Understandable · 3.3 Input Assistance
No authentication step may require a cognitive function test, such as remembering or transcribing a password or solving a puzzle, unless it offers another method or a mechanism to assist, such as paste and password manager support, or the test is recognizing objects or non-text content the user provided.
Live demo
The same task, done two ways: switch between the version that passes and the one that fails, or put them side by side. Everything in the box is live, so try it with a keyboard, a pointer or a screen reader.
In each version, press Fill with a password manager, or copy a password and paste it. Then try to finish signing in.
The tools follow the version you last used.
What happened
Why it passes
A password manager or paste fills in the password, Show password lets you check it, and there is no puzzle. You can also skip the password and get a sign-in link by email.
Why it fails
The password box refuses paste and password managers, so you must remember the password and type it. Then you must copy distorted letters from a picture, which many people with dyslexia or memory problems cannot do.
Examples
Five examples, each one running: the usual ways this criterion fails, and code that passes. Listen to them, measure them, or copy the code.
Fails
Live preview
<label for="password">Password</label><input id="password" name="password" type="password" onpaste="return false">People who copy their password from a password manager or a note cannot paste it. They must remember it and type it, a cognitive function test with no help.
Passes
Live preview
<label for="username">Email address</label><input id="username" name="username" type="email" autocomplete="username"><label for="password">Password</label><input id="password" name="password" type="password" autocomplete="current-password">Paste is allowed, and the autocomplete tokens let browsers and password managers fill both fields, so nobody has to remember or retype the password.
Fails
Live preview
<img src="/captcha/7421.png" alt="Security check image"><label for="captcha">Type the characters in the image</label><input id="captcha" name="captcha" autocomplete="off"><button type="submit">Sign in</button>Copying distorted characters is a transcription test. With no other way to sign in, people with dyslexia or memory difficulties can be locked out.
Passes
Live preview
<form action="/sign-in/link" method="post"> <label for="link-email">Email address</label> <input id="link-email" name="email" type="email" autocomplete="username"> <button type="submit">Email me a sign-in link</button></form>The user can sign in by opening a link sent to their inbox instead of solving the puzzle. It is another method that needs no memory or transcription.
Passes
Live preview
<label for="otp">Enter the 6-digit code we sent to your phone</label><input id="otp" name="otp" inputmode="numeric" autocomplete="one-time-code" pattern="[0-9]{6}" maxlength="6">Paste works, and autocomplete="one-time-code" lets supporting browsers offer the code from the text message, so the user does not copy it digit by digit.
Why it matters
People with cognitive, memory, or learning disabilities such as dyslexia may be unable to recall passwords, transcribe codes, or solve puzzles, which can lock them out entirely. Supporting password managers, paste, and other methods lets them sign in independently.
W3C: Understanding 3.3.8How to test
A few concrete steps. Automated tools find some failures; most need a person.
Common failures