Skip to content
SilktideHelp

Accessible login

Silktide finds login forms on your pages and asks you to confirm that signing in does not force visitors to remember, transcribe, or puzzle out information. Tests of memory or problem-solving are only acceptable when an alternative or assistance is offered.

Why this matters

Passwords, usernames, and puzzles are all cognitive function tests: they demand memory, transcription, or calculation. For people with cognitive disabilities these tests can make signing in impossible, locking them out of accounts they own. A login that supports a password manager, by contrast, reduces the whole test to a couple of clicks.

How to fix it

This check asks you to verify each login form manually. Most login forms pass if they meet all of the following:

  1. Password managers work. The form allows software to fill in the username and password. Use standard fields with autocomplete="username" and autocomplete="current-password", and never ask for selected characters ("enter the 3rd, 7th, and 1st characters of your PIN"), which defeats them.
  2. Paste is allowed. Do not block pasting into the username or password fields.
  3. No unassisted puzzle. A or similar test must not be the only way in. At this level, exceptions exist for recognizing objects in images and for identifying content the user themselves provided (such as a photo they uploaded).
  4. No invented username. Requiring a made-up handle (like @joe1987) is a memory test. An email address or phone number is fine, because people use them everywhere.

If the form cannot be brought in line, offer an alternative sign-in that avoids the cognitive test entirely, such as an emailed sign-in link or a passkey.

If a flagged form already meets these conditions, the finding.

How Silktide tests this

  1. Examine every form on each page for the shape of a login form: either a username field followed by a password field (with at most a couple of extras such as a "remember me" checkbox), or a single-field first step asking for a username, as some major sites use.
  2. Flag each detected login form for your review. Whether password managers, paste, and alternatives work can only be confirmed by trying them, so a human decides.

Troubleshooting

A form was flagged that is not a login

The detection looks for the structure of a login form, and occasionally another small form matches it. If the form does not sign anyone in, approve the finding.

My login is on a separate domain or behind a button

Silktide can only examine login forms on the pages it scans. A login hosted elsewhere (such as a separate identity provider) should be checked there manually.

Learn more

Last updated

Was this page helpful?