What the standard says
A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides at least one of the following:
Why it matters
Transcribing a code, solving a CAPTCHA or remembering a password are cognitive tests, and they are not what authentication needs to be.
What a failure looks like
- failsA CAPTCHA with no alternative.
- failsBlocking paste in a password field, which breaks password managers.
- failsAsking for "the third and seventh character of your memorable word".
How to fix it
- doAllow paste and let password managers fill the field.
- doSupport passkeys, email links or OAuth.
- doIf you need a bot check, use one that does not require a cognitive test.
How A11ySignal checks it
manual
No automated rule can judge this criterion, and we will not pretend otherwise. A clean scan does not mean 3.3.8 passes — it means nothing we can measure fails. This one needs a person.