Accessibility Required
Make signing in easy for everyone
Never make signing in depend only on remembering, copying out or solving puzzles. Allow paste and password managers. This is WCAG 2.2 criterion 3.3.8 (AA).
How to do it
Allow paste and password managers. Offer passkeys or email links. Avoid puzzles and memory tests.
Example
<!-- No onpaste blocking. The autocomplete tokens let password managers fill in. -->
<input id="user" type="email" autocomplete="username webauthn">
<input id="pass" type="password" autocomplete="current-password">
How to check
Sign in using only a password manager.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/accessibility/accessible-authentication.