Accessible Authentication (Minimum)
New in WCAG 2.2. No step of signing in may require a cognitive function test, which the standard defines as a task asking you to remember, manipulate or transcribe information. A password is one. A puzzle is one. Copying a code by hand from one screen to another is one. Four things lift the requirement, and two of them carry almost all the practical weight. Another sign-in method that skips the test, and a mechanism that helps the user through it, which the standard says includes password manager support and copy and paste. The other two are narrow. A test that only asks the user to recognize objects is excepted, and so is one that asks them to pick out content they uploaded themselves. Every step has to clear this, so there needs to be a whole path through your login with no memory test anywhere in it.
Why it matters
Login is the gate in front of everything else you built. A memory test at that gate means some people never see the rest. Paste-blocking is the most common way it happens, and it is a superstition. It defeats password managers, it pushes people toward passwords weak enough to remember, and the security bodies that publish password guidance tell you to allow pasting rather than to block it. This is one of the rare places where accessibility asks for exactly what the security advice already recommends.
Who this rule protects
People with memory or processing difficulties are the audience this rule was written for. Dyslexic users transcribe a code and land a character in the wrong place. Users with dyscalculia have the same trouble with a string of digits, which is precisely what a one-time code is. And anybody whose password manager your form fights is affected too, disability or not.
How to check it yourself
- Paste into the password field. Then paste into the one-time-code field. Both have to accept it, and a field that silently drops the paste is the failure.
- Let a password manager fill the form and watch whether it succeeds. That depends on the fields carrying the right autocomplete attributes and on nothing in your JavaScript blocking the fill.
- Walk every step, not just the first. Multi-factor is where this breaks, because a clean password step followed by a code you read off a phone and retype still fails.
- Walk the account-recovery flow too, since recovering or changing a password is part of authentication for this rule.
- Try to trigger the conditional challenges. Some CAPTCHAs only appear after failed attempts or behind an ad blocker, and a normal test pass never sees them.
- Check what the second factor actually asks for. A hardware key, a push notification you confirm on your phone, or a fingerprint are not cognitive function tests at all, so a login built on those has nothing to fix here.
Failures we see most often
- Paste is disabled on the password field in the name of security, which defeats password managers and helps nobody.
- A one-time code is split across six separate boxes, so pasting the code fills the first box and stops. That is W3C's own named failure for this rule, and it is the most common way a modern login breaks.
- The login asks for the first, third and fifth character of your password, which no password manager can fill and no user can answer without reading their own password off something.
- A CAPTCHA asks the user to transcribe distorted characters, with no alternative route offered. Transcription is a cognitive function test, and distorted text is not object recognition.
- A security question asks for a first pet's name. Recalling text and typing it is not covered by the exception for content the user provided, which is about picking out an image rather than remembering a word.
- The password step is clean and the second factor is a code you read off another device and retype by hand, so the path through the login still contains a memory test.
Who this one is for
Read from this rule's own note above, so the grouping and the note cannot disagree.
- Cognitive and learningpeople for whom the difficulty is understanding, remembering, or staying with it
How to fix it
- Allow paste in every authentication field, including the code fields, and take out whatever is blocking it.
- Use one input for a one-time code rather than six, and add autocomplete="one-time-code" so the operating system can fill it.
- Mark the login fields properly. autocomplete="username" and autocomplete="current-password", with a real accessible name on each field, is what lets a password manager recognize them, and it is most of what the sufficient technique asks for.
- Offer a route that skips the password. An email sign-in link is W3C's documented technique for this, and passkeys work well in practice, though the standard still lists them as a technique in waiting rather than a settled one.
- If your security team needs a challenge, reach for the ones that do not test the user. Rate limiting, geolocation checks and client authentication all cut how often a CAPTCHA has to appear at all.
- Add a show-password toggle. It is not required, it costs almost nothing, and it turns blind typing into something a person can check.
Step-by-step fix guides (3)
Passes vs. fails
Passes
Paste works, the password manager fills both fields, the one-time code lands in a single input the phone can autofill, and an Email me a sign-in link option sits one click away.
Fails
The password field blocks paste, so a 24-character password generated by a password manager has to be typed in by hand, one character at a time, and checked by eye.
In audits and lawsuits
This is a WCAG 2.2 addition, so it is a common gap in older conformance claims. We test the login with a password manager, with paste, and through account recovery, since recovery is where the last memory tests hide and the standard puts it in scope. Start with the reassuring half, because most owners told their login fails WCAG 2.2 assume the answer is a rebuild. W3C publishes an ordinary email-and-password form as a sufficient technique, and one form covers this criterion and its AAA sibling at once. Its whole test procedure is two steps. Each authentication input carries a proper accessible name, and each one allows pasting. That is the entire technique. Two things we do not raise. A CAPTCHA that only asks the user to pick out common objects is excepted at this level and fails only at AAA. And a CAPTCHA on your signup form is not a finding here, because this criterion covers authenticating existing users rather than creating accounts. No automated rule exists, so all of it is done by hand.