In plain language
Logging in must not require memorizing/transcribing (no blocked paste, no puzzles) — password managers and copy-paste must work.
Who it affects
People with cognitive disabilities and anyone who depends on password managers or paste.
How to check
Try to log in using a password manager and paste: both must work; any CAPTCHA/puzzle needs an accessible alternative. Worked example — A photo-sharing app's upload screen: copy a one-time code and try to paste it into a split multi-box OTP input: if pasting the full code doesn't work and each box must be typed individually, it fails.
Common misconception
CAPTCHA is often treated as a security requirement immune to accessibility rules. In reality, this rule just requires a non-cognitive alternative to exist, like an audio option or a passkey. Real example: on a music streaming app's playlist screen, the password or code field blocks pasting (or splits the code into boxes that break paste) — users are forced to memorize and retype, which is exactly what this rule forbids.