Accessible Authentication & CAPTCHA Alternatives
Accessible authentication is the WCAG 2.2 requirement (success criterion 3.3.8, level AA) that a login or sign-up process must not depend on a pure cognitive function test – remembering a password, solving a puzzle or transcribing a code – unless an alternative is offered. Password managers with autofill, biometric methods, WebAuthn and single sign-on remain permitted, as do object recognition ("select all the traffic lights") and recognising content you uploaded yourself. The criterion therefore rules out classic text-based CAPTCHAs with no accessible alternative.
In practice
When designing logins and checkouts for shops and customer portals, always allow copy and paste into password fields and never block autofill – a common breach that is easy to fix. Instead of classic text or arithmetic CAPTCHAs, use invisible bot protection such as server-side signals and honeypot fields, or CAPTCHA providers with a demonstrably accessible alternative such as audio or one-click verification. Two-factor methods should offer options that avoid transcribing long codes by hand, such as push confirmation in an app or biometric approval. Since login and checkout are among the most conversion-critical points of the customer journey in e-commerce, accessible authentication reduces bounce and abandonment rates – and it anticipates the WCAG 2.2 requirements that are heading towards the European legal framework with the coming version of EN 301 549.