Skip to main content
Tu navegador es demasiado antiguo para mostrar este sitio correctamente. Actualiza a la última versión de Chrome, Edge, Firefox o Safari.
Back to WCAG Database
Level AAAWCAG 2.2

3.3.9 Accessible Authentication (Enhanced)

A cognitive function test is not required for any step in an authentication process, unless an alternative is provided that does not rely on a cognitive function test, with no exception for object recognition or personal content.

Last reviewed: September 9, 2026

Understanding 3.3.9

This is the AAA-level version of 3.3.8, and it closes the one exception that 3.3.8 allows. Object recognition tasks ("select all images with a bus") and identifying personal content ("which of these is your photo") can no longer be used as the sole authentication step, because they still exclude some people with cognitive, visual, or memory disabilities. At this level, authentication must never rely on any cognitive function test unless a non-cognitive alternative is also offered.

How to Meet It

Support authentication methods that require no memorization or puzzle-solving at all: WebAuthn/passkeys, biometrics, hardware security keys, OAuth/federated login ("Log in with Google/Apple/Microsoft"), or email/SMS magic links. Do not rely on image-recognition CAPTCHAs or "identify your photo" challenges as the only path to authenticate; if used, an equally accessible alternative that avoids any cognitive test must also be offered.

Code Examples

INCORRECT
<!-- Only authentication path is an image CAPTCHA -->
<div class="captcha">
  <p>Select all images containing a traffic light</p>
  <!-- ...image grid... -->
</div>
CORRECT
<!-- Passkey / WebAuthn offered as a path requiring no puzzle -->
<button onclick="navigator.credentials.get({ publicKey: options })">Sign in with a passkey</button>

Frequently Asked Questions

How is this different from 3.3.8 Accessible Authentication (Minimum)?

3.3.8 (AA) still permits object recognition and personal-content-identification tests, such as picture CAPTCHAs, as an allowed exception. 3.3.9 (AAA) removes that exception entirely, so even those tests require a non-cognitive alternative to be offered.

Related Success Criteria

3.3.1 Error Identification3.3.2 Labels or Instructions3.3.3 Error Suggestion3.3.4 Error Prevention (Legal, Financial, Data)

Quick Facts

  • Criterion3.3.9
  • LevelAAA
  • IntroducedWCAG 2.2

Automate Compliance

AccessiSight automatically scans and identifies 3.3.9 issues in your codebase.

Try Scanner Free