If you're saving the hash of original PassWORD, then transforming the erronously entered pASSword to lower case will still produce a different hash from tge one you have saved. It will only work if you save a hash of lower case password.

> If you're saving the hash of original PassWORD, then transforming the erronously entered pASSword to lower case will still produce a different hash from t[h]e one you have saved.

This is true, but it's not a response to your parent comment,

> You can do what Facebook does without storing the passwords as lower case. If someone tries to log in, and the password doesn't match, then just transform it that way and try again.

1. Store the hash of "PassWORD".

2. Receive erroneous "pASSword", hash it, find the hash isn't right.

3. Reverse the case of the bad input to get "PassWORD", hash that, find it matches.

At no point was it necessary to store the hash of "password".

Oh, you mean only the transformation of inverting the case. But I believe that originally we were talking about any mistakes with case, not only inversion.

You can also do O(2^n) brute-force like a dumbass.

Not sure if this is what GP meant. Maybe Facebook only accepts wrong case on the first position (simple to implement) or maybe GP just doesn't know what they do.

Why wouldn't they transform it before registration and login ? That way they don't have to check multiple passwords. I guess I'm missing smtg.