WCAG 2.2 success criterion 3.3.8, Accessible Authentication (Minimum), is a Level AA requirement: sign-in does not require a cognitive function test.
Read the criterion in the W3C Recommendation, WCAG 2.2 (opens in a new tab).
How BearScan checks it
Sign-in does not require a cognitive function test
Checked automatically: clicks through the page. Severity: high. Blocking paste or password managers forces users with memory or cognitive disabilities to transcribe a password by hand, which can lock them out of their account.
An approximation: A paste event is dispatched to each credential field in the browser and a field whose handler cancels it fails, as does paste blocking written into the markup. The sign-in form's text is read by a decisions model (TypeSafe's Jev) for a memory, transcription or calculation test (80% or more fails). Challenge widgets are identified by their source: reCAPTCHA, hCaptcha and Turnstile test object recognition, which the criterion allows; any other puzzle, or a CAPTCHA image of unknown kind, is reported for review. The password is never submitted, so a step that appears only after a username is accepted, and a one-time code sent afterwards, are not seen.
How to fix it. Allow paste into username, password and one-time-code fields, do not disable password managers, and offer an alternative to any puzzle or memorisation test (an email link, a passkey, or a CAPTCHA based on object recognition).
All WCAG 2.2 criteria · Next: 4.1.2 Name, Role, Value
Questions
Is WCAG 3.3.8 required by the ADA?
The ADA doesn't name a technical standard for businesses. 3.3.8 was added in WCAG 2.2, so it isn't part of WCAG 2.1 Level AA, the version the Justice Department's 2024 rule adopted for state and local governments. WCAG 2.2 has been the current W3C Recommendation since October 5, 2023.
Can an automated tool check WCAG 3.3.8?
Mostly. BearScan checks it automatically (clicks through the page). A clean result still isn't proof every page passes, only the pages scanned.
How do I fix a WCAG 3.3.8 failure?
Allow paste into username, password and one-time-code fields, do not disable password managers, and offer an alternative to any puzzle or memorisation test (an email link, a passkey, or a CAPTCHA based on object recognition).