Accessible Authentication (Minimum)
Tier 1 · The normative floor
Baseline compliance
What the normative text of WCAG 2.2 requires, and nothing more. Only a failure of this tier is a WCAG failure.
The bare minimum
No step of an authentication process requires a cognitive function test, unless that step offers one of: another method that doesn't rely on one; a mechanism to help complete it; a test that is recognizing objects; or a test that is identifying non-text content the user provided. WCAG defines a cognitive function test as remembering, manipulating or transcribing information, such as remembering a password, transcribing characters, correct spelling, calculations or puzzles. Name, email and phone number don't count.
Normative text
Verbatim from WCAG 2.2, W3C Recommendation 12 December 2024. Underlined terms are defined below.
A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides at least one of the following:
- Alternative
- Another authentication method that does not rely on a cognitive function test.
- Mechanism
- A mechanism is available to assist the user in completing the cognitive function test.
- Object Recognition
- The cognitive function test is to recognize objects.
- Personal Content
- The cognitive function test is to identify non-text content the user provided to the website.
Not required by the normative text
Common claims that this criterion does not support. Don't log these as WCAG failures.
- Removing passwords. A password with help, such as password-manager support and paste (W3C's informative note gives these as examples of mechanisms), meets the Mechanism option.
- Covering account sign-up. It covers authentication; W3C's Understanding document says creating an account is not covered.
Definitions used (4)
Glossary definitions are normative. Their notes are informative.
- cognitive function test
-
A task that requires the user to remember, manipulate, or transcribe information. Examples include, but are not limited to:
- memorization, such as remembering a username, password, set of characters, images, or patterns. The common identifiers name, e-mail, and phone number are not considered cognitive function tests as they are personal to the user and consistent across websites;
- transcription, such as typing in characters;
- use of correct spelling;
- performance of calculations;
- solving of puzzles.
- process
-
series of user actions where each action is required in order to complete an activity
- mechanism
-
process or technique for achieving a result
Informative notes (2)
The mechanism may be explicitly provided in the content, or may be relied upon to be provided by either the platform or by user agents, including assistive technologies.
The mechanism needs to meet all success criteria for the conformance level claimed.
- non-text content
-
any content that is not a sequence of characters that can be programmatically determined or where the sequence is not expressing something in human language
Informative notes (1)
This includes ASCII art (which is a pattern of characters), emoticons, leetspeak (which uses character substitution), and images representing text
Notes in the criterion Informative
WCAG 2.2 lists notes among its informative material, which "does not create requirements that impact a conformance claim." They help interpret the criterion but are not part of the floor.
"Object recognition" and "Personal content" may be represented by images, video, or audio.
Examples of mechanisms that satisfy this criterion include:
- support for password entry by password managers to reduce memory need, and
- copy and paste to reduce the cognitive burden of re-typing.
Tier 2 · The gap
Usability & user impact
Where content can meet this criterion and still make things harder for people with disabilities. These are not failures of SC 3.3.8, so raise them as usability defects. Known failures, including failures of related criteria, are listed in Tier 1.
Object-recognition CAPTCHAs are allowed at AA but are still very hard for many blind and low-vision users and people with cognitive disabilities.
Tier 3 · The golden path
Recommended best practice
The pattern that meets the floor, closes the gap, and avoids audit disputes. A recommendation, not a requirement.
Support password managers and paste, and offer passkeys, email magic links or other non-memory options.
W3C's Understanding document and techniques for SC 3.3.8 ↗ are informative: sufficient techniques show ways to pass, and documented failures show common ways to fail, but neither changes what the criterion requires.
How SC 3.3.8 maps to the WCAG 3 draft
From this site's reviewed map to the WCAG 3 editor's draft. It's an interpretation: W3C has not published a mapping.
Successor provisions
Related, not a successor
From WCAG 2.2, section 5.1: “The main content of WCAG 2.2 is normative and defines requirements that impact conformance claims. Introductory material, appendices, sections marked as "non-normative", diagrams, examples, and notes are informative (non-normative). Non-normative material provides advisory information to help interpret the guidelines but does not create requirements that impact a conformance claim.”