This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Accessibility
What makes a sign-in process on a website accessible?
A sign-in process is accessible if it works without any memory or puzzle-solving effort. The customer must be able to paste their password from a password manager instead of knowing it by heart; nobody should have to type out distorted characters or transfer character strings between devices. Criterion 3.3.8, newly introduced with WCAG 2.2, calls such hurdles cognitive function tests — and requires that sign-in be possible without them, or that an alternative be offered.
Memory tasks lock customers out
Remembering a password and typing it in without errors is a memory test — often an insurmountable one for people with dementia, learning difficulties, concentration disorders, or after a stroke. The same applies to typing a code from a phone into a computer, or solving distorted character puzzles. The criterion doesn't ban passwords: it requires that a route exist without any memory effort of one's own. In practice, often very little is needed. The sign-in fields allow pasting from the clipboard and automatic filling by password managers. Alternatively, modern routes such as a sign-in link by email or a passkey carry the sign-in entirely without any memory effort. A sign-in field that blocks pasting, on the other hand, directly violates the criterion.
How the audit service checks accessible authentication
Whether sign-in without memory effort is possible is decided by the complete sign-in journey: what steps the website requires, whether every field allows pasting, whether a password manager engages, whether an alternative route exists. An automated single-page measurement without a real customer account can't fully go through this journey. Our report therefore openly marks criterion 3.3.8 as a manual check point. At the Gold Standard level, a human checks the sign-in flow step by step: testing pasting into the fields, behaviour with a password manager, and the presence of puzzle or copy-typing tasks. The report thus honestly states what was measured and what was judged by a human.
- Test your sign-in form with copy and paste — both fields must accept pasted characters.
- Check whether a common password manager recognises your fields and fills them in automatically.
- Replace puzzle tasks with distorted characters with invisible protection methods or a simple confirmation.
- Offer a sign-in route with no memory effort, such as a sign-in link by email or a passkey.
- Avoid prompts that have customers type codes from one device onto another — pasting and automatic transfer must remain possible.
FAQ
What is a cognitive function test during sign-in?
A cognitive function test is any task that requires memorising, copy-typing, or puzzle-solving: entering a password from memory, recognising distorted characters, copying a code from a phone, solving arithmetic problems. WCAG criterion 3.3.8 requires that sign-in be possible without such tests — or that an alternative such as password manager support or a sign-in link be available.
Are passwords still allowed under WCAG 2.2?
Passwords remain permitted. What matters is that nobody has to know them by heart and type them in by hand: the fields must allow pasting from the clipboard and automatic filling by password managers. That way, the tool carries the memory effort, and the human only has to decide. A field that technically blocks pasting violates criterion 3.3.8.
Does a character puzzle used as bot protection satisfy the criterion?
A puzzle with distorted characters is a cognitive function test and makes sign-in inaccessible if it's the only route. Protection methods that work without any memorising or recognition effort remain permitted — such as invisible background checks or a simple one-click confirmation. If the website offers an equivalent puzzle-free route alongside the puzzle, the criterion is met.