Accessibility Test Cases

A11Y-WCAG-053

WCAG 3.3.8 Accessible Authentication (Minimum)

Generated file current Authoring: Content complete
What file status means

This status reports only whether the generated procedure matches the current controlled source hash. It is not independent content verification, regulatory approval, product evidence or a conformance decision.

Recorded standards review: No optional specialist review recorded. Next review: Not scheduled.

MethodWCAG check
TesterAccessibility tester
Indicative effort33–48 min small scope

Authentication requires memorisation, transcription, calculation or puzzle solving without an allowed branch.

Available formats

Use this test in the format you need

The HTML procedure includes the working worksheet. JSON provides the structured source data. Editable Markdown files are delivered inside package downloads.

Purpose

What this test checks

Authentication requires memorisation, transcription, calculation or puzzle solving without an allowed branch.

What this result means: This WCAG 3.3.8 Accessible Authentication (Minimum) procedure determines whether the recorded targets meet WCAG 3.3.8 on web-desktop-cross-browser in the tested states. A broader conformance decision must also account for every applicable target in the declared scope, complete processes, accessibility-supported use and the other WCAG conformance requirements.

Why it matters

Authentication requires memorisation, transcription, calculation or puzzle solving without an allowed branch. People most likely affected: people with cognitive, language, learning or memory disabilities; People who use keyboards, switches, speech input or adapted pointing devices; Blind people and people using screen readers or braille. Users may be locked out of accounts and essential services. In the recorded web-desktop-cross-browser environment, apply the criterion to every relevant state and named normative exception; failures in critical tasks and complete processes carry the greatest user impact.

When to use it

Test alternative authentication, assistance mechanisms, object recognition and personal-content branches; include password-manager and paste support.

Confirm before starting

Mark it not applicable only when

Exceptions

WCAG 2.2 Success Criterion 3.3.8 states no normative exception. Conditional applicability or alternative satisfaction branches are recorded in decision_branches instead.

Prepare

What you need

  • The product area and test targets are agreed before testing starts.
  • The operating system, browser, viewport and input method are recorded.
  • Test data is safe to use and does not expose unnecessary personal information.

Targets and required variations

  • Every step in authentication and account-recovery processes that requires a cognitive function test.
  • Default and every meaningful state or variation that can change the result.

Clean state

  • Start from a documented clean or known state and record pre-existing preferences, extensions and cached data that can change the result.

Effort estimate

Setup
10 min
Per target
8 min
Evidence
7 min
Technical review
8 min

Assumptions: one page or component state; add another execution block for each materially different template or state

Variation: Add a new per-target execution and evidence allowance for each additional target class or state that could produce a different result. Add setup time for each distinct environment.

Excluded: Client coordination, inaccessible-environment recovery, recruitment, legal review, remediation implementation and waiting time unless the procedure states otherwise.

Execute

Test steps

Follow each action in order. The expected result is always visible; open the guidance when you need setup, tool, evidence, decision or repeat details. Step-level recording is optional while work is in progress and required only to export a completed execution.

Step 1

Inventory applicable targets

Purpose: For WCAG 3.3.8 Accessible Authentication (Minimum), prepare the named scenario: Inventory applicable targets. Target: Every step in authentication and account-recovery processes that requires a cognitive function test. The preparation must establish this result: Every selected target and state is uniquely identifiable before testing.

User impact: Users may be locked out of accounts and essential services. This scenario isolates that risk in the action named Inventory applicable targets.

Freeze the page, content and product version. Inventory Every step in authentication and account-recovery processes that requires a cognitive function test. Apply this rule: Test alternative authentication, assistance mechanisms, object recognition and personal-content branches; include password-manager and paste support.

Expected result

Every selected target and state is uniquely identifiable before testing.

Failure observation

During WCAG 3.3.8 Accessible Authentication (Minimum), the target, starting state, environment or scope record remains ambiguous for the scenario named Inventory applicable targets. The preparation result cannot be demonstrated: Every selected target and state is uniquely identifiable before testing.

