Published October 26, 2026

WCAG 3.3.8 Accessible Authentication (Minimum), Level AA

Does WCAG ban passwords?

No. Success criterion 3.3.8 Accessible Authentication (Minimum) is Level AA in WCAG 2.2. A cognitive function test must not be the only way to authenticate, unless there is an alternative that is not a cognitive function test, or a mechanism that helps the person complete the test. Remembering a password is a cognitive function test. Allowing paste or a password manager is a mechanism that helps. The text is in the W3C WCAG 2.2 Recommendation.

What counts as a cognitive function test?

A test that requires the person to remember, transpose, or process information. The W3C explanation is in Understanding Success Criterion 3.3.8. Examples include remembering a password or username, typing characters from an image, solving a puzzle, or recognizing objects. Object recognition and personal content are treated carefully in the Understanding document. A login that also offers email magic links, passkeys, or another method that is not a cognitive test can meet the criterion even when a password option remains.

Do passwords still work under 3.3.8?

Yes, when something helps the person enter them. Allow paste. Do not block password managers. Those mechanisms satisfy the “help” path of the criterion for a remembered password. Labels, errors, and keyboard access on the sign-in form are still required under the form and keyboard rules, covered on the accessible forms and keyboard access pages. Username and current-password fields that collect information about the user also need a programmatically determined purpose under 1.3.5, covered on the identify input purpose page. Blocking paste on the password field removes the help mechanism.

Does the Title II web rule include 3.3.8?

No. The Department of Justice rule for state and local government websites names WCAG 2.1 Level AA, not 2.2. Criterion 3.3.8 was added in WCAG 2.2, so Title II does not include Accessible Authentication. Who must meet 2.1 AA, and the April 2027 and April 2028 dates, are on the Title II web rule page. If a contract requires WCAG 2.2 AA, then 3.3.8 applies. The version gap is on the WCAG 2.1 vs 2.2 page. Other 2.2-only criteria, such as dragging movements, follow the same Title II pattern.

Can a scanner prove the login meets 3.3.8?

Rarely. A tool may see that paste is blocked. It cannot decide whether a CAPTCHA is the only path, or whether a passkey option is enough. A person has to walk the sign-in flow, which is why a passing score is not conformance, as covered on the scanner page. The fix belongs in the authentication flow, which is remediation.