3.3.9 Accessible Authentication (Enhanced)

Who it helps

Some people with cognitive, visual or perceptual disabilities cannot reliably pick out objects in images or recognize their own uploaded photo among others. Removing those tests lets them log in without depending on recognition or memory.

How to meet it

• Meet 3.3.8 first: allow paste and autofill, and mark up fields with autocomplete="username" and autocomplete="current-password".
• Replace image CAPTCHAs such as "select all the traffic lights" with checks that need no user task, or offer a method that skips them.
• Do not use "pick the photo you uploaded" as a login step unless another method without a cognitive test is offered.
• Offer passkeys (WebAuthn), an email sign-in link or approval on a trusted device.

Examples

<form action="/login" method="post">
  <!-- username and password fields -->
  <fieldset>
    <legend>Select every image that contains a bicycle</legend>
    <!-- grid of nine image checkboxes -->
  </fieldset>
  <button type="submit">Log in</button>
</form>

<form action="/login/link" method="post">
  <label for="email">Email</label>
  <input id="email" type="email" name="email" autocomplete="username webauthn">
  <button type="submit">Email me a sign-in link</button>
</form>
<button type="button" id="passkey-login">Sign in with a passkey</button>

Common mistakes

• Assuming a site that passes 3.3.8 also passes 3.3.9, when it still relies on an image CAPTCHA.
• Using a "choose your security image" step as a second factor with no alternative.
• Offering an accessible login but a recovery flow that asks users to recall security answers.

Related criteria

• 3.3.8 Accessible Authentication (Minimum)
• 1.1.1 Non-text Content
• 1.3.5 Identify Input Purpose

Official W3C explanation of 3.3.9