Setup, evidence and decision guidance
Target
Every step in authentication and account-recovery processes that requires a cognitive function test.
Required state
For WCAG 3.3.8 Authenticate without unsupported cognitive tests, use default and every meaningful state or variation that can change the result.
Tool or command
For WCAG 3.3.8, use the frozen scope inventory, product requirements and rendered content to identify every Authenticate without unsupported cognitive tests target.
Record
Page/view, target identifier, state, technology, sample rationale and scope limitation.
Pass
Record passed for the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Inventory applicable targets only when the evidence (Page/view, target identifier, state, technology, sample rationale and scope limitation.) supports: Every selected target and state is uniquely identifiable before testing.
Fail
Record failed when the action is completed and this failure observation is reproduced: During WCAG 3.3.8 Accessible Authentication (Minimum), the target, starting state, environment or scope record remains ambiguous for the scenario named Inventory applicable targets. The preparation result cannot be demonstrated: Every selected target and state is uniquely identifiable before testing.
Not applicable
The completed scope inventory contains no target matching: Every step in authentication and account-recovery processes that requires a cognitive function test.
Blocked
Record blocked, not passed, when The target is applicable, but a required action, state, environment or evidence item was not completed.
Repeat or recover
Repeat the WCAG 3.3.8 target inventory after a material content, state, technology or process change.
Limitations
This WCAG 3.3.8 Accessible Authentication (Minimum) scenario covers only the action named Inventory applicable targets for the recorded target and state. It contributes evidence to 3.3.8; apply the procedure's aggregation, complete-process and conformance-scope rules before making a broader decision.
If you are new to this test
For WCAG 3.3.8, keep agreed scope exclusions separate from the target's applicable, inapplicable and pass outcomes.
Record this step

Step 2

Authenticate without unsupported cognitive tests

Purpose: For WCAG 3.3.8 Accessible Authentication (Minimum), execute the named scenario: Authenticate without unsupported cognitive tests. Target: Every step in authentication and account-recovery processes that requires a cognitive function test. Compare the observation with this result: No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification.

User impact: Users may be locked out of accounts and essential services. This scenario isolates that risk in the action named Authenticate without unsupported cognitive tests.

Complete every authentication and recovery path without cognitive-function tests; test password-manager paste/autofill and object-recognition alternatives.

Expected result

No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification.

Failure observation

After the tester completes the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Authenticate without unsupported cognitive tests, the recorded observation for the target is inconsistent with the required result: No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification.

Setup, evidence and decision guidance
Target
Every step in authentication and account-recovery processes that requires a cognitive function test.
Required state
For WCAG 3.3.8 Authenticate without unsupported cognitive tests, use default and every meaningful state or variation that can change the result.
Tool or command
Complete authentication/recovery journeys with authorised accounts, password manager, copy/paste and any alternative method.
Record
Step, cognitive demand, alternative/mechanism, object/personal-content branch, password-manager/paste result and security limitation.
Pass
Record passed for the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Authenticate without unsupported cognitive tests only when the evidence (Step, cognitive demand, alternative/mechanism, object/personal-content branch, password-manager/paste result and security limitation.) supports: No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification.
Fail
Record failed when the action is completed and this failure observation is reproduced: After the tester completes the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Authenticate without unsupported cognitive tests, the recorded observation for the target is inconsistent with the required result: No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification.
Not applicable
The completed scope inventory contains no target matching: Every step in authentication and account-recovery processes that requires a cognitive function test.
Blocked
Record blocked, not passed, when The target is applicable, but a required action, state, environment or evidence item was not completed.
Repeat or recover
Repeat the WCAG 3.3.8 action when the target's content, state, environment or underlying technology changes.
Limitations
This WCAG 3.3.8 Accessible Authentication (Minimum) scenario covers only the action named Authenticate without unsupported cognitive tests for the recorded target and state. It contributes evidence to 3.3.8; apply the procedure's aggregation, complete-process and conformance-scope rules before making a broader decision.
If you are new to this test
For WCAG 3.3.8 Authenticate without unsupported cognitive tests, record the actual evidence before deciding; use checker or visual evidence alone only when this procedure defines it as the measurement.
Record this step

Step 3

Repeat material variations and recovery

Purpose: For WCAG 3.3.8 Accessible Authentication (Minimum), execute the named scenario: Repeat material variations and recovery. Target: Every step in authentication and account-recovery processes that requires a cognitive function test. Compare the observation with this result: Every material variation and required recovery path has its own reproducible observation; no unexecuted state is merged into a passing result.

User impact: Users may be locked out of accounts and essential services. This scenario isolates that risk in the action named Repeat material variations and recovery.

Repeat the WCAG 3.3.8 Accessible Authentication (Minimum) action for each inventoried variation that can change the outcome. Include relevant default, revealed, error, interruption, recovery and confirmation states and complete the selected process from start to finish where this test can affect task completion.

Expected result

Every material variation and required recovery path has its own reproducible observation; no unexecuted state is merged into a passing result.

