3.3.8 Accessible Authentication (Minimum)

Who it helps

People with cognitive, memory or learning disabilities may be unable to remember passwords, retype one-time codes or solve puzzles. People with dyslexia or dyscalculia struggle to transcribe characters. Letting password managers and paste work removes the barrier for them.

How to meet it

• Mark up username and password fields with labels and autocomplete="username" and autocomplete="current-password" so browsers and password managers can fill them.
• Never block paste in login, password or code fields, and do not turn autofill off with scripts.
• Use one input with autocomplete="one-time-code" for verification codes, so users can paste or auto-fill the whole code.
• Offer a method that needs no recall, such as an email sign-in link, passkeys (WebAuthn) or a push approval on a phone.
• If you use a CAPTCHA, offer a path that is not a cognitive test. Object recognition or choosing a photo the user uploaded is allowed at this level.
• Do not ask for parts of a password, such as the 2nd and 5th characters, since users cannot paste those.

Examples

<label for="pw">Password</label>
<input id="pw" type="password" autocomplete="off" onpaste="return false">

<fieldset>
  <legend>Enter the code we texted you</legend>
  <input aria-label="Digit 1" maxlength="1" inputmode="numeric">
  <input aria-label="Digit 2" maxlength="1" inputmode="numeric">
  <!-- ...four more one-digit inputs -->
</fieldset>

<label for="user">Email</label>
<input id="user" type="email" name="username" autocomplete="username">
<label for="pw">Password</label>
<input id="pw" type="password" name="password" autocomplete="current-password">

<label for="otp">Enter the 6-digit code we texted you</label>
<input id="otp" name="otp" inputmode="numeric" autocomplete="one-time-code"
       pattern="[0-9]{6}" maxlength="6">

Common mistakes

• Blocking paste on password fields in the belief that it improves security.
• Splitting a one-time code into separate boxes that reject a pasted code.
• Using a text CAPTCHA as the only way past the login form.
• Asking users to type specific characters of their password or a security answer from memory with no alternative.

Related criteria

• 3.3.9 Accessible Authentication (Enhanced)
• 1.3.5 Identify Input Purpose
• 4.1.2 Name, Role, Value
• 3.3.7 Redundant Entry

Official W3C explanation of 3.3.8