Accessibility
Nearly every way to prove you're a person runs on a countdown. A code appears, you have thirty seconds to read it and type it, and if you need longer than that the internet decides you're not real.
That's a strange way to treat people, from an industry whose whole job is telling humans apart from machines.
22 of 33
Only twenty-two of thirty-three tested combinations of screen reader and authentication method reached acceptable usability. The rest were somewhere between difficult and impossible.
“Broken Access”, ACM Web Conference, 2025One-time-code inputs routinely ship without accessible names or live regions. A screen-reader user may not be told a code was sent, where to type it, how long they have, or whether it worked.
Nothing about security requires a code to expire while you're still reading it. That window excludes people using switch control, magnification, or simply moving at their own pace.
We looked at the major authenticator apps, including the ones the privacy community recommends. None we looked at markets accessibility as a strength. It's an open lane, and it shouldn't be.
Not because we solved a hard problem. Because a signed credential is a different shape from a code you retype — and that shape happens to be the accessible one.
| A code you type | A 5arz badge | |
|---|---|---|
| Time limit | 30–60 seconds | None |
| You must read something | Yes, accurately | No |
| You must retype something | Yes, without error | No |
| Fails if you're slow | Yes | No |
| Works one-handed or by switch | Often not | Yes |
| Works with no sight at all | Depends on the site | Yes |
Your device holds the credential and presents it when asked. There's nothing to read, nothing to transcribe, and no clock. We didn't design that for accessibility — but it is the accessible answer, and it would be strange not to say so.
Written as commitments rather than features, because these are things we should be held to.
A page like this is worth nothing if it only lists wins.
We build to WCAG 2.2 AA, but we have not yet completed an independent audit. When it's done, the report goes on this page — including whatever it finds.
Your first document check runs in an identity vendor's own flow, and its accessibility isn't ours to control. We're testing vendors on this and will say which we use and how they perform. Every check after the first is ours, and has no timer.
This goes to a person, not a form queue. Tell us what you were trying to do, what assistive technology you use, and where it broke. We'll reply.
If you'd rather not email, anything you send to info@5arz.com marked “accessibility” reaches the same people.