Failure observation

After the tester completes the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Repeat material variations and recovery, the recorded observation for the target is inconsistent with the required result: Every material variation and required recovery path has its own reproducible observation; no unexecuted state is merged into a passing result.

Setup, evidence and decision guidance
Target
Every step in authentication and account-recovery processes that requires a cognitive function test.
Required state
For WCAG 3.3.8 Accessible Authentication (Minimum): Default and every meaningful state or variation that can change the result.
Tool or command
For WCAG 3.3.8 Accessible Authentication (Minimum), use the same recorded method, then change only the state, environment or recovery condition being compared.
Record
Variation identifier; changed state or environment; start and end points; actual observation; recovery result; intervention; evidence reference and target outcome.
Pass
Record passed for the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Repeat material variations and recovery only when the evidence (Variation identifier; changed state or environment; start and end points; actual observation; recovery result; intervention; evidence reference and target outcome.) supports: Every material variation and required recovery path has its own reproducible observation; no unexecuted state is merged into a passing result.
Fail
Record failed when the action is completed and this failure observation is reproduced: After the tester completes the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Repeat material variations and recovery, the recorded observation for the target is inconsistent with the required result: Every material variation and required recovery path has its own reproducible observation; no unexecuted state is merged into a passing result.
Not applicable
The completed scope inventory contains no target matching: Every step in authentication and account-recovery processes that requires a cognitive function test.
Blocked
Record blocked, not passed, when The target is applicable, but a required action, state, environment or evidence item was not completed.
Repeat or recover
Repeat this action for every required variation of Authenticate without unsupported cognitive tests and after a material target, content, state, environment or configuration change. Preserve the original observation.
Limitations
This WCAG 3.3.8 Accessible Authentication (Minimum) scenario covers only the action named Repeat material variations and recovery for the recorded target and state. It contributes evidence to 3.3.8; apply the procedure's aggregation, complete-process and conformance-scope rules before making a broader decision.
If you are new to this test
For WCAG 3.3.8 Accessible Authentication (Minimum), change one material condition at a time where practical. Do not assume that a passing default state covers errors, overlays, orientation changes, interruptions or recovery.
Record this step

Step 4

Apply branches and exceptions

Purpose: For WCAG 3.3.8 Accessible Authentication (Minimum), execute the named scenario: Apply branches and exceptions. Target: Every step in authentication and account-recovery processes that requires a cognitive function test. Compare the observation with this result: Every alternative branch or exception used is named and supported by its exact condition.

User impact: Users may be locked out of accounts and essential services. This scenario isolates that risk in the action named Apply branches and exceptions.

Apply these decision branches exactly: Alternative authentication without a cognitive function test. Mechanism assisting completion of the cognitive function test. Object-recognition test. Identification of non-text personal content supplied by the user.

Expected result

Every alternative branch or exception used is named and supported by its exact condition.

Failure observation

After the tester completes the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Apply branches and exceptions, the recorded observation for the target is inconsistent with the required result: Every alternative branch or exception used is named and supported by its exact condition.

Setup, evidence and decision guidance
Target
Every step in authentication and account-recovery processes that requires a cognitive function test.
Required state
For WCAG 3.3.8, use the same Authenticate without unsupported cognitive tests target and state evidence collected in S2.
Tool or command
WCAG 2.2 normative text and Understanding Success Criterion 3.3.8: Accessible Authentication (Minimum) as informative interpretation.
Record
Selected branch; exception name, condition and evidence; unresolved judgement and resolver.
Pass
Record passed for the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Apply branches and exceptions only when the evidence (Selected branch; exception name, condition and evidence; unresolved judgement and resolver.) supports: Every alternative branch or exception used is named and supported by its exact condition.
Fail
Record failed when the action is completed and this failure observation is reproduced: After the tester completes the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Apply branches and exceptions, the recorded observation for the target is inconsistent with the required result: Every alternative branch or exception used is named and supported by its exact condition.
Not applicable
The completed scope inventory contains no target matching: Every step in authentication and account-recovery processes that requires a cognitive function test.
Blocked
Record blocked, not passed, when The target is applicable, but a required action, state, environment or evidence item was not completed.
Repeat or recover
Reassess WCAG 3.3.8 when source status, normative wording or the Authenticate without unsupported cognitive tests target facts change.
Limitations
This WCAG 3.3.8 Accessible Authentication (Minimum) scenario covers only the action named Apply branches and exceptions for the recorded target and state. It contributes evidence to 3.3.8; apply the procedure's aggregation, complete-process and conformance-scope rules before making a broader decision.
If you are new to this test
For WCAG 3.3.8, use Understanding and Techniques as informative decision support; they do not create extra requirements.
Record this step

Decide

How to decide

Passed

No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification.

