They hash it once and save it to the database. When logging in, they generate three hashes (if I remember correctly) and compare it to the hash in the database.

They hash it once and save it to the database. When logging in, they generate three hashes (if I remember correctly) and compare it to the hash in the database. If any match, it logs you in. Edit: Here's a post on the matter http://www.zdnet.com/blog/facebook/facebook-passwords-are-not-case-sensitive-update/3612 http://www.zdnet.com/blog/facebook/facebook-passwords-are-no...