3 ms·

I'd be very surprised if they created all 3. They probably check the other 2 variations if the first one fails though: if (entered == password || entered.swa

I'd be very surprised if they created all 3. They probably check the other 2 variations if the first one fails though: if (entered == password || entered.swapcase() == password) .. // etc

r00fus 13y ago
In order to be performant, since the check is not against your actual password but just against a stored hash (salted/bcyrpted/etc), I wouldn't be surprised if they simply stored all 3 hash results.