What this criterion requires
No step of authentication may require a cognitive function test (memorizing, transcribing, solving puzzles) unless an alternative method exists, a mechanism assists, or the test is object/personal-content recognition.
Who it helps
People with cognitive disabilities, for whom memorized passwords and transcription CAPTCHAs are hard barriers.
Example: fails vs passes
/* paste allowed - password managers work */
<a href="/magic-link">Email me a sign-in link instead</a>New in 2.2: no memorization or transcription tests without an alternative. Let password managers and copy-paste work.
How to meet and fix it
- Allow paste in password fields and support password managers (no copy-paste blocking)
- Offer email magic links, passkeys/WebAuthn or OAuth as alternatives
- Avoid transcription CAPTCHAs; if challenge is needed, use object recognition
Common failures auditors find
- Blocking paste on password or OTP fields
- Login gated by a distorted-text CAPTCHA with no alternative
Automated scanning catches a share of these instantly - run a free check - and a manual audit covers the judgement calls a tool cannot make.
- W3C, Understanding 3.3.8: Accessible Authentication (Minimum) - w3.org/WAI
- W3C, How to Meet 3.3.8 (quick reference) - w3.org/WAI/quickref
Last updated . Reviewed by the EqualWeb accessibility team.
Does your site pass 3.3.8?
Run a free automated check now, or have certified IAAP/CPWA auditors test every criterion and document the result.