- Success Criterion 3.3.8
- Conformance level AA
3.3.8 · Accessible Authentication (Minimum)
Lesson overview · Accessible Authentication (Minimum)
In plain language
Logging in must not require memorizing/transcribing (no blocked paste, no puzzles) — password managers and copy-paste must work.
Who it affects
People with cognitive disabilities and anyone who depends on password managers or paste.
How to check
Try to log in using a password manager and paste: both must work; any CAPTCHA/puzzle needs an accessible alternative.
Common misconception
CAPTCHA is often treated as a security requirement immune to accessibility rules. In reality, this rule just requires a non-cognitive alternative to exist, like an audio option or a passkey.
Learn more
Scenarios in this lesson
- Password Field That Blocks Pasting or Splits the Code Up
- Password Field Scripted to Block Paste Entirely
- Password Manager Autofill Blocked by the Login Form
- Visual CAPTCHA Required With No Non-Visual Alternative
- Puzzle CAPTCHA Gating Login With No Alternative Method
- One-Time Code Split Into Boxes That Reject a Pasted Code
- Displayed Code Required to Be Retyped With Copying Disabled
- Security Question Requiring an Exact Memorized Answer
- Login PIN Entered Only via a Randomized On-Screen Keypad
- Email Magic-Link Login That’s Broken or Expires Instantly