Services · By journey
Login Accessibility Audit: The Front Door Everyone Must Pass
For any product where users sign in, which is to say most products, and where a broken front door blocks everything behind it.
What We Keep Finding
Nothing else on your site matters to a user who cannot get in. Login concentrates the classic traps. Password fields that fight paste, two-factor codes on a timer, and reset flows that hide their errors. The timer argument has an answer in the standard, by the way, and it is not the one people expect. The rule about time limits has three exceptions and not one of them is security, so "the code expires in 30 seconds because of fraud" is not the reply people think it is. The exception you would actually argue is whether extending it would break the activity, which is a real question and the right one.
WCAG 2.2 added a rule aimed straight at authentication. It limits how much memorizing and transcribing a login may demand, and the commonest way to fail it is the six-box one-time-code field, because splitting a code across boxes stops anybody pasting it. W3C names that exact pattern as a failure, and it counts whether the boxes take the whole code or just three characters of it.
Here is the reassuring half, and almost nobody selling you a login audit will tell you this. An ordinary email-and-password form is published by W3C as a way of passing that rule, and passing the stricter AAA version of it too. The test is two steps. Every field in the sign-in has a proper accessible name, and every field lets you paste. So on most logins the finding is not "you fail the new rule". It is "the code boxes fail, and the rest of the form already passes".
One correction worth making before somebody bills you for it. A picture CAPTCHA asking you to pick out the buses is expressly excepted from that authentication rule at Level AA, so it is not a failure there. Where it does fail is 1.1.1, the Level A rule about text alternatives, which wants the CAPTCHA's purpose described and a second version of it in a different sensory mode. Level A is the lower bar, so that is the more serious finding, and it is the one to write up. CAPTCHA also sits first on screen reader users' own list of what makes the web hardest.
What We Check
- Sign up, sign in, and reset a password with a screen reader
- Test paste and password-manager support in every credential field
- Check the one-time-code input against the named split-field failure
- Check any CAPTCHA against 1.1.1, and time limits against 2.2.1's three exceptions
- Verify every error is announced and tied to its field
- Measure against 3.3.7, so a signup never asks twice for what you already gave it
What You Get
Every service on this site runs the same three-pass engine: an automated scan, an expert review of all 55 WCAG 2.2 A and AA rules, and a hands-on session with a professional blind screen-reader user. You get one report with every finding screenshotted, ranked by user impact, and linked to its fix. Your team fixes, we verify: the re-audit is half price within 3 months.
The format is not a mystery either. Read the sample report before you spend anything.
The Honest Limit
One honest limit and one piece of arithmetic. Third-party identity providers bring their own screens, and those belong to them. We test the full journey anyway and mark which findings are yours and which are evidence for your provider. While the provider decides what to do, the standard gives you two honest positions on that content. Monitor it and repair what breaks within two business days, and the claim stands. Or publish that the page would conform if the identity provider's screens were removed, described clearly enough that a visitor can tell which part you mean. On arithmetic, a signup, a sign-in and a password reset is three pages before you count a two-factor step and a confirmation, so a full authentication journey can be half of a Rapid Audit's 10. Say so when you pick your pages and we will tell you whether it fits.
What It Costs
Rapid Audit: $499, up to 10 pages you pick, report in 5 business days. Standard Audit: $1,499, up to 25 pages in 10 business days. Flat rates, no discovery calls, and a real blind screen-reader user on every engagement. Pick your pages. We bring the humans.
Worth Reading Next
Related on this site
Guides, checklists, tools, and terms that go with this service.