3.3 Input Assistance · SC 3.3.9

AAA2 min read

Accessible Authentication (Enhanced)

A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides an alternative authentication method that does not rely on a cognitive function test, or a mechanism is available to assist the user in completing the cognitive function test.

In plain language

This is a stricter version of the login rule above: no authentication step can require someone to "memorize and figure it out on their own" — not even tasks like "pick the photos with a car in them." There must always be an alternative that doesn't depend on memory or reasoning, like biometrics or a support mechanism.

Why it matters

Tests like "memorize a password" or "recognize objects in images" (CAPTCHA-style) exclude people with cognitive, memory, or learning disabilities, even when some kind of "help" exists. This stricter version guarantees there's always a login path that doesn't depend on that kind of mental effort.

In practice

Fails this criterion

To confirm identity, the site asks the user to select all the images containing a car (CAPTCHA-style), with no alternative login method available.

Meets this criterion

The site lets people sign in using their fingerprint or face recognition on their phone or computer, or accepts a password manager with auto-fill — never requiring the person to memorize or solve something on their own.

Test it yourself

Go through the site's login and identity-verification flow. If at any point the only option is to "memorize and type" a password or solve a visual test (like picking images), with no alternative (biometrics, password manager, etc.), this criterion is failing.

Read SC 3.3.9 on the official WCAG 2.2 specification ↗