2 minute read

WCAG 3.3.8: Accessible Authentication (Minimum) (Level AA)

Imagine needing to access your account, but every login feels like a quiz: What’s your password? What’s your first pet’s name? What street did you live on in 1998?

Accessible Authentication (Minimum) ensures that logging in doesn’t rely on memory or complicated tests, so everyone can log in easily.

Who this impacts

  • People with cognitive impairments: Memory tests and complex CAPTCHAs can make authentication difficult or even impossible.
  • People with physical disabilities: Accessible login options reduce barriers for users who may struggle with traditional input methods.
  • Everyone: Simpler, more accessible authentication improves the experience for all users.

How to meet Accessible Authentication (Minimum)

  1. Avoid memory-based tasks: Users should not have to memorize passwords or recall answers to security questions to authenticate.
  2. Provide alternative login methods: Support authentication options like password managers, magic links, or biometric verification.
  3. Test for accessibility: Ensure all login methods work seamlessly with assistive technologies.

Practical example

Catbook offers to email magic links for login, so users can access their accounts without remembering passwords—or interrupting their nap time.

Example of magic link confirmation and email from Catbook.  The confirmation says Your paws are almost on the prize! We've sent a magic link to your inbox.  Use it to pounce back into Catbook faster than a cat chasing a laser pointer.  The link will expire in 24 hours, so be sure to get your paws on it.  The email reads, Hi there, fabulous feline!  This link will whisk(er) you away to your account - no passwords required.  Log into Catbook button, then if this wasn't you, no need to hiss - just ignore this email.

Top tips

  • Embrace password-free authentication: Magic links or biometric options make logging in easier for all users.
  • Simplify security measures: Use accessible CAPTCHAs or verification methods that don’t rely on complex tasks.
  • Do not disable paste: Password managers are amazing, but need the ability to cut and paste information into fields.
  • Test with assistive tech: Verify that all authentication methods are accessible and user-friendly

Further reading

Previous articleNext article
Back to top