WCAG 2.2.1: Timing Adjustable
A countdown that suits an average user is a locked door for someone who reads slowly, types with a switch, or navigates a screen at 400% zoom. This criterion asks that for every time limit the content sets, the user can turn it off, adjust it, or extend it before it runs out. Time limits are still allowed — they just must not silently push people off the page.
The success criterion, in full
For each time limit that is set by the content, at least one of the following is true: Turn off: The user is allowed to turn off the time limit before encountering it; or Adjust: The user is allowed to adjust the time limit before encountering it over a wide range that is at least ten times the length of the default setting; or Extend:The user is warned before time expires and given at least 20 seconds to extend the time limit with a simple action (for example, “press the space bar”), and the user is allowed to extend the time limit at least ten times; or Real-time Exception: The time limit is a required part of a real-time event (for example, an auction), and no alternative to the time limit is possible; or Essential Exception: The time limit is essential and extending it would invalidate the activity; or 20 Hour Exception: The time limit is longer than 20 hours.
The first three options are the remedies you build; the last three are exceptions that exempt a limit entirely. You only need to satisfy one of the six for any given time limit.
Who this helps
Everyone occasionally needs a moment longer than a designer assumed — to re-read, to find a card number, to answer the door. For many disabled users that extra time is not a convenience but the difference between finishing a task and being locked out:
People who read or type slowly
Users with cognitive, learning, or language differences may need several times longer to read instructions and enter information. A fixed timer punishes them for taking the time they need.
Low-vision users
Navigating at high magnification means only a fraction of the screen is visible at once, so locating fields, warnings, and buttons takes longer — often longer than a short countdown allows.
Screen reader users
Content is heard linearly, one item at a time. Reaching and understanding a form, then a timeout warning, then the extend control takes real time that a silent expiry does not grant.
People with motor impairments
Switch access, eye-gaze, and one-handed or tremor-affected typing all slow input. Completing a checkout or re-locating an 'extend' button can easily exceed a tight limit.
People using AAC devices
Users who compose responses on augmentative and alternative communication devices build messages slowly and deliberately; abrupt timeouts discard that effort.
Anyone who gets interrupted
A phone call, a child, a dropped connection — real life interrupts everyone. Adjustable timing means a two-minute distraction does not cost someone their work.
What the requirement covers
Whenever your content imposes a time limit — a session that expires, a cart hold that releases, a quiz that ends, a carousel that advances — you must provide at least one of three user controls before the user runs into the limit:
- Turn off. Let the user switch the time limit off before they encounter it. This is the simplest, most robust option: no clock, no barrier.
- Adjust. Let the user lengthen the limit before it applies, over a wide range that is at least ten times the default — so a 20-minute default should be adjustable up to at least about 200 minutes.
- Extend. Warn the user before time runs out, give them at least 20 seconds to respond with a simple action (a single keystroke or click), and allow at least ten extensions.
The exceptions, briefly
A time limit is exempt if it meets any one of three narrow exceptions. Reach for these carefully — they are specific, and a vague appeal to “security” is not among them.
- Real-time Exception. The limit is a required part of a real-time event — a live auction, a synchronized multiplayer round — and no alternative to it is possible.
- Essential Exception. The limit is essential and extending it would invalidate the activity. A genuinely timed test of speed is the textbook case; a session timeout rarely is.
- 20 Hour Exception. The limit is longer than 20 hours. A window that long is not a practical barrier, so no additional control is required.
Pass and fail examples
✓ Passes 2.2.1
- A session that shows “You will be logged out in 2 minutes” with an Extend session button, extendable at least ten times.
- A settings option to turn the inactivity timeout off, or lengthen it, before it applies.
- A checkout that keeps the cart server-side, so re-authenticating after a timeout loses no work.
- A carousel that pauses (or has no auto-advance) so it sets no time limit at all.
- A live auction countdown — exempt under the Real-time Exception.
✗ Fails 2.2.1
- A session that logs the user out silently, with no warning and no way to extend.
- A checkout form that expires and clears entered data with no chance to continue.
- A page that redirects after a fixed countdown the user cannot pause or stop.
- A ticket or seat hold that releases too fast with no adjust or extend option.
