Skip to main content :::
:::

What Is Accessible Authentication?

Accessible authentication reduces the need to memorize, transcribe, or solve puzzles to sign in. Learn the WCAG 2.2 AA/AAA distinction and how to check password managers, pasting, and account recovery.

Last updated:

Key Takeaways

  • Check every authentication step, including sign-in, multi-factor verification, and account recovery.
  • WCAG 2.2 3.3.8 (AA) and 3.3.9 (AAA) have different cognitive-test exceptions.
  • One-time codes do not automatically meet the requirement; check that the whole code can be pasted or autofilled.

Why login flows matter

Many important services sit behind login. Even if public pages are accessible, people still cannot complete the task if login, two-factor authentication, or account recovery blocks them.

These barriers affect people with visual, cognitive, memory, motor, or assistive technology needs. They can also affect anyone using a mobile device, recovering from injury, or acting under pressure.

How do AA and AAA differ?

3.3.8 (AA) requires authentication without a cognitive function test unless there is a non-cognitive alternative, assistance mechanism, object-recognition exception, or recognition of non-text content previously supplied by the user. Transcribing distorted text or solving arithmetic is not object recognition.

3.3.9 (AAA) does not retain the object-recognition and personal non-text content exceptions. These criteria concern authentication to existing accounts; registration still needs other accessibility checks.

Common risks

Accessible authentication does not mean removing security. It means avoiding security flows that only offer one difficult path.

  • Transcription, recall, or puzzles without a qualifying alternative or assistance mechanism.
  • Password managers, copy and paste, or one-time-code autofill are blocked.
  • Users must remember complex information without a usable alternative.
  • Verification errors are unclear and do not explain what to do next.
  • Timeouts are too short, or entered data is lost after reauthentication.

What teams can check first

Walk through sign-in, multi-factor verification, and account recovery. For example, pasting a code into six separate boxes should populate the whole code, not only the first box. Also test password managers, keyboard use, errors, and data preservation after timeouts; these involve other criteria too.

DevCheck can help with page-level scans and simulations, but whether the authentication task can actually be completed still needs manual operation and real testing.

Frequently Asked Questions

Does accessible authentication mean CAPTCHAs are forbidden?

Not categorically. AA has specified exceptions; an audio version that still requires transcription is not a non-cognitive alternative. Assess the actual method, target level, and other accessibility requirements.

Are one-time codes (OTP) the same as CAPTCHA?

No. A one-time code is a temporary code used for authentication; a CAPTCHA tries to distinguish a person from an automated program and may involve image recognition, transcription or a puzzle. They pose different review questions. When a sign-in flow uses a one-time code, check that the whole code can be pasted or autofilled, and assess the other applicable accessibility requirements.

Is this a WCAG 2.2 requirement?

Yes. 3.3.8 is AA and 3.3.9 is AAA. They are not identical, and password-manager and paste support must work in the actual flow.

Related Pages

References