← All criteria

Understandable · Level AA · 3.3.8

Accessible Authentication (Minimum)

Logging in shouldn't require a cognitive function test — memorizing a password, solving a puzzle, transcribing a code from another device, doing arithmetic — unless an alternative that doesn't require it is also offered, or the test is limited to recognizing objects or the user's own personal content.

  • Cognitive
The problem, in practice — select the image to enlarge it
A login screen compared with authentication that requires a cognitive function test versus one offering an accessible alternative. 'Authentication that requires a cognitive function test' shows logging in by memorizing a password, solving a puzzle piece, entering a 6-digit code from another device, or doing mental arithmetic, each requiring memory, problem-solving, transcription, or calculation with no alternative offered. 'Accessible authentication provided' shows the same password login now paired with an email magic-link alternative that needs no memorization, plus biometric or security-key sign-in and picture-recognition or trusted-device sign-in, each based on recognition rather than a cognitive test. A side panel notes that a cognitive test is allowed only when limited to recognizing objects, symbols, or the user's own content, or when no viable alternative exists.

How to recognize it

Look at the login flow itself: a password field alone isn't a violation as long as the browser's password manager and paste are allowed to work (letting autofill and paste function is what makes memorizing the password itself not required); the failure is when something actively blocks that path — a login form that disables pasting into the password field, forcing the user to actually type and therefore remember it, or a puzzle CAPTCHA that requires solving a visual logic problem to proceed, or a two-factor flow that requires manually retyping a six-digit code read off another screen rather than allowing autofill or copy-paste. People with memory-related cognitive disabilities, dyslexia, or dyscalculia are the ones this protects — a login step that quietly assumes everyone can memorize an arbitrary string or perform quick mental arithmetic under time pressure is a real barrier for them, distinct from a simple inconvenience for everyone else.

How to fix it

Allow password managers, browser autofill, and copy-paste into every authentication field rather than disabling them — that alone typically resolves the 'don't force memorization' requirement even while a password field is still present. For two-factor codes, allow the code to be pasted or autofilled instead of requiring it to be manually retyped from another device. If a genuinely memory- or puzzle-based step is unavoidable, offer an alternative authentication path that doesn't require it — email magic links, WebAuthn/passkeys, or an object-recognition or personal-photo-recognition step are all acceptable alternatives that don't rely on memorization.

Example

Avoid

<input type="password" onpaste="return false;">
<!-- blocks pasting, forcing the user to manually recall and type the password -->

Prefer

<input type="password" autocomplete="current-password">
<!-- paste and password-manager autofill both work -->

Resources