Understandable · Level AA · 3.3.8
Accessible Authentication (Minimum)
Logging in shouldn't require a cognitive function test — memorizing a password, solving a puzzle, transcribing a code from another device, doing arithmetic — unless an alternative that doesn't require it is also offered, or the test is limited to recognizing objects or the user's own personal content.
- Cognitive
How to recognize it
Look at the login flow itself: a password field alone isn't a violation as long as the browser's password manager and paste are allowed to work (letting autofill and paste function is what makes memorizing the password itself not required); the failure is when something actively blocks that path — a login form that disables pasting into the password field, forcing the user to actually type and therefore remember it, or a puzzle CAPTCHA that requires solving a visual logic problem to proceed, or a two-factor flow that requires manually retyping a six-digit code read off another screen rather than allowing autofill or copy-paste. People with memory-related cognitive disabilities, dyslexia, or dyscalculia are the ones this protects — a login step that quietly assumes everyone can memorize an arbitrary string or perform quick mental arithmetic under time pressure is a real barrier for them, distinct from a simple inconvenience for everyone else.
How to fix it
Allow password managers, browser autofill, and copy-paste into every authentication field rather than disabling them — that alone typically resolves the 'don't force memorization' requirement even while a password field is still present. For two-factor codes, allow the code to be pasted or autofilled instead of requiring it to be manually retyped from another device. If a genuinely memory- or puzzle-based step is unavoidable, offer an alternative authentication path that doesn't require it — email magic links, WebAuthn/passkeys, or an object-recognition or personal-photo-recognition step are all acceptable alternatives that don't rely on memorization.
Example
Avoid
<input type="password" onpaste="return false;">
<!-- blocks pasting, forcing the user to manually recall and type the password -->Prefer
<input type="password" autocomplete="current-password">
<!-- paste and password-manager autofill both work -->