- A short timeout justified only by a blanket “security requires it” claim.
Code examples
A timeout warning with a simple extend action
Warn before the limit expires and expose a single, keyboard-operable control to extend. The dialog is announced through a live region so screen reader users hear it in time to act.
<!-- ✗ Silent, fixed timeout — no warning, no control -->
<div class="notice">Your session will expire in 5 minutes.</div>
<!-- ✓ Warned, and extendable with a simple action -->
<div id="timeout-warning" role="alertdialog" aria-live="assertive"
aria-labelledby="to-title" aria-describedby="to-desc" hidden>
<h2 id="to-title">Session expiring soon</h2>
<p id="to-desc">
Your session expires in <span id="secs">30</span> seconds.
</p>
<button id="extend" type="button">Extend session (Space)</button>
</div>Warn, then allow at least ten extensions
Show the warning before expiry, give the user at least 20 seconds to respond, and permit the extension at least ten times.
const LIMIT = 15 * 60; // 15-minute session, in seconds
const WARN_AT = 60; // warn 60s before expiry (> 20s minimum)
const EXTEND_BY = 15 * 60;
const MAX_EXTENSIONS = 10; // at least ten times
let remaining = LIMIT;
let extensionsUsed = 0;
const tick = setInterval(() => {
remaining -= 1;
if (remaining === WARN_AT) showWarning(); // warn BEFORE expiry
if (remaining <= 0) { clearInterval(tick); expireSession(); }
}, 1000);
function extend() {
if (extensionsUsed >= MAX_EXTENSIONS) return;
remaining += EXTEND_BY;
extensionsUsed += 1;
hideWarning();
announce(`Session extended. ${MAX_EXTENSIONS - extensionsUsed} extensions left.`);
}
// A single keystroke satisfies the "simple action" requirement.
document.getElementById('extend').addEventListener('click', extend);
document.addEventListener('keydown', (e) => {
if (e.code === 'Space' && isWarningVisible()) { e.preventDefault(); extend(); }
});Turn off or adjust the limit before it applies
Offering a preference to disable or lengthen the timeout satisfies the “Turn off” and “Adjust” options — the adjustable range must reach at least ten times the default.
<fieldset>
<legend>Session timeout</legend>
<label>
<input type="radio" name="timeout" value="900" checked>
15 minutes (default)
</label>
<label>
<input type="radio" name="timeout" value="9000">
150 minutes (10× the default)
</label>
<label>
<input type="radio" name="timeout" value="0">
No time limit
</label>
</fieldset>Interactive demo
Watch a 30-second session count down. The adjustable version warns you before it expires and lets you extend with one click; the silent version simply logs you out. Toggle between them to feel the difference 2.2.1 is asking for.
Adjustable session
Session started with 30 seconds remaining.
The adjustable version warns you 10 seconds before expiry and lets you extend by 20 seconds with one click, up to 10times — meeting the “warn and extend” remedy. The silent version simply logs you out.
Common failures
- Session or authentication timeouts that log the user out with no warning and no way to extend.
- Forms and checkout flows that expire and discard entered data before the user can finish.
- Timed quizzes or tests with a fixed limit that cannot be adjusted (unless the timing is genuinely essential).
- Auto-advancing carousels, slideshows, or news tickers that move on before slow readers can keep up.
- Pages that redirect on a countdown the user cannot pause, stop, or turn off.
- A 'your session will expire' message with no control to actually extend or postpone it.
- Ticket, seat, or inventory holds that release too quickly with no adjust or extend option.
- Justifying a short, fixed timeout with a blanket 'security requires it' claim that is not one of the real exceptions.
- An extend control that appears only at (or after) expiry, giving the user less than 20 seconds — or no time — to respond.
How to test for 2.2.1
- 1
Enumerate every time limit
List all limits the content sets: session and inactivity timeouts, form and checkout expiries, cart and seat holds, quizzes, auto-advancing carousels, and countdown redirects. Automated tools rarely find these, so this step is manual.
- 2
For each limit, check for a control
Confirm the user can do at least one of: turn the limit off, adjust it over a range that is at least ten times the default, or be warned and extend it. If none is present, the limit fails unless an exception applies.
