WCAG 2.2's authentication rule is evaluated at each step of the process, and it asks for one complete path through that never requires a cognitive function test. Not a majority of steps. A path. Which means an audit of your sign-in is an audit of every state it can put somebody in, and the interesting work is reaching them rather than judging them.
That framing is why this page is a worksheet rather than an explainer. The judgment calls are mostly easy once you are standing in the state. Getting into a locked account, an expired code, a device-not-recognised challenge and a password reset, on a system somebody else runs, is the part that needs planning.
What the Rule Actually Prohibits, and the Four Ways Out
Accessible Authentication (Minimum) prohibits a cognitive function test at any step of authentication unless that step provides at least one of four things. An alternative method that does not rely on one. A mechanism that helps the user complete it. Object recognition, where the test is to identify objects. Or personal content, where the test is to identify non-text content the user provided.
A cognitive function test is a task that requires somebody to remember, manipulate or transcribe information. The definition names five example categories, and it explicitly carves out three things people assume are covered. Your name, your email address and your phone number are not cognitive function tests, because they are common identifiers rather than things you were asked to memorise.
At Level AAA the list shrinks to two. The enhanced version keeps alternative and mechanism, and drops object recognition and personal content. So the same image CAPTCHA passes at AA and fails at AAA, which is a clean answer to a question people ask constantly.
This rule does not ban passwords
H100, a properly marked up email and password form, is listed by W3C as a sufficient technique for both the AA and the AAA version. A password field is fine, because a password manager can fill it and a person can paste into it. What breaks the rule is a field that stops them, which is why the only documented failure here, F109, is about preventing a password or code from being re-entered in the same format. The six-box one-time-code widget is the version you will meet most often, because it defeats a single paste.
Where the Rule Starts and Stops
Three scope facts change a test plan more than any amount of technique reading, and all three surprise people.
- Account recovery is in scope. Password reset and credential change are authentication for this criterion, so the reset journey gets the same treatment as the sign-in.
- Account creation is not. The criterion covers authenticating existing users. Signup is outside it, though every other rule about forms, labels, errors and redundant entry still applies to it.
- Getting the code from your phone to your laptop is outside the test. W3C says so directly. When a code arrives on a second device, whether it can travel to the first is not part of evaluating this criterion. All that is tested is whether the field accepts a paste. The difficulty is real, and it belongs in the report as an observation rather than a criterion failure.
One more, which is good news for anybody being told to rip out their security. Hardware keys, push confirmations and platform biometrics are explicitly cleared. They are not cognitive function tests, because nobody is being asked to remember anything.
The Authentication Test-State Worksheet
This is the artifact. Every row is a state somebody has to be put into, and the middle column is the one that decides whether the engagement can start, because most of these states need something from your side.
| State | What the tester needs to reach it | What is in play |
|---|---|---|
| First sign-in with a password | A working test account | Labels, autocomplete tokens, paste behaviour, the show-password control |
| Wrong password | Permission to fail a few times | Error identification, and whether focus goes to the message |
| Locked or throttled account | A disposable account, and a way to clear the lock | The message, the wait, and whether the wait is announced |
| MFA prompt appears | A test account with MFA enrolled | Whether the second factor is announced as a new step or just redraws |
| Code entry | A code delivery route the tester can read | Paste into a single field, or the F109 failure if the field is split |
| Code resend and expiry | Time, and patience | A time limit set by the content, so Timing Adjustable applies |
| Backup or recovery code | Codes issued in advance | Same paste question, usually a longer string |
| Passkey enrolment | A device with a platform authenticator | The browser's own dialog is not your content, but everything around it is |
| Passkey sign-in | An enrolled account | Whether a keyboard-only route to trigger it exists |
| Unrecognised device challenge | A clean browser profile, or a VPN | Often the state nobody tests, and often the worst one |
| CAPTCHA appears | A trigger, which may need repeated failures | Two criteria at once, covered below |
| Password reset requested | Access to the mailbox | In scope, because recovery is authentication |
| Reset link followed | The email, opened where the tester is | A new page, often on a different template |
| New password set | Nothing extra | Requirements stated up front, and paste allowed |
| Re-authentication after timeout | A long enough wait | Re-authenticating and whether data survives |
Fifteen rows, and a typical evaluation reaches maybe nine of them without help. That is the real message of the worksheet. The states you cannot reach are not clean, they are unevaluated, and the report has to say which is which.
CAPTCHA Answers to Two Rules, Not One
A CAPTCHA can satisfy the authentication rule through the object recognition exception and still fail a different criterion entirely, which is the part teams miss.
Non-text Content has a CAPTCHA situation, and it is conjunctive. It requires a text alternative that identifies and describes the purpose of the CAPTCHA and alternative forms using output modes for different types of sensory perception. Both halves. The sufficient techniques are named as a pair for exactly that reason. So a visual challenge with a clear label and no audio alternative has met one half of one rule.
None of which makes CAPTCHA forbidden. It makes it a control that needs a second modality and a described purpose, and at Level AAA it needs something that is not a cognitive function test at all.
Security Timers Are Covered, With One Named Exception
"It is a security requirement" is not an exception in WCAG. A security-motivated time limit is a limit set by the content, and the content-set limits are the ones the timing rule covers.
There is one carve-out and it is narrow. W3C says time-limited two-factor tokens specifically can be considered essential, and the essential exception is available where removing the limit would fundamentally change the activity and the same result cannot be achieved another conforming way. That covers the six-digit code that expires in thirty seconds. It does not cover the session timeout, which is why sessions and timeouts is a separate conversation with its own numbers, starting at 20 seconds of warning and ten available extensions.
No Scanner Is Going to Tell You Any of This
There is no ACT rule for either authentication criterion. W3C's index says so plainly for both, which puts them in the same position as 49 of the 86 success criteria, and it is why a clean automated report on a login page proves almost nothing about the login.
What automation does reach here is the ordinary form work underneath. Fields with no accessible name, missing autocomplete tokens, contrast on the submit button. Worth running, and finished in a minute. The states in the worksheet are a person, every time, which is the general case our automated versus manual guide covers.
One honest limit
We audit and never repair, so nothing here is an offer to rebuild your sign-in. And we have no opinion on whether your authentication design is secure, because that is a different profession. What an evaluation produces is the states that were reached with their findings, and a named list of the states that were not, which is usually the most useful page in the report. Scope it at contact or read what the login and signup audit covers.