3.3.9 Accessible Authentication (Enhanced)

1. What is the goal of this criterion?

Forgetting passwords is as much a part of digital life today as coffee is part of the morning. But what if, on top of that, you have to solve puzzles, recognise objects or tackle complicated tasks just to log in? For people with cognitive disabilities, that can be an insurmountable barrier.

The goal of WCAG Success Criterion 3.3.9 is to make authentication as accessible as possible – without you having to prove your memory skills or solve visual puzzles. In short: logging in should work without your brain having to work overtime.

The criterion is new in WCAG 2.2 and sits at Level AAA.

2. What exactly does it require?

Success Criterion 3.3.9 is the enhanced version of Accessible Authentication (Minimum) and therefore even stricter: cognitive function tests aren’t allowed in any step of authentication – unless that step offers one of the following:

Alternative authentication method: another way to log in that doesn’t involve any cognitive test – e.g. passkeys/WebAuthn with a fingerprint or hardware key, or sign-in via a third-party provider.

Supporting mechanism: something that helps you complete the cognitive task – such as autofill by browsers or password managers and pasting from the clipboard.

What’s dropped compared with Level AA (3.3.8):

• No more exception for object recognition: “Click all images with cars” is no longer enough.
• No more exception for personal content: “Select the photo you uploaded” no longer works.

That means: either you offer an alternative with no cognitive test at all, or you help people complete the task.

3. Why does it matter for accessibility?

Imagine you want to log in to your online banking, but the system asks you to solve a puzzle or recognise certain images. For people with dyslexia, dyscalculia or memory difficulties, that can be frustrating or even impossible.

Accessible authentication enables participation because it:

• lets people with cognitive disabilities use digital services independently.
• reduces the stress and anxiety caused by complex login procedures.
• helps older people who may struggle with visual puzzles.
• supports people with dyslexia or other learning disabilities.
• accommodates people with attention deficits who find it hard to focus on complex tasks.

And last but not least: it makes authentication simpler, faster and easier for everyone.

4. How to meet the criterion

The good news: accessible authentication is often the most convenient kind too. Here are some proven strategies:

Make it password-manager friendly:

• Use labelled <input> fields with appropriate autocomplete attributes
• Never block pasting into password and code fields
• Use type="email" and type="password" so browsers recognise the fields

Use modern authentication methods:

• Passkeys/WebAuthn: fingerprint, face recognition or hardware keys
• Single sign-on: log in via trusted providers
• Login links by email: one click instead of a password
• Push approval: confirm with a tap on your smartphone

Get two-factor authentication right:

• Offer several options: authenticator app, push approval, hardware token, codes by text message or email
• Codes must be pasteable or autofillable (autocomplete="one-time-code") – having to type them in is a cognitive test
• Hardware tokens that only need a button press are especially accessible

What to avoid for Level AAA:

• Image selection tasks (“Select all traffic lights”) without an alternative
• Recognising your own images (“Which one is the profile picture you uploaded?”) without an alternative
• Arithmetic tasks or logic puzzles
• Memory tests for arbitrary information

Technical implementation:

<!-- Correct markup for password managers -->
<label for="email">Email address</label>
<input id="email" type="email" name="email" autocomplete="username" required>
<label for="password">Password</label>
<input id="password" type="password" name="password" autocomplete="current-password" required>

<!-- Offer alternative login options -->
<button type="button" onclick="loginWithPasskey()">Sign in with a passkey</button>
<button type="button" onclick="sendLoginLink()">Email me a login link</button>

5. Why this criterion matters for businesses

Even at Level AAA, accessible authentication isn’t just the right thing to do – it brings tangible benefits for your business.

1. Fewer drop-offs

Complicated login procedures are a typical reason people give up. A simple login lowers the barrier – on every single visit.

2. Lower support costs

“I can’t get in” is one of the typical support requests. Accessible login methods without forgotten passwords and locked accounts reduce these requests – and the costs that come with them.

3. Better security

Modern methods such as passkeys or hardware tokens aren’t just more accessible – they’re also considered more secure than classic passwords. You improve user experience and security at the same time.

On the legal side: 3.3.9 is a Level AAA criterion and new in WCAG 2.2. It isn’t explicitly required by the European Accessibility Act or its German implementation, the Barrierefreiheitsstärkungsgesetz (BFSG) – the harmonised standard EN 301 549 refers to WCAG 2.1 Level AA for web content. If you’re introducing passkeys or login links anyway, though, you’ll often meet it almost in passing. This section is general information, not legal advice.

6. The success criterion in the W3C’s words

Success Criterion 3.3.9 Accessible Authentication (Enhanced) (Level AAA)

A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides at least one of the following:

• Alternative: Another authentication method that does not rely on a cognitive function test.
• Mechanism: A mechanism is available to assist the user in completing the cognitive function test.

In short: no step in a login may force a cognitive test – unless there’s an alternative without a test or a mechanism that helps complete it. Object recognition and personal content no longer count as exceptions here.