Level AA · WCAG 2.2
3.3.8 Accessible Authentication (Minimum)
Authentication does not depend on a cognitive function test — remembering, transcribing or solving a puzzle — unless there is an alternative.
Manual only No automated check says anything useful.
How it fails in practice
A login that blocks paste into the password field, so a password manager cannot be used. An image CAPTCHA with no other route through.
How to fix it
Allow paste. Support passkeys or email links. If you use a CAPTCHA, offer a non-puzzle alternative alongside it.
At a glance
- Level
- Level AA — the level EN 301 549 requires, and therefore the level the BFSG and the EAA are measured against.
- Principle
- Understandable
- Guideline
- 3.3 Input Assistance
- Added in
- WCAG 2.2
- EN 301 549
- Not referenced in EN 301 549 v3.2.1
- Automated check
- Manual only
Manual only
How far an automated check gets
Nothing automatic decides this. A scanner that reports it as passing is reporting that it did not look. It stays untested until a person tests it and records what they did — which is exactly how we treat it: as untested, not as passed.
Related criteria
Other criteria under the same guideline.
Find out which criteria your site fails
We scan up to 100 pages against WCAG 2.2 AA, run the agent protocol on one key journey and send you the report — free, once, no strings.