Authentication must not depend on a cognitive-function test
Rule
accessible-authentication· Forms · impact serious · Static + live
Why it matters
An authentication step that forces the user to recall or transcribe something — a password typed from memory (paste and password managers blocked), or a CAPTCHA that asks them to read distorted characters or pick out images — is a cognitive-function test, and can lock out people with cognitive disabilities. Only inline signals are visible to static analysis: a password field with no valid (or a suppressing) autocomplete token, and well-known CAPTCHA scripts/iframes or challenge copy, so a clean result here is not proof of conformance.
How to fix
Set autocomplete="current-password" (or "new-password") on password fields and never block paste. For any CAPTCHA, offer an accessible alternative authentication method, or use a mechanism (device, token, passkey) that needs no cognitive test.
Example
<form><input type="password"></form>
<form><input type="password" autocomplete="current-password"></form>
Example
<form><input type="password" autocomplete="current-password"><script src="https://www.google.com/recaptcha/api.js"></script><button>Login</button></form>
<form><input type="password" autocomplete="current-password"><button>Login</button></form>
Challenge CAPTCHAs are only flagged in an authentication context; invisible score-based reCAPTCHA v3 (api.js?render=…) shows no challenge and is not flagged.
WCAG success criteria
3.3.8 Accessible Authentication (Minimum) — Level AA
An authentication step must not rely on a cognitive function test (remembering a password, solving a puzzle, transcribing characters) unless an accessible alternative is offered — e.g. let password managers and paste fill the field, or provide a non-cognitive way to sign in.
Standards
This rule contributes to the following standards:
WCAG AA EN 301 549
| Standard | Criteria |
|---|---|
| EN 301 549 | 9.3.3.8 |