WCAG 3.3.8 Accessible Authentication (Minimum)

Success criterion 3.3.8 is new in WCAG 2.2. It helps people with cognitive disabilities, memory or learning difficulties and dyslexia, for whom remembering a password, retyping a code or solving a puzzle can lock them out of their account. In a shop this concerns login, sign-up, password reset, two-factor codes and CAPTCHAs. It is level AA and appears in EN 301 549 as clause 9.3.3.8.

What the criterion requires

A cognitive function test must not be required for any step of an authentication process, unless that step provides at least one of:

• Alternative: another authentication method that does not rely on a cognitive function test;
• Mechanism: a mechanism to assist the user, such as support for password managers or copy and paste;
• Object recognition: the test is to recognise objects;
• Personal content: the test is to identify non-text content the user gave the site (for example, a photo they uploaded).

A cognitive function test is a task that requires the user to remember, manipulate or transcribe information: remembering a password or pattern, typing characters shown on screen, spelling, calculations, puzzles. Entering a name, email address or phone number is not a cognitive function test.

The object recognition and personal content exceptions apply at AA only; the AAA criterion 3.3.9 does not allow them.

Typical failures on an online shop

• the password field blocks paste or sets attributes and scripts that stop password managers from filling it, with no other login method;
• a two-factor code split into six separate boxes that reject a pasted code;
• a text CAPTCHA (type the distorted letters) or a maths question as the only option;
• an audio CAPTCHA that requires transcribing what you hear as the "alternative";
• asking for "the 2nd, 5th and 7th character" of a password;
• a security question such as "your first pet's name" as the only recovery path.

How to check it

Automated: our checker has no rule for this criterion. It does not log in, so this needs a manual check.

By hand: test login, registration, password reset and any two-factor step. Try saving and filling the password with a password manager. Paste a password and a one-time code from the clipboard. Note every CAPTCHA and what it asks you to do. For each step with a memory or transcription task, look for an alternative (email link, passkey) or a mechanism (paste, autofill).

How to fix it

• Allow paste and autofill: use autocomplete="current-password", new-password and one-time-code, and do not block paste.
• Use one input field for one-time codes, or make split fields accept a pasted code.
• Offer an email login link, passkeys or social login as an alternative.
• Replace text and maths CAPTCHAs with an option that does not need a cognitive test; W3C advises avoiding object recognition where possible too.

Related criteria

• 3.3.7 Redundant Entry — don't make users retype data in a process.
• 1.3.5 Identify Input Purpose — autocomplete on input fields.
• WCAG 2.2 checklist — the other new criteria in WCAG 2.2.

Frequently asked questions

Are passwords still allowed under WCAG 3.3.8?

Yes, if the user is helped to complete them: password managers can fill the field and pasting is allowed. Blocking paste or autofill on the password field fails, unless another login method without a cognitive test is offered.

Is a CAPTCHA allowed under WCAG 2.2 AA?

A CAPTCHA that only asks users to recognise objects (for example, pick the pictures with a bicycle) is allowed at AA under the object recognition exception. Text transcription, maths or puzzle CAPTCHAs need an alternative.

Is a one-time code by SMS or email acceptable?

Yes, if users can paste the code or let the browser fill it in. Separate boxes per digit that reject a pasted code fail. An email login link is listed by W3C as a sufficient technique.

Is entering my email address a cognitive function test?

No. W3C says the common identifiers name, email and phone number are not considered cognitive function tests.