WCAG 2.2 · Level AA · Understandable
3.3.8 Accessible Authentication (Minimum)
Manual verification
How to validate 3.3.8 by hand
Check authentication tasks for cognitive-function tests and verify an allowed accessible alternative is available.
Start with the extension result
Reopen the reported URL and reproduce the same state (for example, after expanding a menu or submitting a form). Use the result’s Highlight action when available, or its affected-element details and CSS selector, to find the reported content. Apply the checks below to that content and its context. If the element or state has changed, rescan and record that difference before deciding whether the finding still applies.
- Test sign-in, account recovery, and multi-factor authentication from the start of the process.
- Identify steps that require memorizing, transcribing, solving, or recognizing information and determine whether the task relies on a cognitive function test.
- Check for an alternative method, assistance mechanism, object recognition, or personal-content recognition that does not require the prohibited test.
Evidence to record
Record the authentication step, cognitive task, alternative method, and whether users can complete the process without the test.
Scope and exceptions
This Level AA criterion has specific exceptions for object/personal-content recognition and mechanisms that assist completion. Password managers and copy/paste are relevant but do not automatically satisfy every case.
Record the review outcome
- Confirmed: the recorded evidence shows the requirement is not met in the tested page state, and no applicable exception explains it.
- Not reproduced: the reported issue is absent in the current state. Record the URL, state, and affected element you checked; this does not prove other pages or states conform.
- Needs more review: evidence is incomplete, the content requires human judgment, or an exception is uncertain. Record what remains to be checked instead of treating it as a pass.