you create an account, you should compare the new name with existing names in a case-insensitive way, and when someone logs in, you should compare in the same way. Otherwise two people can register Anna and ANNA and see each other's mail. For security reasons, many designers also normalize Unicode text before comparing names.

Domain names and web addresses

Domain names are case-insensitive. The DNS standard requires that names are compared without regard to case, which is why EXAMPLE.COM and example.com are the same site. Browsers usually show the domain in lowercase. The scheme at the start of a URL, such as https, is also case-insensitive.

The rest of a web address is different. According to RFC 3986, the path and the query are case sensitive in the standard itself, and most web servers on Linux map them to files, which are case sensitive. So example.com/About and example.com/about can be different pages or one valid page and one error. That is why slugs should be lowercase, and why a site should redirect any capital-letter variants to the canonical lowercase address.

Email addresses

An email address has two parts. The domain after the @ is case-insensitive like any domain name. The part before the @, the local part, is formally case sensitive: the SMTP standard RFC 5321 says that mail systems must preserve its case, and that a host may treat Smith and smith as different mailboxes. The same standard adds that relying on this is discouraged because it hurts interoperability.

In practice, large email providers treat the local part as case-insensitive, so Anna@example.com and anna@example.com reach the same person. For this reason, most websites store email addresses in lowercase for comparison. A good approach is to keep the original spelling for display and use a lowercase copy for comparison and duplicates. Do not reject an address because it has a capital letter.

Files and folders

File systems differ. Linux file systems such as ext4 are case-sensitive by default: Report.pdf and report.pdf can exist side by side. Windows NTFS is case-insensitive by default but case-preserving: the system remembers the capitals you typed but treats the names as equal. macOS APFS and HFS+ are case-insensitive by default as well, with an option for a case-sensitive format.

This difference breaks projects that move between systems. A web page that links to Logo.PNG works on a developer's Mac and fails on a Linux server where the file is called logo.png. Version control can be confused by a file that is renamed only in case. The safest habit is to use lowercase names with hyphens or underscores for every file and folder in a project.

Databases and programming languages

Databases have their own rules. PostgreSQL compares text case-sensitively by default. MySQL and SQL Server often use case-insensitive collations by default, depending on the version and settings, so that a search for smith also finds Smith. The collation of a column decides, and you can change it. To compare without regard to case in PostgreSQL, you can use ILIKE or compare LOWER() of both sides.

Programming languages are mostly case sensitive: in JavaScript, Python, Java, C and Go, name and Name are different identifiers. HTML tag names, CSS property names and HTTP header names are case-insensitive, while XML, JSON keys and CSS class names are case-sensitive in standards mode. Knowing which part of your stack is which saves a lot of debugging.

Practical rules

Treat passwords as exact strings and never change their case. Use lowercase for slugs, file names and domain names in links. Store email addresses as typed and compare them in lowercase. Decide whether usernames are case-sensitive before you launch and implement it consistently. When a system fails for no obvious reason, look at capitalization first: it is a cheap check and a common cause.

The converter on this page can help in the cases where the text is not a secret: convert a list of email addresses or slugs to lowercase before you compare or import them. Never paste real passwords into any online tool, even a tool like this one that runs in your browser, because a copy can end up in the clipboard history or in a screen recording.