Biometric Authentication: How Fingerprints and Face Unlock Really Work

The Third Factor

Authentication factors come in three kinds: something you know (passwords, PINs), something you have (your phone, a security key), and something you are. Biometrics is that third category: fingerprints, facial geometry, iris patterns, voice, even typing rhythm. The appeal is obvious: you cannot forget your face, cannot leave your fingerprint at home, and nobody phishes it out of you with a fake login page the way they can a password.

How the three factors combine is covered in our 2FA vs MFA explainer. This post is about how the "something you are" part actually functions at a technical level, because it works differently than most people assume, and understanding the mechanics changes how you should trust it.

Your Phone Does Not Store Your Fingerprint

The near universal misconception: that a fingerprint image or face photo sits in a database somewhere, ready to be stolen like a password file. What actually happens is closer to a one way conversion:

1. At enrollment, the sensor captures your fingerprint or face across multiple angles or pressure points.
2. The system extracts a mathematical template: measurements of ridge patterns, minutiae points, or facial geometry, not a stored image. The original scan is typically discarded immediately after the template is derived.
3. The template is stored inside dedicated secure hardware: Apple's Secure Enclave, Android's Trusted Execution Environment (TEE) or dedicated Titan M security chip. Regular apps, and even the operating system proper, cannot read it, extract it, or export it.
4. At each unlock, a fresh scan is compared to the template inside that secure hardware, using a matching algorithm that tolerates natural variation (a slightly different finger angle, changed lighting). Out comes only a yes or no confidence score crossing a threshold, never the underlying data.

When you use Face ID to log into your bank app, the bank receives no facial data whatsoever: it receives a cryptographic confirmation, usually in the form of an unlocked private key producing a signature, that the device's owner is present. This is the same architecture passkeys build on (see our FIDO2 explainer): the biometric unlocks a locally stored private key, and only a signature ever leaves the device.

The correct mental model: biometrics do not replace your secrets. They guard the vault your secrets live in. That is why the fingerprint that unlocks everything never itself travels anywhere.

How the Sensors Actually Work

• Capacitive fingerprint sensors (most phones and laptops): an array of tiny capacitors measures the electrical difference between fingerprint ridges (closer to the sensor, more charge) and valleys (further away, less charge), building a ridge map without needing light at all. Apple cites odds around 1 in 50,000 of a random person's finger falsely matching; spoofing needs a quality lifted print, often reconstructed from a latent print with conductive material, and real effort most casual attackers will not invest.
• Optical in-display sensors (many recent Android flagships): a small camera under the screen photographs the finger, illuminated by the display itself, and software analyzes the ridge pattern from the image. Generally solid, though historically slightly easier to fool with a very high resolution printed replica than capacitive sensors.
• Ultrasonic in-display sensors (Samsung's Galaxy line, among others): sends ultrasonic pulses through the screen and reads the echo pattern bouncing off ridges and valleys, effectively mapping the finger in a rough 3D profile rather than a flat image. This makes it noticeably harder to fool with a 2D printed fingerprint than optical sensors.
• Structured-light and depth-sensing face systems (Face ID class): project thousands of invisible infrared dots onto the face and read the distortion pattern to build an actual 3D depth map, then cross-check it with an infrared image for texture. Photos and screens fail against them because a flat image has no depth to distort the dot pattern. Apple cites about 1 in 1,000,000 random match odds, with an explicit caveat that odds worsen for identical twins and close siblings.
• Camera-only face unlock (some cheaper Android phones): plain 2D image matching using the regular front camera, historically fooled by a printed photo or a video played on another screen. Fine as a convenience lock for a phone left on a desk, not as a security boundary for anything sensitive. Android's own compatibility rules label these implementations as weaker biometrics and restrict which apps and permissions are allowed to trust them.

Where Biometrics Shine

• Device unlocking: a phone unlocked 100 times a day needs authentication that takes half a second, or people disable locking entirely out of sheer friction. Biometrics made strong device security the path of least resistance: arguably their single biggest real world security win, since an unlocked, unsecured phone is a bigger practical risk than almost any password weakness.
• Gating apps and passkeys: your authenticator app, password manager, and banking apps piggyback on the platform biometric, letting long random master secrets stay long and random since you rarely have to type them out by hand.
• Payment confirmation: a fingerprint or face scan per transaction beats a PIN typed in full view of a queue, and it happens fast enough that it does not slow checkout down.

