This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung
Accessibility
What makes a sign-in process on a website accessible?
A sign-in process is accessible if it works without any memory or puzzle-solving effort. The customer must be able to paste their password from a password manager instead of knowing it by heart; nobody should have to type out distorted characters or transfer character strings between devices. Criterion 3.3.8, newly introduced with WCAG 2.2, calls such hurdles cognitive function tests — and requires that sign-in be possible without them, or that an alternative be offered.
Memory tasks lock customers out
Remembering a password and typing it in without errors is a memory test — often an insurmountable one for people with dementia, learning difficulties, concentration disorders, or after a stroke. The same applies to typing a code from a phone into a computer, or solving distorted character puzzles. The criterion doesn't ban passwords: it requires that a route exist without any memory effort of one's own. In practice, often very little is needed. The sign-in fields allow pasting from the clipboard and automatic filling by password managers. Alternatively, modern routes such as a sign-in link by email or a passkey carry the sign-in entirely without any memory effort. A sign-in field that blocks pasting, on the other hand, directly violates the criterion.
How the audit service checks accessible authentication
Whether sign-in without memory effort is possible is decided by the complete sign-in journey: what steps the website requires, whether every field allows pasting, whether a password manager engages, whether an alternative route exists. An automated single-page measurement without a real customer account can't fully go through this journey. Our report therefore openly marks criterion 3.3.8 as a manual check point. At the Gold Standard level, a human checks the sign-in flow step by step: testing pasting into the fields, behaviour with a password manager, and the presence of puzzle or copy-typing tasks. The report thus honestly states what was measured and what was judged by a human.
Examples
Registration with image captcha and insertion lock
<input type="password" onpaste="return false" autocomplete="off">
<img src="captcha.png" alt="Zeichen abtippen"><input type="password" autocomplete="current-password">
<!-- Passwortmanager darf einfügen; Schutz vor Bots über ein unsichtbares Verfahren oder Passkey -->Memorizing, typing and puzzling are cognitive tests. Allowed to remain at level AA object recognition and own content; Everything else needs a different path.
- Test your sign-in form with copy and paste — both fields must accept pasted characters.
- Check whether a common password manager recognises your fields and fills them in automatically.
- Replace puzzle tasks with distorted characters with invisible protection methods or a simple confirmation.
- Offer a sign-in route with no memory effort, such as a sign-in link by email or a passkey.
- Avoid prompts that have customers type codes from one device onto another — pasting and automatic transfer must remain possible.
