Understandable · 3.3 Input Assistance

Accessible Authentication (Enhanced) WCAG 3.3.9 · Level AAA

No authentication step may require a cognitive function test, such as remembering or transcribing a password or solving a puzzle, unless another method or a mechanism to assist is offered. Unlike 3.3.8, object recognition and personal content tests are not exceptions.

Level
AAA
Since
WCAG 2.2
Principle
Understandable
Guideline
3.3 Input Assistance
Try the live demo All criteria Checklist

Live demo

Sign in without a picture test

The same task, done two ways: switch between the version that passes and the one that fails, or put them side by side. Everything in the box is live, so try it with a keyboard, a pointer or a screen reader.

Use Fill with a password manager to sign in to each version. Notice which one also asks you to recognize a picture before you can continue.

Live example

Passes

Sign in to online banking

Or sign in without a password:

What happened

    Why it passes

    A password manager can fill in the password, and there is no picture or puzzle to solve. You can also sign in with a link sent to your email.

    Why it fails

    Paste and password managers work here, so this would pass level AA. But you must also recognize a picture of a boat, with no other way to sign in, and that fails the enhanced level.

    Examples

    Code that fails, and the fix

    Five examples, each one running: the usual ways this criterion fails, and code that passes. Listen to them, measure them, or copy the code.

    01

    Fails

    Picture puzzle with no other way in

    Live preview

    HTML
    <fieldset>  <legend>Select every picture that shows a bicycle</legend>  <label><input type="checkbox" name="tile" value="1"><img src="/captcha/tile-1.jpg" alt="Picture 1"></label>  <label><input type="checkbox" name="tile" value="2"><img src="/captcha/tile-2.jpg" alt="Picture 2"></label>  <label><input type="checkbox" name="tile" value="3"><img src="/captcha/tile-3.jpg" alt="Picture 3"></label>  <label><input type="checkbox" name="tile" value="4"><img src="/captcha/tile-4.jpg" alt="Picture 4"></label></fieldset>

    Recognizing objects is an allowed exception at level AA (3.3.8) but not at AAA. With no other method offered, this step fails 3.3.9.

    Passes

    Sign-in link with no test at all

    Live preview

    HTML
    <form action="/sign-in/link" method="post">  <label for="link-email">Email address</label>  <input id="link-email" name="email" type="email" autocomplete="username">  <button type="submit">Email me a sign-in link</button></form>

    Opening a link from the inbox needs no memory, transcription or recognition, so it is an alternative that meets the enhanced level.

    Fails

    Choosing your own photo from a set

    Live preview

    HTML
    <fieldset>  <legend>Choose the photo you uploaded when you opened your account</legend>  <label><input type="radio" name="photo" value="a"><img src="/security/photo-a.jpg" alt="Photo A"></label>  <label><input type="radio" name="photo" value="b"><img src="/security/photo-b.jpg" alt="Photo B"></label>  <label><input type="radio" name="photo" value="c"><img src="/security/photo-c.jpg" alt="Photo C"></label></fieldset>

    Identifying content the user supplied is an exception at AA but not at AAA, and it depends on memory. Without another method, it fails.

    Passes

    Passkey sign-in with WebAuthn

    Live preview

    JavaScript
    async function signInWithPasskey() {  const options = await (await fetch("/api/passkey/options")).json();  const credential = await navigator.credentials.get({    publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options)  });  await fetch("/api/passkey/verify", {    method: "POST",    headers: { "Content-Type": "application/json" },    body: JSON.stringify(credential.toJSON())  });}

    The browser and the user's device handle sign-in with a passkey. The page asks for nothing to remember, transcribe or recognize.

    Passes

    A password that can be filled still passes

    Live preview

    HTML
    <label for="password">Password</label><input id="password" name="password" type="password"       autocomplete="current-password">

    A password still meets 3.3.9 when paste and password managers work, because they are a mechanism that removes the need to remember it.

    Why it matters

    Who it helps

    Some people with cognitive disabilities cannot reliably recognize objects in images or identify content they supplied earlier. Removing those exceptions ensures everyone has a way to sign in without any memory, transcription, or puzzle task.

    W3C: Understanding 3.3.9

    • Level AAA

      Level AAA is the highest level. It is not required for whole sites, but it is worth meeting where you can.

    • In WCAG versions

      New in WCAG 2.2, published in October 2023.

      No WCAG 1.0 checkpoint maps to it.

    • Where it is required

      No law on this site requires Level AAA criteria for whole sites.

    How to test

    Checking it

    A few concrete steps. Automated tools find some failures; most need a person.

    1. Go through every authentication step, including sign-up and account recovery, and note any memory, transcription, recognition, or puzzle task.
    2. Confirm each such step offers another method or an assisting mechanism, such as password manager and paste support, an email link, or a passkey.
    3. Check that image or object recognition challenges are never the only option.

    Common failures

    Where it breaks

    • An image CAPTCHA asking the user to select every square with traffic lights is the only way to continue.
    • Sign-in requires picking the user's own previously uploaded photo from a set, with no alternative.
    • The password field blocks paste and autofill, so the password must be remembered and typed.

    Related