Is there any explanation (other than storing plaintext) for case-insensitive passwords?

I agree with Emil that it's a question of usability. Making passwords case-insensitive puts an end to the common user error of entering the password with caps lock on.

Also, a case-insensitive password doesn't have to be stored in plaintext, it can simply be converted to lower case before it is hashed. The only security concern with having case-insensitive passwords is that it lowers password complexity, but this can be mitigated by requiring longer passwords or passphrases.


One possible reason could be usability. We have all seen how some users have difficulties correctly typing their password, due to cap locks or wrong case.

Having case insensitive passwords increases the success of login in.


By flattening case, you allow people to enter passwords on a traditional phone keypad. I have seen more than one example of a bank that does this so that customers can have the same password at the website, as they do over the phone.

ie.

password: joe123

on-phone: 563123

This is obviously a significant compromise in security, and limits the password to 24 of the 26 letters in an English alphabet, if you assume really old phones.

In some early systems, in the days of 7-bit connections, if you gave your username in all uppercase, it assumed you couldn't do mixed case, and flattened your password during authentication.