Accessible Authentication: The Memory Test That Locks People Out

Accessible authentication is the criterion that names the login test that locks people out: a form that asks you to remember a password, solve a puzzle, or transcribe a code from another device, with no alternative. WCAG 2.2 success criterion 3.3.8, Level A, says authentication must not rely on a cognitive function test, unless an alternative is provided. The metric is simple, and the failure is everywhere.

The criterion, in plain terms

WCAG 2.2 added nine success criteria, and six of them are Level A or AA. Accessible authentication, 3.3.8, is Level A, and it is the one that names the login test that locks people out: authentication must not rely on a cognitive function test, such as remembering a password, solving a puzzle, or transcribing a code from another device, unless an alternative authentication method is provided, or a mechanism is available to assist the user. The classic example is a login that asks for a password and offers no alternative, and no way to use a password manager.

The exception is a mechanism that assists the user, such as a password manager, a copy-and-paste code, or a passkey. The point is not that passwords are forbidden. It is that a login that relies only on memory, with no alternative and no assistance, is a login that excludes the people who cannot remember, and the people who cannot solve puzzles, and the people who cannot transcribe a code from a phone to a laptop without error.

The metric that makes it visible

Count the authentication steps that require the user to remember, recall, or transcribe information, divided by the total steps in the flow. That is the accessible authentication rate, and it is the metric that makes the failure visible. A login that offers only a password scores badly. A login that offers a magic link, a passkey, or a copy-and-paste code scores zero, which is the target. The WebAIM Million 2026 report shows that form failures are among the most common accessibility defects on the web, and authentication is the place where the failure costs the most, because a shopper who cannot log in cannot buy.

The metric also catches the CAPTCHA. A CAPTCHA that asks the user to identify traffic lights or solve a puzzle is a cognitive function test, and it fails 3.3.8 unless an alternative is provided. A CAPTCHA that runs in the background, or that offers an audio alternative, is a different case. The test is whether the user has to do something cognitive to prove they are human, and whether there is another way.

Why it matters beyond the criterion

Accessible authentication is not just an accessibility failure. It is a conversion failure, because a shopper who cannot log in cannot complete an order, and a shopper who is locked out of their account does not create a new one, they buy from someone else. The login is the first step in the checkout for a returning customer, and a login that fails is a checkout that fails before it starts.

It is also a security failure in disguise. A login that relies only on a password, with no alternative, pushes users toward weak, reused passwords, because the memory load is the thing they are optimising for. A passkey or a magic link is more secure and more accessible at the same time, which is rare, and it is the reason the criterion exists.

The test that catches it

Try to log in with a password you do not remember, and see what happens. If the only recovery is to remember a different password, or to solve a puzzle, the login fails 3.3.8. If the recovery is a magic link, a passkey, or a code that can be copied and pasted, it passes. That is the whole test, and it takes one login to run.

Then do the same test on the password reset flow, because it is often built separately and fails differently. A reset that asks for the old password, or for the answer to a security question, is the same failure in a different flow, and the fix is the same: offer an alternative that does not rely on memory.

Frequently asked questions

Which WCAG criterion covers login tests?

WCAG 2.2 success criterion 3.3.8, Accessible Authentication, Level A. It requires that authentication does not rely on a cognitive function test, such as remembering a password or solving a puzzle, unless an alternative authentication method is provided, or a mechanism is available to assist the user.

How do you measure accessible authentication?

Count the authentication steps that require the user to remember, recall, or transcribe information, divided by the total steps in the flow. A login that offers only a password scores badly. A login that offers a magic link, a passkey, or a copy-and-paste code scores zero, which is the target.

Is a CAPTCHA an accessible authentication failure?

Yes, and it is the classic example. A CAPTCHA that asks the user to identify traffic lights or solve a puzzle is a cognitive function test, and it fails 3.3.8 unless an alternative is provided. A CAPTCHA that runs in the background, or that offers an audio alternative, is a different case.

What counts as an alternative to a memory test?

A passkey, a magic link sent by email, or a code that can be copied and pasted, not transcribed from memory. The mechanism that helps is one that removes the memory load, not one that makes it easier to remember. A password manager is the mechanism most users already have, and the login should not block it.