Accessible Authentication: WCAG 3.3.8 and the End of the Puzzle Test
Try logging in to a store account and the site asks you to pick the traffic lights, or transcribe a distorted string, or remember a password you set three years ago with no help. For a user with a cognitive disability, that is not a security check. It is a locked door.
What 3.3.8 actually bans
Success Criterion 3.3.8, Accessible Authentication (Minimum), is Level AA in WCAG 2.2, and it says a cognitive function test must not be required unless an alternative is available, or help is available, or the test is needed to identify content the user owns. A cognitive function test is anything that asks the user to remember, manipulate, or transcribe information: a password from memory, a puzzle, a CAPTCHA that asks you to identify objects. The criterion does not ban authentication. It bans authentication that only works for people whose memory and processing are fully intact.
The exceptions are the whole design space. An alternative means the user can complete the step another way, like a magic link emailed to them instead of a password. Help means a mechanism is available to assist, like a password manager being allowed to fill the field, or a human support channel. Object recognition, like picking traffic lights, is explicitly a cognitive function test. So is transcribing a distorted string. A login that blocks pasting into the password field fails the help exception, because it blocks the password manager that is the help.
Passkeys are the clean answer, and the messy one is fine too
WebAuthn passkeys are the cleanest answer to 3.3.8, because they replace the memorized secret with a device-held credential and a biometric or PIN the user already uses. The user authenticates with the thing they have and the thing they are, not the thing they must remember. But a site does not need passkeys to pass. A magic link, a one-time code sent to an email or phone the user controls, or simply allowing paste and password managers, all satisfy the criterion when they are real alternatives, not decorative ones.
The audit for this criterion is short. Try to log in with a password manager and confirm paste works. Try the password reset flow and confirm it does not demand a puzzle. Check whether the CAPTCHA on the login page has an alternative, like an audio challenge or a magic link path, and confirm the alternative actually works rather than looping back to the same test. For the related authentication-adjacent work, see Section 508 vs WCAG 2.1: What Federal Buyers Actually Ask For, and for the demand-letter context, Watching an ADA Demand Letter: What It Actually Asks.
The objection, answered
The usual objection is fraud: without a puzzle, bots get in. The answer is that the criterion does not remove bot defenses, it moves them. Risk-based checks, device signals, rate limiting, and WebAuthn all keep bots out without asking a human to prove they can remember and transcribe. A CAPTCHA that blocks legitimate users is not a security control. It is a filter that keeps out the people the site is legally required to serve, and 3.3.8 is the criterion that says so in plain language.
Frequently asked questions
Is a CAPTCHA a cognitive function test under 3.3.8?
Yes, if it asks the user to recognize objects, transcribe distorted text, or solve a puzzle. Object recognition and transcription are explicitly named in the criterion. A CAPTCHA needs an alternative, available help, or it cannot be the only path.
Does allowing password managers satisfy the criterion?
It satisfies the help exception for the memorization part, because the manager is the mechanism that assists. But blocking paste into the password field defeats that help, and a login that blocks paste fails the criterion.
Do passkeys replace passwords entirely?
They can, and they are the cleanest answer to 3.3.8 because they remove the memorized secret. But a magic link or a one-time code is also a valid alternative. The criterion requires an alternative path, not a specific technology.
What if our fraud team insists on a puzzle CAPTCHA?
Keep the bot defense, move it. Risk-based checks, device signals, rate limiting, and WebAuthn all filter bots without asking a human to solve a puzzle. A control that blocks legitimate users is not a security win.