Engrain by ByteRush

QLT.03.05 Mid-level· 11 minCore — asked often

Forms, errors and accessible authentication (WCAG 2.2)

What WCAG 2.2 requires of forms: labels and instructions, identifying errors and suggesting fixes, not asking for the same information twice (3.3.7), and logins without memory puzzles, with paste and password managers allowed (3.3.8).

Comes up in: Web fundamentals, Machine coding

Learn#

Leela manages her passwords with a password manager because of a memory condition. Her bank’s new login page blocks paste and shows a picture puzzle. She cannot log in to her own account.

Accessible authentication is WCAG 2.2 rule 3.3.8, at level AA. A login must not depend on a memory or puzzle test, such as recalling a password, unless there is another way or some help. Letting password managers fill the field counts as help. So the fix is often to remove a blocker:

<label for="email">Email</label>
<input id="email" name="email" type="email" autocomplete="username">
<label for="password">Password</label>
<input id="password" name="password" type="password" autocomplete="current-password">
<!-- no onpaste blocking; passkeys or an emailed link are good alternatives -->

Redundant entry is rule 3.3.7, at level A. Do not make users type the same thing twice in one process. Fill it in for them, or let them pick it.

Two WCAG 2.2 failures and their fixesStep 1 of 4

Page

  • <input type=password onpaste="return false">

State

    empty

    A login form blocks paste in the password field "for security". The password manager cannot fill it.

    Read the steps as text
    1. A login form blocks paste in the password field "for security". The password manager cannot fill it.
    2. Users with dyslexia or memory difficulties must now type a long password from memory: a cognitive function test.
    3. The checkout also asks for the delivery address again on the payment step, though it was entered one step earlier.
    4. Fixed: paste allowed, autocomplete="current-password", passkeys offered, and a "same as delivery address" checkbox.

    Predict#

    Predict first

    A sign-up form shows a CAPTCHA asking users to type distorted letters, with no other option. Does it meet WCAG 2.2 accessible authentication?

    Interview angle#

    Say it like this — about 30 seconds

    “WCAG requires visible labels, errors described in text, and hints for fixing them. WCAG 2.2 added two rules for forms. Redundant entry means you do not ask for the same thing twice in one process. Accessible authentication means a login must not depend on memory or puzzles without help. So I allow paste and password managers, set the right autocomplete values, and offer passkeys or email links.”

    Stays on your device. Nothing is uploaded.
    Follow-up Why is blocking paste in password fields harmful?
    It breaks password managers, forcing users to remember or retype passwords, which fails 3.3.8 and pushes people to weak passwords.
    Follow-up What should the autocomplete value be for a login password?
    current-password; for creating one, new-password; for the email or username field, username.
    Follow-up What does error suggestion (3.3.3) require?
    When you know how to fix an input error, tell the user, such as “Enter the date as DD/MM/YYYY”.

    Practice#

    Guided

    Audit a login or sign-up form for common accessibility failures.

    Done when

    • Unlabeled inputs, blocked paste, missing autocomplete and puzzle-only CAPTCHAs are reported.
    • Codes appear in the given order, with field names where required.
    • A well-built form returns an empty list.

    The automatic tests for this exercise are still being written. Try it in your own editor, against the checklist above.

    Remember#

    Try to answer each card before you open it. Then add them to your reviews.

    What does WCAG 2.2 criterion 3.3.8 cover?

    Accessible authentication: no memory or puzzle test without an alternative or help.

    What does 3.3.7 Redundant Entry require?

    Do not make users re-enter information already given in the same process.

    Which autocomplete value fits a login password field?

    current-password.

    Is blocking paste in password fields acceptable?

    No. It breaks password managers and fails 3.3.8.

    Go deeper

    Four layers. Stop at the one your interview needs; each ends with a quick check.

    The core ideaEvery round
    Error identification (3.3.1) means errors are described in text, not just color; labels or instructions (3.3.2) are required for input; error suggestion (3.3.3) means saying how to fix it (RCT.10.02).
    Check yourself: Which criterion requires errors to be described in text?

    3.3.1 Error Identification.

    How it works underneathSenior rounds

    These criteria arrived in WCAG 2.2. 3.3.8 is level AA; 3.3.9 (enhanced, AAA) also disallows object-recognition and personal-content tests .

    Check yourself: Which WCAG version added 3.3.7 and 3.3.8?

    WCAG 2.2.

    Edge cases and trapsWhere people slip

    3.3.7 has exceptions: re-entry is allowed when essential, for security, or when earlier data is no longer valid. A “confirm new password” field is therefore allowed, though a show-password toggle is often better.

    Check yourself: Is asking to confirm a new password a redundant-entry failure?

    No. Re-entry for security or to confirm essential information is an exception.

    In productionStaff-level answers
    Passkeys and email links avoid memory tests entirely. For bots, prefer invisible checks, such as Cloudflare Turnstile, over puzzles, with a non-puzzle fallback .
    Check yourself: Name two login methods that avoid cognitive tests.

    Passkeys and magic links (email or SMS links).

    Finished the five steps? Mark it, and its cards join your reviews.

    Last checked 2026-11-01. Spot a mistake? Use “Report an error” below — fixes are listed on the corrections page.