3.3.8 Accessible Authentication (Minimum)

What does it mean?

A cognitive function test is anything that asks users to remember, transcribe or work out something, such as recalling a password, copying characters from a distorted image, or solving a puzzle. Such a step is only allowed if there is another way to log in, or if the user gets help with it, for example because password managers can fill in the field and pasting is allowed.

At this level, two kinds of tests are still allowed: recognising common objects (for example "select all pictures with a bicycle") and identifying content the user provided themselves, such as a picture they uploaded. Passkeys, login links by e-mail and one-time codes that can be pasted all meet the criterion.

Who does it help?

• People with cognitive disabilities, memory problems or dyslexia
• People who rely on password managers to fill in complex passwords
• People with motor disabilities for whom typing long codes is hard

Common failures

• Pasting into the password or one-time code field is blocked by script
• The password field uses autocomplete="off" or an unusual structure so password managers cannot fill it
• A text CAPTCHA with distorted characters is the only way to log in
• A one-time code is split into six separate fields that do not accept pasting
• Users must solve a maths question or remember a security answer with no other option

How we test it

• evidence Evidence: our scanner collects material such as screenshots, lists and measurements.

Test question: Login works without a cognitive test (no puzzle CAPTCHA, paste allowed, password managers work).

A person decides every criterion. No criterion ever passes automatically.

How to fix it

<input type="password" autocomplete="off" onpaste="return false">

<label for="user">E-mail address</label>
<input id="user" name="username" type="email" autocomplete="username webauthn">
<label for="pw">Password</label>
<input id="pw" name="password" type="password" autocomplete="current-password">
<button type="submit">Log in</button>
<a href="/login/link">Send me a login link instead</a>

Correct autocomplete values let password managers and passkeys work, pasting is allowed and a login link offers an alternative.

Practical tips

• For one-time codes, use one field with autocomplete="one-time-code".
• This applies to every step of login, including two-factor authentication and password reset.

Guides and patterns on this

• Forms that everyone can completeForms are where people buy, book or give up. This guide shows how labels, required fields and error messages need to work for keyboard, screen reader and magnifier users.
• Stop spam without stopping peopleA CAPTCHA is meant to stop bots and often stops people instead: those who are blind, have low vision, are hard of hearing or find puzzles hard. There are better ways to fight spam.

Official source

Understanding WCAG 2.2 at the W3C: 3.3.8 Accessible Authentication (Minimum)