Failed

At least one applicable target violates this condition and no documented normative exception applies: No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification.

Not applicable
The completed scope inventory contains no target matching: Every step in authentication and account-recovery processes that requires a cognitive function test.
Cannot tell
The authentication method or security control cannot be executed safely enough to determine the available branch.
Not tested
The target is applicable, but a required action, state, environment or evidence item was not completed.
Aggregation and reporting boundaries

Aggregation: Preserve one result per target and material state. A failed target prevents a passed aggregate; cantTell and untested remain unresolved; inapplicable is used only when no target matches applicability.

WCAG decision: A WCAG 3.3.8 decision is separate from target and ACT outcomes. It requires all applicable content in the declared conformance scope plus WCAG's full-page, complete-process, accessibility-supported-ways and non-interference requirements as applicable.

Automation: A passed automated or ACT check covers only its exact applicability and expectation. Complete all remaining manual, contextual, exception, state and technology checks; never set the criterion to satisfied automatically.

Record

Record the result

Record the target, state and observed behaviour. Add evidence or technical details only when needed.

Choose the option that best matches what happened to this target.

Describe the actual behaviour and why it supports the selected result.

When more than one target is recorded, the overall procedure result is calculated from all target results.

Environment: Not set.
Add evidence or details

Choose only the group needed for this record. These fields remain optional for a working draft.

Evidence references

Enter one file name, issue ID or evidence reference per line. Files stay on your device.

Test environment

Save a named profile once to reuse the same product, platform and environment details on other procedures in this browser.

Engagement and tester identifiers

Component expectation results

Use these controls only when the procedure has distinct component expectations. The overall outcome must agree with them.

E1 No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification.

E2 Every selected target and material state is executed; omitted coverage remains untested.

WCAG report decisions

These report-level decisions are separate from the target outcome and require complete declared-scope evidence.

Formal completion and limitations

Identify the frozen list or sampling record used to select every target represented by this execution.

Choose a final result before marking the execution complete. Completed records require the full environment, step, evidence and method-specific information.

Data management

Export before clearing if the record must be retained. Apply the engagement retention schedule and delete browser data when it is no longer needed.

Saved drafts stay in this browser and are not uploaded. Do not enter credentials, secrets or unnecessary personal data.

Reference

Supporting information

Standards and requirement mappings
  • W3C-WCAG22 · 3.3.8 conformance · full

    Full mapping describes the intended criterion scope of this manual procedure, not proof that a sample covers every item in a product or that WCAG conformance requirements are satisfied.

  • W3C-WCAG22-QUICKREF · W3C-WCAG22-QUICKREF advisory · supporting

    This source does not override WCAG or create an additional WCAG conformance requirement.

  • W3C-WCAG22-TECHNIQUES · W3C-WCAG22-TECHNIQUES advisory · supporting

    This source does not override WCAG or create an additional WCAG conformance requirement.

  • W3C-UNDERSTANDING-3-3-8 · Understanding 3.3.8 advisory · supporting

    Understanding guidance is informative and does not add a WCAG conformance requirement.

Supporting and advisory guidance

Supporting sources are identified in the mappings and source register. They do not add conformance requirements.

Evidence specification
  • Scope inventory

    Page/view, target identifier, product/content version, state, technology and sample rationale.

    Use authorised identifiers and redact credentials, secrets and unnecessary personal data.

  • Criterion specific evidence

    Step, cognitive demand, alternative/mechanism, object/personal-content branch, password-manager/paste result and security limitation.

    Reference redacted evidence; do not embed sensitive files or unnecessary personal data.

  • Decision record

    Target outcome, normative branch, exception evidence, actual result, limitation and issue reference.

    Use evidence references and apply the engagement retention policy.

Worked example and outcome calibration

A11Y-WCAG-053-WORKED-001: representative worked example

Context: Representative synthetic example for WCAG 3.3.8 Accessible Authentication (Minimum) on a fictional, version-frozen product target; no client or participant execution occurred.

Inspected: The tester follows S2 (Authenticate without unsupported cognitive tests) using the target, required state, tool and repeat rule stated in this procedure.

Observed output: After the tester completes the WCAG 3.3.8 Accessible Authentication (Minimum) scenario named Authenticate without unsupported cognitive tests, the recorded observation for the target is inconsistent with the required result: No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification.

