Watching Password Reset and Account Recovery Flows for Barriers

Password reset is an authentication process, so WCAG 2.2 criterion 3.3.8 applies to every step of it. A reset code that must be transcribed by hand, a field that blocks paste, or a CAPTCHA with no alternative each fail it. Watch the flow end to end, not the login page alone.

The flow after the login page

The login page gets the audit. The reset flow does not, and the reset flow is where the barriers stack. A shopper clicks forgot password, and the store sends a six-digit code that expires in ten minutes. The code arrives by email, and the field it goes into blocks paste, so the shopper has to memorize six digits and type them from memory. Then a CAPTCHA appears, because the reset endpoint is a fraud target. Each of those steps is a cognitive function test under WCAG 2.2 criterion 3.3.8, and the criterion applies to any step in an authentication process, not only the first one. A reset flow that passes the login check and fails the reset check is still failing.

The fixes are unglamorous and mostly configuration. Let the code field accept paste and autofill, so a password manager or the browser can fill it. Give the code a generous expiry, thirty minutes rather than ten, and say so in the message. Offer a magic link as an alternative to the code, so nobody has to transcribe anything. And if a CAPTCHA is required, give it an alternative path, an audio challenge or a link-based verification, instead of a puzzle with no way around it.

What to watch, and how often

Reset flows change when fraud tooling changes, which is exactly when nobody tells the accessibility owner. A vendor update shortens code expiry. A theme update adds a bot check to the reset page. A security review disables paste on all password fields, including the reset code field, because someone read a decade-old guideline about paste blocking and did not check the current one. NIST SP 800-63B has recommended allowing paste since 2017, and WCAG 3.3.8 now makes blocking it a Level AA failure when no alternative exists.

Watch the flow quarterly, end to end, with a keyboard and a password manager. Time the code, try the paste, and note whether any step demands memory or a puzzle with no alternative. When a change breaks it, the alert goes to whoever owns fraud tooling, because the fix is their configuration. A shopper locked out of their own account is a lost sale with a clear cause, and it is the kind of cause a store can fix in a day once someone is watching for it. Password recovery sits next to accessible authentication under 3.3.8 and what 2.4.13 actually demands of focus appearance.

Frequently asked questions

Does WCAG 3.3.8 apply to password reset, or only login?

It applies to any step in any authentication process, and reset is an authentication process. A code entry step, a security question, and a CAPTCHA during reset are all covered.

Why is blocking paste a failure?

Paste is the mechanism that lets a password manager or the browser fill the field, so the user never has to memorize or transcribe. Blocking it removes the only assistance for the cognitive test, and NIST SP 800-63B has recommended allowing paste since 2017.

How long should a reset code last?

Long enough that a person using assistive technology can switch apps, read the email, and return. Ten minutes is tight; thirty is a reasonable floor, and the expiry should be stated in the message itself.

What is the simplest compliant reset flow?

A magic link sent by email, with the code as a fallback that accepts paste and autofill. No puzzle, no memorization, no transcription. That passes 3.3.8 without any exception or workaround.