3.3.8: Accessible Authentication (Minimum)

What it means

Authentication must not rely only on cognitive function tests like remembering passwords, solving puzzles, or identifying objects — unless you offer an alternative. WCAG 2.2 added this for login barriers.

Provide options that do not depend on memory or puzzle solving.

How to fix it

• Support password managers and paste into password fields.
• Offer WebAuthn/passkeys or magic links as alternatives to memorised passwords.
• Do not block copy-paste on login forms.
• If CAPTCHA is required, provide an accessible alternative method.

Quick examples

• Good: Users can sign in with a passkey or emailed one-time link.
• Bad: Login requires solving a visual puzzle with no audio alternative.
• Good: Password fields allow paste from a password manager.
• Bad: Forgotten password recovery forces users to recall security questions from years ago.