WCAG 3.3.8 Accessible Authentication (Minimum) (level AA) explained

What it asks for, in plain English

Any step of signing in that is a cognitive function test, such as remembering a password, transcribing a code from one place to another, solving a puzzle or reading distorted letters, must have an alternative or a way to make it easier. The clearest route: let people use a password manager, let them paste into the password and code fields, and do not block autofill.

A password field on its own is fine as long as a password manager can fill it and pasting works. A one-time code sent by text is fine if the person can copy it in rather than memorise and retype it. Alternatives that avoid the test entirely are also fine: a sign-in link sent by email, a passkey, signing in with a device, or a third-party login.

Two things are allowed at this level without an alternative: recognising objects (pick the pictures of buses), and recognising content the person supplied themselves (their own photo). Distorted-text CAPTCHAs are not in that list.

This is an independent explanation. The binding wording is the W3C Recommendation, and the W3C's own Understanding 3.3.8 page has the full intent, techniques and definitions.

Who it affects

A person with a memory impairment cannot hold a six-digit code in mind long enough to type it into another window, but can paste it.

Someone with dyslexia fails a distorted-text CAPTCHA again and again and is locked out of their own account.

A screen reader user cannot see the puzzle at all, and the audio version is often harder than the visual one.

Example

Broken

Autofill is switched off, paste is blocked by script, and there is a distorted-text puzzle with no alternative. Three cognitive tests, no way round any of them.

Fixed

A password manager can fill both fields, paste works, and there is a route in that needs no password at all.

Show the markup behind both examples

Broken

<style>body{margin:0;padding:16px;font-family:system-ui;font-size:14px}label{display:block;font-weight:600;margin-bottom:2px}input{font:inherit;display:block;padding:6px 8px;border:1px solid #9ca3af;border-radius:4px;width:200px;margin-bottom:10px}.cap{display:inline-block;background:#e5e7eb;padding:6px 14px;margin-bottom:6px;font:italic 700 20px Georgia,serif;letter-spacing:6px;color:#374151;transform:skewX(-12deg)}button{font:inherit;padding:6px 12px}</style>
<form>
  <label for="u">Username</label>
  <input id="u" autocomplete="off">
  <label for="p">Password</label>
  <input id="p" type="password" autocomplete="off">
  <label for="c">Type the characters shown</label>
  <div class="cap" aria-hidden="true">x7Qm4k</div>
  <input id="c">
  <button type="button">Sign in</button>
</form>

Fixed

<style>body{margin:0;padding:16px;font-family:system-ui;font-size:14px}label{display:block;font-weight:600;margin-bottom:2px}input{font:inherit;display:block;padding:6px 8px;border:1px solid #9ca3af;border-radius:4px;width:200px;margin-bottom:10px}button{font:inherit;padding:6px 12px}p{margin:12px 0 0}a{color:#1d4ed8}</style>
<form>
  <label for="u">Email</label>
  <input id="u" type="email" autocomplete="username">
  <label for="p">Password</label>
  <input id="p" type="password" autocomplete="current-password">
  <button type="button">Sign in</button>
  <p>Or <a href="#">email me a sign-in link</a> instead.</p>
</form>

How to check it

Open the sign-in form and try to paste into the password field and any code field. It should work.
Check a password manager or the browser's autofill can fill the username and password; the fields should have autocomplete="username" and autocomplete="current-password".
Look for any puzzle, maths question or distorted text you must solve. If there is one, there must be another way in that does not need it.
Check two-factor codes can be pasted or filled automatically, not only retyped from memory.

What Websight checks for 3.3.8

Websight has no automated check for this criterion. It lists it in the manual checklist that comes with every report, so it is not forgotten.

Websight's autocomplete check flags sign-in fields with a missing or invalid autocomplete value, the main thing that stops password managers working. It cannot tell whether paste is blocked or whether a puzzle has an alternative; a person has to try.

Practical tips

Never block paste or autofill on sign-in fields, and remove any script that does.
Offer a sign-in link or a passkey alongside the password; both avoid the test altogether.
If you must use a CAPTCHA, use one based on object recognition or one that is invisible, and provide a route without it.

3.3.1 Error Identification (level A)
3.3.2 Labels or Instructions (level A)
3.3.3 Error Suggestion (level AA)
3.3.4 Error Prevention (Legal, Financial, Data) (level AA)
3.3.7 Redundant Entry (level A)