Accessible Authentication
Design complete authentication flows that support password managers, paste, passkeys, and low-memory one-time-code and cross-device use
WCAG 3.3.8 evaluates the complete authentication process. It must not require a cognitive function test—such as remembering or transcribing a password, solving a puzzle, or recognizing non-personal content—unless an allowed method, assistance mechanism, or Minimum-level exception is available.
Password-manager and paste support can remove a memory burden, but “paste allowed” alone does not prove that the whole flow passes. Evaluate account discovery, CAPTCHA, multi-factor steps, one-time codes, magic links, cross-device transfers, recovery, and reauthentication. Object recognition and identifying personal content are exceptions at Level AA; an audio transcription task is not automatically an equivalent accessible alternative.
Memory and Transcription Barriers vs. Assisted Authentication
View inaccessible code
<input type="password" autocomplete="off" onpaste="return false" />
<input aria-label="Type the code from your other device" />View accessible code
<input type="email" autocomplete="username" />
<input type="password" autocomplete="current-password" spellcheck="false" autocapitalize="none" />
<button type="button">Sign in with a passkey</button>
<input inputmode="numeric" autocomplete="one-time-code" />Flow-level decision guide
- Identify every memory, transcription, calculation, puzzle, or recognition task.
- Determine whether a password manager, paste, autofill, WebAuthn, or another method removes that task.
- Test the alternative across devices; a link or code still creates a transcription burden if the receiving platform cannot populate it.
- Document any object-recognition or personal-content exception and retain a non-cognitive route where practical.
- Test recovery and step-up authentication, not only initial sign-in.