- Success Criterion 2.2.1
- Conformance level A
One-Time Passcode That Expires Too Quickly to Use
2.2.1 — Timing Adjustable
Scenario
Setting
A pharmacy app's prescription-refill form
What’s wrong
one-time password (OTP)/2FA codes with very short validity and no re-request path within the flow.
Example
A pharmacy app's prescription-refill form is a good example: one-time password (OTP)/2FA codes with very short validity and no re-request path within the flow.
Why it matters
People who read, type, or move slowly, including many screen-reader users. On a pharmacy app's prescription-refill form specifically, they run out of time before finishing the task.
How to test
Request an OTP/2FA code and time its validity: if it expires very quickly with no easy way to request a new one within the same flow, it fails.
How to fix
The time limit must be removable or adjustable (to at least 10x) before it starts, or extendable via a warning giving at least 20 seconds to respond with a simple action.
Outcome
Fixed, a visitor to a pharmacy app's prescription-refill form can read the content without losing their place.
Who is affected
People who read, type, or move slowly, including many screen-reader users.
Learn more
- Understanding Understanding document (opens in a new tab)
Related scenarios
- Page Auto-Redirects on a Timer With No Way to Stop It
- Page That Auto-Reloads and Resets the User’s Position
- Server Redirect Timeout With No Warning or Way to Extend It
- Session Expiring With No Warning and No Way to Extend It
- Session Warning That Gives Users Less Than 20 Seconds to Respond
- Session Extension Allowed Fewer Than the Required 10 Times