Accessibility

3.3.8 - Accessible authentication (minimum)

Benefits users with:

  • cognitive abilities

Examples

Alternative way

  • Users can sign in via email verification link.
  • Multiple two-factor authentication options, including a USB method (e.g. dongle) where users press a button to enter a token.
  • A website with two-factor authentication lets users scan a QR code with an app to verify their identity.
  • Users can sign in via biometric authentication:
    • Fingerprint scan (e.g., unlocking a phone with a fingerprint)
    • Face recognition (e.g., Face ID on iPhones)
    • Iris scan (eye recognition technology)
    • Voice recognition (e.g., using voice commands to authenticate)

Note for audio CAPCHA - The audio CAPTCHA (where users listen to a series of spoken characters and type them out) does not count as an acceptable alternative under WCAG’s Alternative Exception for accessible authentication. It still requires users to remember and type a sequence of characters, which is a cognitive function test (not accessible to users with memory, hearing, or processing difficulties). It does not provide a different method that avoids transcription or recall challenges.

Alternative way

  • A password manager can auto-fill credentials for users who have difficulty remembering them.
  • Allows pasting, enabling users to copy credentials from a password manager.

Object recognition

Users select a familiar photo (e.g., “Click on the photo of your pet”) instead of typing a password.

Personal content

Users answer a personalized question (e.g., “What is your favorite food?”) instead of solving a CAPTCHA.