3.3.9 Accessible Authentication (Enhanced) (Level AAA): WCAG explained. Axevoo

In plain English

The AA rule (3.3.8) already bans memory-and-puzzle login barriers but allows a couple of exceptions, like recognising objects or your own uploaded images. This AAA rule removes even those: no step of signing in may depend on any cognitive test unless there is an alternative that does not.

The practical answer is the same, just applied more strictly: support passkeys and password managers, allow paste, and offer a memory-free path like an email magic link.

Who this is for

People with cognitive and memory differences, for whom recall and puzzle tests are barriers.
Everyone frustrated by password and CAPTCHA friction at login.

How to check and fix it yourself

Check your login and any CAPTCHA. Ensure there is a sign-in route that tests neither memory nor puzzle-solving, and never block paste or password managers.

Email magic link or passkey offered.               ✓ no cognitive test
Login field allows paste + password managers.      ✓
Puzzle CAPTCHA as the only way through.            ✗

Where we can help

We test your login flow for memory and puzzle barriers, including CAPTCHAs and paste-blocking, and recommend a cognitive-test-free path. Authentication is one of the new WCAG 2.2 items that trips up many stores.

Frequently asked questions

What does accessible authentication (enhanced) require?+

Success Criterion 3.3.9 (Level AAA, new in WCAG 2.2) says no step of logging in may rely on a cognitive function test (like remembering a password or solving a puzzle) unless there's a non-cognitive alternative. Unlike the AA version, it removes the exceptions for recognising objects and user-provided images.

How is it different from 3.3.8?+

3.3.8 Accessible Authentication (Minimum) (Level AA) allows object-recognition and personal-image tests as accessible alternatives. 3.3.9 (AAA) drops those exceptions too, so even 'pick the photos of a bus' or 'recognise your pet' can't be the only path.

How do stores comply?+

Support password managers and passkeys, allow copy-paste in login fields, and offer sign-in methods that don't test memory or puzzle-solving, like an email magic link or a device passkey. Avoid puzzle CAPTCHAs as the only gate.

Accessible Authentication (Enhanced)