Accessible Authentication: WCAG Exceptions and Methods That Pass

Accessible authentication under WCAG means that no step of a login flow can require a cognitive function test — remembering a password, transcribing a code, solving a puzzle — unless the system provides at least one of four defined exceptions. This rule comes from Success Criterion 3.3.8 at Level AA and, in a stricter form, SC 3.3.9 at Level AAA in WCAG 2.2.¹ It applies to every authentication touchpoint: initial login, password reset, two-factor prompts, and any re-authentication triggered by a session timeout.²

What Counts as a Cognitive Function Test

WCAG treats a cognitive function test as any task that asks the user to remember, manipulate, or transcribe information.² The category is wider than most developers assume.

Recalling a password, PIN, or unlock pattern set up previously.
Typing characters from a distorted CAPTCHA image, or entering a code sent by SMS or authenticator app.
Solving a math problem embedded in a challenge.
Spelling a specific word to verify identity.
Completing any logic or pattern puzzle to prove humanity.

Security questions fall in as well. Asking for the name of a first pet or the street a user grew up on demands recall of a specific stored fact, which is exactly the burden the criterion targets.

One carve-out: typing your own name, email address, or phone number does not count. These are stable personal identifiers, not arbitrary secrets, and users generally have them memorized or autofilled everywhere they go.² A form that collects only an email address before dispatching a login link avoids the cognitive test problem from the start.

The Four Exceptions at Level AA

SC 3.3.8 does not ban cognitive tests outright. It bans requiring one without a safety valve. A step involving a cognitive test passes Level AA if any single exception applies.¹

Alternative Method

The site offers another login route that has no cognitive test. A password form is fine if the user can instead choose biometric login, a magic link, or a hardware key. The password field itself is still a cognitive test, but it is never the only path.²

Mechanism to Assist

A tool helps the user get through the cognitive test. This is the most common compliance path and the one most sites break. Supporting password managers is the textbook case: proper autocomplete attributes and standard input types let browsers and third-party managers fill credentials automatically, so nothing has to be recalled.²

Copy-paste counts too. Users who keep credentials in a standalone manager have to paste them in. Blocking paste in a password field fails the criterion. Asking for “the 3rd, 4th, and 6th character of your password” fails as well, because no password manager can handle that pattern and the user is forced back into manual transcription.²

Object Recognition

The test involves identifying everyday objects rather than solving a puzzle. An image grid asking users to select all pictures with bicycles or cars passes at Level AA because the task depends on ordinary visual recognition, not memory or calculation.²

Personal Content

The user identifies non-text content they supplied during account setup. A common form is uploading a photo at registration and later picking it from a set of alternatives. The words “non-text” carry weight here. Asking a user to remember a word or phrase they chose during setup does not qualify, because that is recall and transcription — the exact burden the criterion is designed to remove. Only image or other non-text content works.²

How Level AAA Tightens the Rules

SC 3.3.9 (Accessible Authentication — Enhanced) keeps the same prohibition but removes two exceptions. Only alternative method and mechanism to assist remain.¹ An image-grid CAPTCHA that passes Level AA fails at Level AAA. A login that relies on the user picking their uploaded photo also fails. Meeting AAA generally means leaning entirely on password managers, passkeys, biometrics, hardware keys, or third-party sign-in.

Authentication Methods That Pass

The strongest strategy is offering more than one path. Several approaches satisfy the criteria on their own.

Password Managers and Paste Support

A traditional username-and-password form can pass SC 3.3.8 provided the site does not block password managers or disable paste. Fields need proper autocomplete attributes and standard input types so browsers and third-party managers can identify and fill them. A script that actively blocks autofill takes the mechanism-to-assist exception off the table and fails the criterion.²

Passkeys and Biometrics

Passkeys built on the FIDO2/WebAuthn standard replace passwords with cryptographic key pairs stored on the user’s device. The user approves a login with a fingerprint, face scan, or device PIN. No password to recall, no code to type. This satisfies both Level AA and Level AAA.

Hardware Security Keys

A physical key plugged into a USB port or tapped against a phone completes authentication with a touch. No memorization, no typing, no puzzle. These keys also resist phishing because the authentication is bound to the legitimate domain. Popular models run roughly $20 to $70, with biometric versions higher.

Email Magic Links

A one-time login link sent to a registered email address removes the password entirely. The user clicks the link and is authenticated. It stays compliant as long as the destination page does not add its own transcription or puzzle step.

Third-Party Login

Offering OAuth-based sign-in through a provider like Google or Apple is recognized by the W3C as a compliant path.² The cognitive burden moves to the provider, which typically handles it through passkeys, biometrics, or saved browser credentials.

Where Two-Factor Authentication Breaks

Many login flows handle the first factor well and then collapse at the second. If the user has to read a six-digit code from an SMS or authenticator app and type it into the site, that is transcription, which is a cognitive function test.²

Two-factor is not the problem; the transcription step is. Accept pasted codes in the verification input. Watch for interfaces that split a six-digit code across six single-character boxes — these often break paste and turn a copyable code back into a manual typing task. Better options remove the code entirely: push notifications that ask the user to tap “approve” on a phone, or a hardware key that handles the second factor with a physical touch.

An Implementation Checklist

Test paste everywhere. Open every login, registration, password reset, and two-factor field and try pasting into each one. Paste blocking is the single most common failure point in authentication accessibility.
Set autocomplete attributes correctly. Login fields need values such as username, current-password, and one-time-code so browsers and password managers can identify them.
Offer at least one non-cognitive login path. Passkeys, hardware keys, magic links, or OAuth all qualify. One well-implemented alternative simplifies the whole compliance picture.
Keep verification codes in a single input. Splitting a numeric code across separate boxes frequently breaks paste behavior.
Test with real assistive technology. Screen readers, switch devices, and voice control tools each interact with login forms differently, and automated scanners will not catch what a user relying on those tools actually experiences.

Why Compliance Matters

WCAG is a technical standard, but several legal frameworks either adopt it or use it as the benchmark. The Department of Justice treats the ADA as covering websites and digital services, and its guidance points to WCAG as the yardstick for whether a site is accessible.³⁴⁵⁶

Enforcement is active. The DOJ has brought actions and reached settlements with public and private entities over inaccessible web content, and private class actions have produced multi-million-dollar payouts alongside remediation costs.³ Authentication systems that block password managers or hide behind CAPTCHAs are exactly the concrete, easily documented barrier that draws complaints.

1
World Wide Web Consortium (W3C). Web Content Accessibility Guidelines (WCAG) 2.2
2
World Wide Web Consortium (W3C). Understanding Success Criterion 3.3.8 – Accessible Authentication (Minimum)
3
ADA.gov. Guidance on Web Accessibility and the ADA
4
Section508.gov. Applicability and Conformance Requirements
5
ADA.gov. Fact Sheet – New Rule on the Accessibility of Web Content and Mobile Apps Provided by State and Local Governments
6
Federal Register. Extension of Compliance Dates for Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities