All principles

    36 · Doing

    Postel's Law

    Accept what people give you in whatever form it comes, and send back something clean and consistent.

    Evidence: Disputed

    What we do with it

    1. 01

      Accept the formats people actually type: “12 ft”, “12.5”, “(555) 123-4567”. Store one clean version.

    2. 02

      Be strict about anything that unlocks something: passwords, payment details, sign-in links. Forgiving input there is a security hole.

    3. 03

      Show people what you understood, so a wrong guess gets caught before it matters.

    Examples

    Getting it wrong, getting it right.

    Don't

    A phone field that rejects “(555) 123-4567” and demands digits only.

    Do

    Accept it any way it's typed, store it one way, show it back neatly.

    The evidence

    What the research says.

    Evidence: Disputed

    Disputed in its own field. In 2023 the Internet Architecture Board published RFC 9413, which argues that accepting sloppy input let bad implementations spread until everyone had to support their mistakes. For what people type into forms, the original advice still holds, and UX research on forms supports it. Javier Bargas-Avila and colleagues showed in 2011, with 166 people, that stating a field's format rule up front cut errors and retries. In Mirjam Seckler and colleagues' 2014 eye-tracking study of 65 people, forms rebuilt along 20 research-based guidelines were finished faster and needed fewer tries to submit. For machine input, and anything to do with security, the advice doesn't hold.

    How our view changed

    We stay forgiving about what people type: spaces, dashes, capitals, “12 ft”. We're strict about anything security-sensitive, like passwords, payment details and links that sign you in.

    A second look

    Is your product breaking one of these?

    Most teams can't tell from the inside. Send us the page or the flow that's not working, and we'll tell you which of these we'd look at first.

    Email hello@synergyprod.com