Mark up email and password inputs properly
A sign-in form should be markup a password manager can read. type=email with autocomplete=email, type=password with autocomplete=current-password or new-password. W3C lists H100 as sufficient for 3.3.8 Accessible Authentication at Level AA and for its enhanced counterpart at AAA. Its test is not about the tokens, which surprises people. It checks two things. That every authentication input has a proper accessible name, because that is what browsers and password managers use to work out what to fill, and that pasting into the field is allowed. So the failure with teeth is any script that blocks paste or fights autofill, and split-character password boxes land in the same bucket. The scope is narrow too. W3C's test covers sites where you log in with an email and a password, which leaves one-time codes and multi-factor flows outside the technique entirely.
How we find it in an audit
Input types, autocomplete tokens and scripts blocking paste are all mechanical checks. Then we log in the way a password-manager user does and note everything that fights the manager. Fields it cannot find, boxes that take one character each, paste suppression, and forms that clear themselves after an autofill.
How affected users experience it
This rule serves people with cognitive disabilities most directly, because memorizing and retyping a password is a real barrier and a working password manager removes it. Screen reader users and people with motor disabilities gain the same way. One autofill instead of transcribing 20 characters they cannot see into a field that masks every keystroke and says nothing until they get it wrong.
Passes vs. fails
Passes
<label for="pw">Password</label>
<input id="pw" type="password" name="pw" autocomplete="current-password">Fails
<input type="text" name="pw" onpaste="return false">Other ways to satisfy this rule
3 guides on this site are filed under 3.3.8 Accessible Authentication (Minimum). W3C lists this one as sufficient for that rule on its own. Implement it correctly, in a way your readers' software actually supports, and the rule is met.
This guide is our interpretation of W3C technique H100: Providing properly marked up email and password inputs. W3C publishes its techniques as guidance rather than as the standard, and says so on every one of them. The success criterion is what conformance is measured against, and a technique is one documented way to meet it.