Accessible authentication (WCAG 3.3.8) for log-in and two-factor flows
Gideon Awolesi ·
Success criterion 3.3.8 Accessible Authentication (Minimum) was added in WCAG 2.2 at level AA. It asks that people can log in without having to pass a cognitive function test, like remembering a password, transcribing a code, or solving a puzzle, unless there's another way to do it or something to help them. It doesn't ban passwords. It bans log-in flows that only work if you can remember, retype, or solve something on your own. For people with memory, reading, or learning disabilities, that difference decides if they can get into their account at all.
01What 3.3.8 asks
A cognitive function test is anything that asks people to remember, manipulate, or transcribe information, like recalling a password, retyping a code, or solving a puzzle. Under 3.3.8, no step in an authentication process can rely on one, unless at least one of these is true:
- There's another authentication method that doesn't rely on one.
- There's a mechanism to help, like letting a password manager fill in the field, or letting people paste.
- The test is to recognise common objects, like picking the photos with cars in them.
- The test is to identify content the user gave the website themselves, like a photo they uploaded.
The last two exceptions only apply at level AA. At level AAA, 3.3.9 removes them.
02Passwords
A password field passes when people don't have to remember the password themselves. In practice, that means letting password managers and the browser fill it in, and letting people paste into it. So don't block paste, don't split the password across several fields, and mark the fields with the right autocomplete values, like username and current-password, so password managers recognise them.
03One-time codes and two-factor authentication
A one-time code sent by text message or email asks people to transcribe it, which is a cognitive function test. It passes if they don't have to retype it themselves: let them paste it, mark the field with autocomplete="one-time-code" so phones can suggest it, and use one input rather than six separate boxes that break paste.
Watch the time limit too. If the code expires before someone can switch apps, find it, and enter it, they're stuck. WCAG 2.2.1 Timing Adjustable asks that people can turn off, adjust, or extend time limits in most cases.
04Methods that pass without help
Some methods don't involve a cognitive function test at all: a magic link sent by email, a passkey, logging in with another account, or approving a push notification on a device people already have. Offering one of these alongside a password is the simplest way to pass 3.3.8.
05CAPTCHAs
A CAPTCHA that asks people to type distorted text, or solve a puzzle, fails unless there's an alternative. Object recognition, like picking the images with traffic lights, is allowed at level AA, but it still excludes blind users unless you offer another route. If you need bot protection, look at options that run in the background without a challenge.
06A quick check for your log-in flow
- Log in with a password manager, and check it fills every field.
- Paste into the password and code fields.
- Use a code from another device, and check you have enough time.
- Try the whole flow with a screen reader.
- Check there's at least one method that doesn't ask people to remember or retype anything.
Our Accessibility Audit tests up to five key journeys by hand against WCAG 2.2 AA, log-in included, in two weeks from €2,500.