Success Criteria

WCAG 3.3.8 Accessible Authentication (Minimum)

Success Criterion 3.3.8 requires that a cognitive function test (remembering a password, solving a puzzle, transcribing a code) is not the only way to complete an authentication process, unless an alternative method, a mechanism to assist the user, or object recognition/personal-content identification is available. It's a Level AA criterion under Guideline 3.3 (Input Assistance), new in WCAG 2.2.

What counts as a "cognitive function test"

Anything requiring the user to remember, transcribe, or calculate something purely from memory to log in: memorizing a password with no way to see or paste it, solving a puzzle CAPTCHA, manually transcribing a code from an image or from a separate device. For people with certain cognitive or memory-related disabilities, these tasks can be a genuine barrier to logging in at all — not just an inconvenience.

The accepted alternatives (at least one required)

Alternative method — a login path not requiring the cognitive test, such as biometric authentication (fingerprint, face recognition) or a magic link sent by email.

Mechanism to assist — allowing password managers to autofill and paste credentials (rather than blocking paste in password fields, a pattern that actively defeats this accommodation), or offering "show password" toggles so users can visually verify what they typed rather than relying purely on memory of what they intended to type.

Object recognition — identifying non-text objects the user is already familiar with (a personal photo they uploaded, for instance) rather than an abstract memorized secret.

Personal content identification — identifying content the user personally provided (not a system-generated abstract test).

The most common real-world violation: blocking password paste

Disabling paste into password fields — sometimes done under a mistaken assumption that it improves security — actively works against password managers, forcing users to manually retype long, complex, memorized-nowhere passwords from memory. This is one of the most direct, common violations of this criterion, and removing the paste-blocking behavior (allowing password managers to function normally) is usually the single highest-impact, lowest-effort fix available for it.

What isn't required

This criterion doesn't ban passwords entirely — it requires that a cognitive test isn't the only path, and that reasonable assistive mechanisms (like paste support) aren't actively blocked.

Common questions

What is WCAG 3.3.8?

A Level AA criterion new in WCAG 2.2: login must not depend on a cognitive function test (recalling passwords, transcribing characters, solving puzzles) without an accessible alternative.

What satisfies the criterion?

Supporting password managers (allowing paste and browser autofill), offering passwordless or email-link login, or using recognition of objects or personal content instead of a memory or puzzle test.

Does it ban CAPTCHAs?

Not entirely, but a CAPTCHA requiring a cognitive puzzle fails unless an alternative method, or recognition of objects/non-text content, is also provided.