Level AA · WCAG 2.2
3.3.8 Accessible Authentication (Minimum)
Authentication does not depend on a cognitive function test — remembering, transcribing or solving a puzzle — unless there is an alternative.
Partly automated Some failures are detectable, others need judgement.
How it fails in practice
A login that blocks paste into the password field, so a password manager cannot be used. An image CAPTCHA with no other route through.
How to fix it
Allow paste. Support passkeys or email links. If you use a CAPTCHA, offer a non-puzzle alternative alongside it.
At a glance
- Level
- Level AA — the level EN 301 549 requires, and therefore the level the BFSG and the EAA are measured against.
- Principle
- Understandable
- Guideline
- 3.3 Input Assistance
- Added in
- WCAG 2.2
- EN 301 549
- Not referenced in EN 301 549 v3.2.1
- Automated check
- Partly automated
Partly automated
How far an automated check gets
A tool finds some failures here and cannot see the rest. A clean automated result means the checks that exist found nothing — not that the criterion is met. This is the gap that makes a green scan look like an accessible site, and it is where the keyboard agent, the agents still in development and a human reviewer do the remaining work.
Where it matters most
The guides that list it among the criteria to check first.
Related criteria
Other criteria under the same guideline.
Find out which criteria your site fails
We scan up to 100 pages against WCAG 2.2 AA, send the keyboard agent through the page you name and email you the report — free, once, no strings.