WCAG 3.3.8: Accessible Authentication (Minimum)

How to

• Login without cognitive function test

  Ensure that users do not have to memorize their passwords. You can achieve this by allowing login data to be entered via copy and paste or through password managers.

  Alternatively, the following methods can be offered:

  • Login via third-party providers (OAuth)

  • Biometric authentication on the user’s own device, such as fingerprint or facial recognition (which must also have an accessible alternative)

  • QR code scan from another device

  Technique(s):

  • H100: Providing properly marked up email and password inputs
  

Notes

• Exception: Image CAPTCHAs

  Image CAPTCHAs may still be used if users need to select an animal or a specific object, for example. These are not considered cognitive function tests. However, the image CAPTCHA must be accessible, for example, by providing an accessible audio alternative.

  Other types of CAPTCHAs, such as text challenges, math problems, or puzzles, are not allowed.

  And one more thing: all users hate CAPTCHAs! It’s best to avoid them altogether.

  

• 

  Hint: Two-factor authentication

  For two-factor authentication, it must be ensured that the second factor can be entered via copy and paste or automatically.

  Example: If a code is sent by SMS or email, the code must be copyable and pasteable into the input field, or automatically transferred.

  Operating systems often handle this automatically. Passkeys are also a useful option for simple and highly secure authentication.