Understandable · Level AAA · Introduced in WCAG 2.2
WCAG 3.3.9: Accessible Authentication (Enhanced)
Published by whatisADA / Grow Wild Agency · Updated
What this criterion means
At Level AAA, authentication cannot require a cognitive test unless an alternative avoids it or a mechanism assists the user. The object-recognition and personal-content exceptions from the AA criterion are not included.
A practical example
A login flow uses an image-identification challenge as its only recovery route. Provide an alternative or assisting mechanism that removes the cognitive test, and verify that it works through all recovery stages.
How to check it
- Review every authentication and recovery step for memory, transcription and puzzle demands.
- Verify a usable non-cognitive alternative or an effective assisting mechanism for each.
- Repeat the workflow without relying on the recognition exceptions available only in the minimum criterion.
What can be missed
An AA authentication pass does not automatically establish AAA. Record which route the user can actually complete, including any third-party identity provider.
Record your test
Use this worksheet to record what you actually checked. Notes stay on this device when you choose Save; they are not sent to us. Avoid personal or confidential information on shared devices.
These are your observations, not automated results or a conformance certificate. A complete evaluation needs appropriate scope, supported technologies, all applicable criteria and relevant page states.
Primary sources and scope
This is independent implementation guidance with original examples. The linked standard contains the full definitions, exceptions and conformance requirements. A criterion or checklist alone does not establish legal applicability or whole-site conformance.