- Success Criterion 2.2.1
- Conformance level A
One-Time Passcode That Expires Too Quickly to Use
2.2.1 — Timing Adjustable
Scenario
Setting
A pharmacy app's prescription-refill form
What’s wrong
one-time password (OTP)/2FA codes with very short validity and no re-request path within the flow.
Example
setTimeout(() => logOut(), 60000); // no warningWhy it matters
People who read, type, or move slowly, including many screen-reader users.
How to test
Request an OTP/2FA code and time its validity: if it expires very quickly with no easy way to request a new one within the same flow, it fails.
How to fix
The time limit must be removable or adjustable (to at least 10x) before it starts, or extendable via a warning giving at least 20 seconds to respond with a simple action. setTimeout(() => showExtendSessionPrompt(), 55000); Users need a warning and a way to extend a time limit before it expires, unless the limit is essential (e.g. an auction).
Outcome
On a pharmacy app's prescription-refill form, this barrier is gone for people who read — they can complete the task without hitting this wall.
Who is affected
People who read, type, or move slowly, including many screen-reader users.
Learn more
- Understanding Understanding document (opens in a new tab)
Related scenarios
- Page Auto-Redirects on a Timer With No Way to Stop It
- Page That Auto-Reloads and Resets the User’s Position
- Server Redirect Timeout With No Warning or Way to Extend It
- Session Expiring With No Warning and No Way to Extend It
- Session Warning That Gives Users Less Than 20 Seconds to Respond
- Session Extension Allowed Fewer Than the Required 10 Times