Accessible authentication
A login that works with password managers, paste, passkeys, and autofill instead of demanding memory, transcription, or puzzles.
See it
What it is
Accessible authentication removes cognitive tests from signing in, or provides a route that does not depend on them. WCAG 2.2 criterion 3.3.8 covers tasks such as remembering a password, transcribing a one-time code, or solving a puzzle. Password managers, copy and paste, passkeys, and correctly marked-up fields let technology do that work for the user.
A strong flow supports WebAuthn passkeys, permits password-manager autofill, allows pasted credentials and codes, and labels every field. Use autocomplete='username', autocomplete='current-password', and autocomplete='one-time-code' so browsers and assistive tools recognize what belongs where.
Gotcha: forcing a new password to satisfy a composition riddle, blocking paste, or splitting a code into boxes that cannot accept the whole value turns routine login into a memory and transcription exam. The reCAPTCHA image grid, and the audio fallback behind it, is the canonical version of this barrier. WCAG's minimum criterion includes exceptions for object recognition and identifying personal content, but those exceptions are not proof that a CAPTCHA or photo challenge is usable. Keep a non-puzzle alternative.
Ask AI for it
Rebuild this sign-in flow to meet WCAG 2.2 criterion 3.3.8 Accessible Authentication (Minimum). Add WebAuthn passkeys through the Credential Management API, keep a password fallback that allows password-manager autofill and paste, and mark fields with autocomplete='username', autocomplete='current-password', and autocomplete='one-time-code' as appropriate. Let a full one-time code be pasted into one control, then distribute it internally if the visual design uses separate boxes. Remove image, memory, and logic puzzles from the primary path and provide a non-puzzle recovery route. Preserve generic credential error messages so the changes do not reveal whether an account exists.