Recall a password from memory
Recall is a cognitive-function test. Allowing password managers and paste provides a mechanism that can assist.
The principle
Accessible authentication principle
Before making a CAPTCHA easier to perceive, ask whether the cognitive test can be avoided.
Barrier or route
Judge the task, not its visual polish.
A beautifully labeled challenge can remain exclusionary. Accessible authentication considers what mental operation a person must complete and whether technology can assist.
Hear and type a numeric CAPTCHA
Audio changes the sensory modality, but the person still has to recognize and transcribe a code.
Use autofill or a password manager
The browser or manager can fill credentials without requiring recall or manual transcription.
Use a passkey or email verification link
These flows can avoid a memory, puzzle, or transcription test when implemented accessibly.
Two requirements
CAPTCHA guidance answers two different questions.
Providing visual and audio CAPTCHA variants can address different sensory access needs under Non-text Content. It does not automatically satisfy the separate Accessible Authentication requirement.
WCAG 1.1.1 Non-text Content
A CAPTCHA needs text that identifies its purpose and alternatives using different sensory modalities.
WCAG 3.3.8 Accessible Authentication
An authentication process cannot depend on a cognitive-function test unless an allowed exception, support mechanism, or other compliant method is available.
Design review
Ask before adding a challenge.
- Can rate limiting, risk analysis, or another abuse-control method avoid a user challenge?
- Can a passkey, device authentication, or verification link provide a non-cognitive route?
- Are password managers, autofill, and paste allowed?
- If CAPTCHA remains, does it offer different sensory modalities?
- Does the complete flow still provide a route that avoids cognitive-function testing?
- Are recovery and support paths accessible too?