Authentication must not require users to rely on their own memory, puzzles, human recognition tasks, or identifying previously supplied images or media.
Accessible Authentication (Enhanced) strengthens the protections introduced at Level AA by removing all remaining cognitive-function-test exceptions. At this level, authentication must be possible without requiring recall, unassisted transcription, or human recognition of objects or personal content, at any step.
How This Differs From Level AA (Minimum)
Accessible Authentication (Enhanced) is identical to the Minimum requirement except for one critical change:
Object recognition and personal content are no longer allowed as exceptions.
At Level AAA:
- Recognising images is not allowed
- Selecting previously uploaded photos is not allowed
- Any puzzle-like recognition task fails, even if it passed at Level AA
WCAG Success Criterion
Accessible Authentication (Enhanced)
A cognitive function test is not required for any step in an authentication process unless at least one of the following is provided:
- Alternative: another authentication method that does not rely on a cognitive function test
- Mechanism: built-in assistance that enables completion of the task
Unlike Level AA, object recognition and personal content are not permitted.
Mechanism means assistance such as password managers, autofill, device-based authentication, or delegation to another trusted system.
Why Recognition Is a Problem
Recognition tasks still require:
- Visual processing
- Cultural interpretation
- Cognitive reinforcement
They are inaccessible or unreliable for blind users and impose a disproportionate cognitive and perceptual burden on users with cognitive disabilities.
What This Means in Plain Terms
Users must be able to log in without having to:
- Remember credentials
- Re-type codes without assistance
- Solve puzzles
- Identify objects
- Recognize images or media they previously provided
If a login step requires any of these, the site must provide a non-cognitive alternative. At Level AAA, human recognition tasks are disallowed, while system-mediated recognition (such as biometrics handled by the device or browser) is allowed.
What Is Explicitly Not Allowed at Level AAA
The following fail this criterion, even if they pass Level AA:
- Selecting images you uploaded during account creation
- Choosing photos that contain a specific object (e.g., cars, signs, animals)
- Image-based CAPTCHAs
- Audio CAPTCHAs requiring transcription
- “Pick the image you uploaded” verification
These are cognitive recognition tests and are disallowed at Level AAA.
What Is Allowed
The following authentication approaches remain valid:
- Username/email + password with autofill and paste enabled
- Password managers
- WebAuthn (biometrics, hardware keys)
- OAuth / third-party login
- Push-based approvals
- QR code–based confirmation
- Hardware security keys
The key requirement is that no step requires users to rely on recall, unassisted transcription, or human recognition.
Multi-Factor Authentication (MFA)
MFA is allowed only if all steps comply.
Allowed:
- Push notifications
- Hardware keys
- Device-based authentication
- Copy/paste or autofill of codes
Fails:
- Manually typing codes with no alternative
- Recognition-based secondary challenges
- CAPTCHA gates triggered after failed attempts
Why AAA Removes Recognition Exceptions
At Level AA, recognition is treated as a lesser cognitive burden.
At Level AAA, WCAG eliminates it entirely because:
- Recognition still excludes blind users
- Recognition still taxes cognitive processing
- Recognition often fails under stress or fatigue
AAA prioritises universal accessibility, not relative improvement.
Common AAA Failures in Real Systems
- CAPTCHA challenges added “only after suspicious activity”
- Image selection used as a second factor
- Security questions replaced with image recognition
- “Choose your avatar” login verification
- Hybrid flows where only one step violates AAA
If any step relies on recognition, the criterion fails.
Auditor Reality Check
Accessibility reviewers typically verify:
- Can a user log in using only autofill or paste?
- Can all steps be completed without human recognition?
- Does any fallback introduce puzzles or image selection?
- Are all authentication paths non-cognitive?
AAA evaluation is manual and scenario-based.
Relationship to Other Criteria
- Accessible Authentication (Minimum) — allows recognition; Enhanced does not
- 1.3.5 Input Purpose — enables autofill
- 4.1.2 Name, Role, Value — ensures controls are operable
- 3.3.7 Redundant Entry — reduces memory load across steps
Enhanced builds on Minimum; it does not replace it.
Wrapping Up
Accessible Authentication (Enhanced) represents the highest standard of cognitive accessibility for login flows.
At this level:
- Memory is not required
- Recognition is not required
- Unassisted transcription is not required
Authentication succeeds through automation, delegation, and user choice, not mental effort. This criterion is not about convenience. It is about ensuring no one is locked out because their brain works differently.