The Honest Weaknesses

• You cannot rotate your face. A compromised password gets changed in thirty seconds; a compromised biometric template is compromised for the rest of your life, since you only have one face and ten fingerprints total. Secure enclave storage exists precisely to make large scale theft of templates near impossible, but it is exactly why biometric databases held server side (government identity systems, some corporate access systems) are a fundamentally different, higher stakes risk category than templates that never leave a single device.
• Coercion and legal compulsion: a finger can be physically pressed onto a sensor by someone else, or a face held up to a camera, in a way a memorised password cannot be extracted without your active cooperation. In several jurisdictions, courts and legal precedent treat compelling someone to unlock a device biometrically differently from compelling them to reveal a password, sometimes with weaker protection for the biometric case. Both iOS and Android ship a quick lockdown mode that disables biometric unlock and forces the passcode instead, worth learning in advance (hold the side and volume buttons briefly on iPhone; the lockdown option sits in the Android power menu on most recent versions).
• Presentation attacks and edge cases: attention detection (checking that eyes are open and focused on the device) defeats most photo and sleeping-person attacks on modern systems, but cheap 2D face unlock genuinely remains weak against a decent printed photo or video replay.
• The fallback is the real boundary. Every biometric system has a PIN or password behind it for cold boots, failed reads, or too many failed attempts. An attacker who learns your weak fallback PIN does not need your fingerprint at all; they simply wait for a failed scan and type the PIN instead. Make the fallback strong: our strong password guide and generator apply here just as much as anywhere else.

Why Biometrics Are Usually Local Unlock, Not True Network MFA

A subtlety worth stating plainly: biometrics rarely function as a second factor over a network the way a TOTP code or hardware key does. When Face ID unlocks your phone, no biometric data crosses a network at all; it never needed to. When a website's login flow uses a passkey, the biometric step is purely local, unlocking a private key that then performs the actual network authentication through a cryptographic signature. In neither case has the remote server ever "checked your fingerprint." It is checking a signature that your fingerprint happened to release.

This is why security researchers describe biometrics as an unlock mechanism layered on top of a real credential, rather than a credential in their own right. A server cannot store or verify "your fingerprint" over the internet in any standard, reputable authentication scheme; anything claiming to do so directly, rather than through a local device unlocking a stored key, should be treated with suspicion.

Biometrics in Your 2FA Setup

Practical placement for a personal security stack:

1. Biometric unlock on your phone, with a strong, non-guessable fallback passcode, not a birthday or repeated digits.
2. Authenticator app (or passkeys) on that phone for your accounts: the biometric then implicitly protects every code and credential behind it. Curious how the codes themselves work? Our free TOTP generator shows the mechanism live in your browser.
3. Biometric-gated password manager for unique passwords everywhere, so the one thing you must remember is the master unlock, not fifty individual passwords.
4. For your highest value accounts, a hardware key whose touch requirement is possession based rather than biometric, and therefore immune to remote extraction of any kind.

Frequently Asked Questions

Can someone unlock my phone with my photo?

Against 3D systems like Face ID: no, photos and video played on screens lack the depth and infrared texture the sensor requires. Against basic 2D camera unlock on budget devices: historically yes, sometimes, with a good enough printed photo or video. Know which kind your phone actually uses before trusting it with banking apps.

Can hackers steal my fingerprint from my phone remotely?

The template sits in isolated secure hardware that even the operating system cannot read, and it is mathematical data derived from the scan, not a storable image. Remote extraction over a network has no practical path with current phones. The realistic risks are physical: lifted latent prints, coercion, or holding a device up to a sleeping person's face, not anything achievable purely through malware.

Is Face ID or fingerprint more secure?

Modern 3D face systems quote better random-match odds on paper; quality fingerprint sensors, particularly capacitive and ultrasonic designs, resist casual spoofing very well too. Both sit far beyond the four digit PINs they replaced in practice. The honest answer: whichever one you will actually use consistently, backed by a genuinely strong fallback code, matters more than the marginal difference between the two.

Should a website ever ask me to upload my fingerprint or a photo of my face?

No legitimate consumer login works that way. Real biometric authentication happens on your device through the platform layer (WebAuthn prompts, an app's biometric gate calling into the OS), never by transmitting raw biometric images to a remote server for login purposes. A site asking you to upload a fingerprint image or face photo is either performing a separate, regulated identity verification process, or attempting something you should walk away from.

What happens to biometric login if my finger is injured or bandaged?

The fallback PIN or password takes over immediately, and you can enroll multiple fingers in advance, so do that today if you have not already. Enroll at least one finger from each hand, and a bandaged thumb becomes a non-event instead of a lockout.