- 3
Verify the warning comes before expiry
Where you rely on the extend path, let a limit run down and confirm the warning appears while there is still time to act — not at the moment of, or after, expiry.
- 4
Confirm the extend action is simple and generous
The user should be able to extend with a single keystroke or click, have at least 20 seconds to respond, and be able to extend at least ten times. Test it with the keyboard alone.
- 5
Test with assistive technology
With a screen reader running, verify the warning is announced (an aria-live or role='alertdialog' region) and that the extend control is reachable and operable. A visual-only warning fails non-visual users.
- 6
Validate any claimed exception
If a limit is exempted, confirm it genuinely meets the Real-time, Essential, or 20 Hour exception. 'Security' alone is not an exception; a real-time auction or a truly timed test is.
For a structured audit, work through the full WCAG 2.2 checklist.
Related Success Criteria
Moving, blinking, or auto-updating content can be paused, stopped, or hidden.
Timing is not an essential part of the event or activity.
Interruptions can be postponed or suppressed by the user.
User data is preserved when a session expires and re-authentication is required.
Users are warned of the duration of inactivity that could cause data loss.
Frequently asked questions
What does WCAG 2.2.1 Timing Adjustable require?
For every time limit that the content sets, at least one of three things must be true before the user encounters the limit: they can turn the time limit off; they can adjust it over a wide range that is at least ten times the default length; or they are warned before it expires, given at least 20 seconds to extend it with a simple action such as pressing the space bar, and allowed to extend it at least ten times. The criterion does not ban time limits — it insists that users who need more time can get it. It is a Level A criterion under Guideline 2.2 Enough Time.
Are there any exceptions to WCAG 2.2.1?
Yes, three. The Real-time Exception applies when the time limit is a required part of a real-time event, such as an auction, and no alternative to it is possible. The Essential Exception applies when the time limit is essential and extending it would invalidate the activity — a genuinely timed skills test is the classic example. The 20 Hour Exception applies when the limit is longer than 20 hours, on the reasoning that such a long window is not a practical barrier. If a time limit meets any one of these, it is exempt. 'Security requires it' is not one of the exceptions, and a blanket security claim does not satisfy the criterion on its own.
Does a session timeout automatically fail 2.2.1?
Not automatically — it depends on how the timeout behaves. A session that logs the user out silently, with no warning and no way to extend, fails. A session that warns the user before it expires, offers a simple 'Extend session' action giving at least 20 seconds to respond, lets them extend at least ten times, or lets them turn the limit off, passes. Preserving the user's data server-side so that re-authenticating does not lose their work is also a recognised technique (and is specifically what the related AAA criterion 2.2.6 Timeouts addresses).
How does 2.2.1 relate to 2.2.3, 2.2.4, and 2.2.6?
They all live under Guideline 2.2 Enough Time but set different bars. 2.2.1 Timing Adjustable (Level A) is the baseline: give users control over content-set time limits. 2.2.3 No Timing (AAA) goes further and removes timing as a requirement entirely except for non-interactive synchronized media and real-time events. 2.2.4 Interruptions (AAA) lets users postpone or suppress interruptions such as auto-updates. 2.2.6 Timeouts (AAA) requires warning users about the duration of any inactivity that could cause data loss. Meeting 2.2.1 is the required minimum; the AAA criteria are enhancements.
What counts as a 'time limit set by the content'?
Any time constraint the page or application imposes on the user: authentication and session timeouts, shopping-cart or seat/ticket holds that release after a period, forms and checkout flows that expire, timed quizzes and tests, auto-advancing carousels and slideshows, content that redirects after a countdown, and inactivity auto-logout. It does not include limits outside the content's control, such as the user's own operating-system screen-lock. If your code starts a clock that changes what the user can do when it runs out, 2.2.1 applies to it.
How much time does the 'extend' option need to give?
When you rely on the warn-and-extend path, the warning must appear before the limit expires, the user must have at least 20 seconds to respond with a simple action (a single keystroke or click — 'press the space bar' is the specification's own example), and they must be able to extend the limit at least ten times. Twenty seconds is a floor, not a target; give people comfortably more where you can, because motor-impaired users, screen reader users, and people using AAC devices may need time just to locate and activate the control.