Accessible Authentication: The Metric Behind Passwordless Login

WCAG 2.2 criterion 3.3.8, Accessible Authentication (Minimum), is Level AA, and it says a login step must not require a cognitive function test unless an alternative or a mechanism to assist is available. A cognitive function test is remembering a password, transcribing characters, solving a puzzle, or recognising images. The criterion does not ban passwords. It bans a login that depends on memory alone, with no help offered.

Object-recognition CAPTCHAs, the click-the-traffic-lights kind, still pass at this level. The stricter version, 3.3.9 Accessible Authentication (Enhanced), is Level AAA, and it removes even those. For most sites the target is 3.3.8, and the bar is an alternative, not the abolition of every test.

No memory test without an alternative

Try logging in with a password manager. Then try pasting the password into the field by hand. Then try a passkey, or a magic link sent to email. If any of those is blocked, the path fails. A login that blocks password managers forces the shopper to remember and type the password, which is exactly the memory test the criterion forbids.

The test is per path, not per site. The main login, the password reset, and the account creation inside checkout are three different paths, and each one has to pass. A site that offers passkeys on the main login but blocks paste on the password reset has a failure on the reset path, and the metric catches it.

The test takes one login

Paste disabled in the password field is the most common blocker, and it is usually set by a well-meaning developer who thinks it improves security. It does the opposite: it forces the shopper to type a password they cannot see, and it blocks the password manager that would have filled it correctly. A CAPTCHA with no audio alternative is the second blocker, and a magic link that expires before the email arrives is the third.

Cloudflare Turnstile is worth knowing about here, because it runs no visual puzzle and satisfies the criterion out of the box. hCaptcha offers an accessibility mode on its paid tiers. Either one is a better answer than a puzzle CAPTCHA with no alternative, and both are cheaper than the lawsuit.

The usual blockers

The metric is the share of login paths that work with a password manager, a passkey, or a magic link. The target is 100 percent, because a single failing path is a single failing login, and the shopper who hits it does not care that the other paths work. Count the paths, test each one, and fix the blockers in order of how often the path is used.

Keep reading: Target Size Minimum: The 24 Pixel Rule Your Audit Keeps Missing, Focus Not Obscured: Measuring 2.4.11 Instead of Guessing.

The target is 100 percent of paths

Track the metric after the fix. A login that works with a password manager is also a login that works faster, and the completion rate usually moves with it. Accessibility and conversion point the same way here, which is not always true, and it is worth saying so when it is.

Frequently asked questions

What is WCAG 2.2 criterion 3.3.8?

Accessible Authentication (Minimum), Level AA: login must not depend on a cognitive function test, like remembering a password or solving a puzzle, without an alternative.

Does blocking paste in a password field fail WCAG 2.2?

Yes. It blocks password managers, which are the mechanism the criterion expects as the alternative to a memory test.

What counts as an alternative to a memory test?

A passkey, a magic link, or a password manager that can fill the field. Any one of them satisfies the criterion.

What is the difference between 3.3.8 and 3.3.9?

Criterion 3.3.9 is Level AAA and removes even object-recognition CAPTCHAs. Criterion 3.3.8, Level AA, still allows them.