Accessible Authentication & CAPTCHA Alternatives
Accessible authentication is the WCAG 2.2 requirement (success criterion 3.3.8, level AA) that a login or sign-up process must not depend on a pure cognitive function test – remembering a password, solving a puzzle or transcribing a code – unless an alternative is offered. Password managers with autofill, biometric methods, WebAuthn and single sign-on remain permitted, as do object recognition ("select all the traffic lights") and recognising content you uploaded yourself. The criterion therefore rules out classic text-based CAPTCHAs with no accessible alternative.
In practice
When designing logins and checkouts for shops and customer portals, always allow copy and paste into password fields and never block autofill – a common breach that is easy to fix. Instead of classic text or arithmetic CAPTCHAs, use invisible bot protection such as server-side signals and honeypot fields, or CAPTCHA providers with a demonstrably accessible alternative such as audio or one-click verification. Two-factor methods should offer options that avoid transcribing long codes by hand, such as push confirmation in an app or biometric approval. Since login and checkout are the most conversion-critical points of the customer journey in e-commerce, accessible authentication improves not only legal compliance but also bounce and abandonment rates.