Accessible Authentication (Enhanced)
A login step cannot require a cognitive function test unless that step offers either another authentication method that is not one, or a mechanism that helps the reader through it. At Level AA there are two more ways out, recognizing an object and identifying non-text content the reader supplied. Non-text is the word that does the work in the second one, which is why a security question about something the reader typed years ago never qualified even at AA. This level removes both of those and keeps the other two. So it does not mean no passwords. W3C publishes an ordinary email and password form as a sufficient technique for this very criterion, with one condition. Password managers can fill it and the reader can paste into it.
Why it matters
Select every image containing a bus is a puzzle with a visual test stacked on top of it, and it shuts out anybody who cannot do both at once. The definition of a cognitive function test is broader than people expect. Remembering something, yes, and also transcribing it, doing arithmetic with it, solving a puzzle, and spelling it correctly. Name, email and phone number are carved out, because they are personal to the reader and the same everywhere. That carve-out is why an email-first login form is not itself a barrier.
Who this rule protects
People with cognitive and learning disabilities and people with memory impairments are who this exists for. W3C's cognitive accessibility work makes the point bluntly, that a login nobody can get through is the difference between using a service and not using it at all.
How to check it yourself
- Walk through login, password reset and account recovery, checking every step, since one non-conforming step fails the whole path.
- Try to paste into every field. Blocking paste is the mechanism failure W3C names.
- Check that a password manager can fill the fields, which means real labels and the right autocomplete values.
- Look for a code or a password split across several inputs, which is the one documented failure here.
- Check any CAPTCHA, including one that only appears sometimes, because occasional use is still in scope.
Failures we see most often
- A one-time code is split into six separate boxes, so it cannot be pasted in one action.
- A login asks for the second, sixth and last characters of the password, which no password manager can supply.
- An image CAPTCHA offers only an audio version the reader has to transcribe, which does not count as an alternative.
- Security questions ask the reader to recall an answer they set years ago. That one fails at Level AA too, because text-based personal content never qualified for the exception.
Who this one is for
Read from this rule's own note above, so the grouping and the note cannot disagree.
- Cognitive and learningpeople for whom the difficulty is understanding, remembering, or staying with it
How to fix it
- Mark the login form up properly. Labels, autocomplete on the email and password fields, and nothing blocking a password manager. W3C publishes exactly that as a sufficient technique.
- Allow pasting everywhere, and where a code arrives in several boxes, accept a paste into the first one and fill the rest.
- Offer an emailed sign-in link, which is a documented route. Note that SMS is not one W3C has written up.
- Support device-based authentication as the no-memory path. A fingerprint, a face, a hardware key, or a prompt on a phone the reader confirms.
Step-by-step fix guides (3)
Passes vs. fails
Passes
Login accepts a password a manager can fill and a reader can paste, with an emailed link offered beside it.
Fails
Login sits behind a grid-of-images CAPTCHA, with no other way in.
In audits and lawsuits
This criterion is new in WCAG 2.2, at Level AAA, alongside its Level AA counterpart at 3.3.8. Reaching it does not require ripping out passwords. It requires that the password form gets out of the reader's way, and W3C's technique for that is short. Real labels, autocomplete values a password manager understands, and paste allowed. Every step in the process has to pass, and account recovery counts as a step. Two things people expect to be in scope are not. Creating an account is outside this criterion, which is about authenticating existing users. And getting a code from a second device to this one is outside it too. W3C assumes the code reaches the clipboard and tests only whether your page lets it be pasted.