Evidence:

  • example-evidence-001: target and state record for Every step in authentication and account-recovery processes that requires a cognitive function test.
  • example-evidence-002: contemporaneous observation from the named method — Step, cognitive demand, alternative/mechanism, object/personal-content branch, password-manager/paste result and security limitation.
  • example-evidence-003: comparison note linking the actual observation to the expected result and claim boundary

Tester reasoning: The recorded observation does not demonstrate the expected result: No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification. The failed decision is limited to this synthetic target and state; unexecuted coverage is not inferred.

Decision: failed

Finding: A11Y-WCAG-053-example-finding-001 — Authenticate without unsupported cognitive tests: expected result is not demonstrated. The represented barrier may affect People with cognitive, language, learning or memory disabilities.; People who use keyboards, switches, speech input or adapted pointing devices.; Blind people and people using screen readers or braille.

Remediation: Change the represented target or process so it demonstrates this result: No cognitive function test is required unless the step provides an alternative, assistance mechanism, object-recognition task or personal-content identification. Then rerun the affected step and every dependent variation.

Reviewer feedback: The reviewer confirms applicability, environment, actual-versus-expected comparison, evidence references and bounded wording; unsupported product-wide or conformance language is removed.

Final client wording: Synthetic training finding: the sampled Authenticate without unsupported cognitive tests target does not meet the procedure expectation in the recorded state. User impact and broader scope require evidence from the buyer's real execution.

Retest: Synthetic retest example: after the represented change, repeat the failed step plus material error and recovery states. Close the finding only when new evidence demonstrates the expected result; otherwise retain the non-pass outcome.

Boundary: This is a representative, synthetic worked example for training and calibration. It is not evidence from a client product, participant or real assistive-technology execution.

Outcome calibration

Passed
Password entry supports paste and a password manager, providing a mechanism that reduces memory and transcription demand.

The applicable target meets the criterion-specific condition in the stated state.

Failed
Users must memorise and retype a one-time code with paste disabled and no alternative or assistance.

The applicable target violates the condition and no supported exception applies.

Not applicable
The frozen scope contains no target matching: Every step in authentication and account-recovery processes that requires a cognitive function test.

No target matches applicability; this target outcome is not automatically copied to a WCAG decision.

Cannot tell
The authentication method or security control cannot be executed safely enough to determine the available branch.

The uncertainty is material and remains unresolved rather than being converted to passed.

Not tested
An applicable authenticate without unsupported cognitive tests target was inventoried, but a required state or action was not executed.

Applicable coverage remains incomplete.

Sampling, complete processes and platform limitations

Test every in-scope instance when practical. For a large population, document a sample that includes each template, content or control type, meaningful state and high-risk task.

If this check is part of a user journey, test the selected journey from start to finish, including relevant errors and recovery. Record any path that was not tested.

  • Check relevant browser, tool or assistive-technology release notes before assigning unexpected behaviour to the product.
  • If responsibility is unclear, record the reproducible behaviour and use cannot tell until it is resolved.
Related procedures

No related procedure is recorded.

ACT rules and WCAG technique traceability

This is a project-authored manual procedure, not a W3C Approved ACT Rule. An ACT result can support only the part of this procedure covered by that rule. It does not replace the remaining manual or assistive-technology checks.

No supporting W3C Approved ACT Rule is selected for this procedure.

  • Understanding SC 3.3.8. Techniques are examples, not extra requirements. Record any technique or common failure used, but decide the result against the success criterion.
Review history and source register
  1. 2026.08.27-rc.9 — Reworked for plain language, case-focused steps, scoped evidence and transparent draft review status.
  2. 2026.08.27-rc.9 — Migrated to professional catalogue schema v3 with separated outcomes, structured authority, applicability, evidence, decision and review records.
  3. 2026.08.27-rc.9 — Individually prepared WCAG 3.3.8 procedure content mapped to current normative and informative sources and checked for internal consistency; competent review, real execution and formal claim authority remain separate.
  4. 2026.08.27-rc.9 — Added explicit preparation and variation/recovery steps plus a bounded representative worked example for paid-template use.
  5. 2026.08.27-rc.9 — Procedure guidance and presentation simplified without changing draft governance status.

Review decision: pending. Open issues: Competent method and standards review must confirm applicability, exceptions, decision logic, evidence and calibration material; unresolved material findings block use for an external assessment.

Source historyReport an accuracy issue
WCAG
SC 3.3.8
Execution
Manual test with tool support
Catalogue version
2026.08.27-rc.9