WCAG 2.2 · Level AAA · Understandable
3.3.9 Accessible Authentication (Enhanced)
Manual verification
How to validate 3.3.9 by hand
At Level AAA, check authentication for cognitive-function tests, applying the stricter restrictions in this criterion.
Start with the extension result
Reopen the reported URL and reproduce the same state (for example, after expanding a menu or submitting a form). Use the result’s Highlight action when available, or its affected-element details and CSS selector, to find the reported content. Apply the checks below to that content and its context. If the element or state has changed, rescan and record that difference before deciding whether the finding still applies.
- Test all authentication and recovery routes, including alternate providers and multi-factor steps.
- Identify any memory, transcription, or puzzle task and check whether it can be completed using an allowed recognition or assistance mechanism.
- Evaluate whether the task depends on a cognitive function test even when copy/paste or an autofill tool is available.
Evidence to record
Record the task, cognitive demand, available method, and whether the stricter Level AAA exception applies.
Scope and exceptions
This is Level AAA and has narrower exceptions than 3.3.8. Do not assume that a method acceptable at AA also satisfies this criterion.
Record the review outcome
- Confirmed: the recorded evidence shows the requirement is not met in the tested page state, and no applicable exception explains it.
- Not reproduced: the reported issue is absent in the current state. Record the URL, state, and affected element you checked; this does not prove other pages or states conform.
- Needs more review: evidence is incomplete, the content requires human judgment, or an exception is uncertain. Record what remains to be checked instead of treating it as a pass.