What is the difference between AA and AAA accessible authentication?

In the Web Content Accessibility Guidelines, Success Criterion 3.3.8: Accessible Authentication (Minimum) is part of WCAG 2.2 AA, and Success Criterion 3.3.9: Accessible Authentication (Enhanced) is part of WCAG 2.2 AAA.

Both criteria require that when users have to authenticate themselves, such as when logging into an account, there's at least one method available that does not rely solely on a cognitive test that may be likely to create accessibility barriers. These requirements affect users with a broad range of disabilities related to cognition and memory. The criteria differ in which types of authentication are considered conforming.

For AA conformance, at least one authentication method option must either:

• Not rely on a cognitive test,
• Include a mechanism to assist the user with a cognitive test,
• Ask the user to recognize objects, or
• Ask the user to identify non-text personal content.

Technically, object recognition and identifying non-text personal content are types of cognitive tests. However, because these tests rely on recognition and selection, they are considered to have a lower cognitive requirement when compared to other types of tests. For example, remembering and typing a password relies on more cognitively challenging recall and transcription.

The AAA success criterion has fewer options for conformance. Under the AAA success criterion, at least one authentication method must either:

• Not rely on a cognitive test, or
• Include a mechanism to assist the user with a cognitive test.

Even if you are aiming for AA conformance overall, meeting the AAA standard when possible will create a better experience for some users.

Would your team benefit from having an accessibility specialist available for regular consultation on questions like this? Explore accessibility consulting services from Accessible Web. We also offer the best web accessibility tools in the industry; give them a try for free!