::I think your are missing the questioner's point. Most users only capitalize one or two letters, which adds little security, and for short passwords, even random capitalization only adds about as much as just adding one more letter. It gets even worse if you consider security per keystroke, see . I believe users often pick weak passwords because they fear forgetting them and forcing them to use mixed capitalization only adds to that fear.