Using the body as a credential
Biometric authentication verifies a person using a measurable physical or behavioral trait instead of, or in addition to, something they know. The most familiar examples are fingerprint and face recognition on phones and laptops. Others include iris patterns, voice, and the geometry of the hand. Some systems also use behavioral signals such as typing rhythm, though these are generally less common as a standalone sign-in method.
The appeal is straightforward: you cannot forget your fingerprint at home, and there is nothing to type. The complications lie in how reliable the matching is and in what happens to the stored data.
Enrollment: creating the reference
Every biometric system begins with enrollment. The user presents their finger or face to a sensor, usually several times from slightly different angles. The system does not normally keep a photograph. Instead, software extracts distinctive features, such as the arrangement of ridge endings in a fingerprint or measurements between points on a face, and converts them into a mathematical representation, often called a template.
That template is what is stored. Later sign-in attempts are compared against it.
Matching: the sign-in step
When you try to unlock a device, the sensor captures a fresh sample, the software extracts features in the same way, and then it compares the new data with the stored template. The result is not a simple yes or no on identical data, because two captures of the same finger are never exactly alike. Pressure, moisture, lighting, angle and small injuries all change the reading.
So the system calculates a similarity score and compares it to a threshold. Above the threshold, access is granted; below it, access is refused. Where that threshold is set is one of the central design decisions.
Accuracy: two kinds of error
Because matching is statistical, there are two basic ways it can be wrong.
- False accept. The system lets in someone who should not be let in, for example, a different person or a convincing imitation.
- False reject. The system refuses the legitimate user, who then must try again or use a fallback method.
These errors trade off against each other. A stricter threshold reduces false accepts but increases false rejects, which frustrates real users. A looser threshold is more convenient but less secure. Designers choose a balance suited to the situation: unlocking a personal phone and entering a secure facility call for different settings.
Accuracy also varies with the sensor, the software and the conditions. Cheap or dirty sensors perform worse, and some systems have been reported to perform unevenly across different groups of people, often because of the data they were developed with. That concern connects to broader questions about training data and algorithmic bias, and it is a reason organizations commonly test systems on the population that will actually use them.
Spoofing and liveness checks
Attackers may try to fool a sensor with a photograph, a recording, a mask or a copied fingerprint. To counter this, many systems include liveness detection, which looks for signs that a real, living person is present, such as depth information, subtle movement, or other physical characteristics. These defenses improve over time, as do attack methods, so no system should be treated as unbeatable. Synthetic images and video, discussed under deepfakes, are one reason that remote face-based checks are an area of ongoing attention.
Where the data lives
A key design question is where the template is stored and where matching happens.
- On the device. Many phones and laptops keep the template in a protected area of the hardware and do the comparison locally. The biometric data never leaves the device; the device simply tells an app that the check succeeded.
- On a server. Some services store templates centrally and compare against them remotely. This can support sign-in across many devices but concentrates sensitive data in one place, which makes it a more attractive target.
On-device approaches are generally regarded as better for privacy, although how any particular product handles the data depends on its design.
Privacy and the problem of permanence
Biometrics raise concerns that passwords do not.
They cannot easily be changed. If a password leaks, you choose a new one. If a stored fingerprint template were stolen, you cannot grow a new finger. Well-designed systems reduce the risk by using templates that cannot easily be turned back into the original image and by protecting them with encryption, and by allowing the enrollment to be reset, but the underlying trait is permanent.
They are personal data. In many places, biometric data is treated as especially sensitive personal data, and collecting it may involve stricter obligations. The details differ by jurisdiction and are best checked with a qualified professional.
They can be collected without much effort. Faces and voices are visible or audible in public, which is a reason face-based identification of people who have not chosen to take part is debated. That wider debate is covered under facial recognition; this article is concerned with the narrower case of a person choosing to sign in.
They may not be freely given. In a workplace, an employee asked to enroll a fingerprint may feel little choice. Organizations often weigh whether the benefit justifies collecting such data, and whether an alternative should be offered.
Biometrics in a layered approach
Biometrics work best as one part of a wider approach rather than a complete answer. A fingerprint on a phone is often used to unlock a secure area that stores a cryptographic key, which is how it fits with passkey sign-in. In that arrangement, the biometric proves you are present at your own device; it is not sent across the internet. Biometrics can also serve as one factor within multi-factor authentication, alongside something you have, such as a hardware key.
Every biometric system also needs a fallback for when it fails, such as a passcode. The fallback is often the weaker link, since an attacker may choose to target it instead.
Questions worth asking
If you are deciding whether to use biometric sign-in, or evaluating a system, useful questions include:
- Is the template stored on the device or on a server?
- What fallback exists when the sensor fails, and how well is it protected?
- Is use voluntary, and is there a reasonable alternative?
- How is the system tested for accuracy across different users and conditions?
- What happens to the data if someone leaves, or the service shuts down?
This article is general information, not legal or security advice. Rules about biometric data differ widely by location, so organizations should seek qualified guidance.