How Do Fingerprint and Face Unlock Work on Your Phone?

In everyday life

Pick up your phone and look at the screen, and it unlocks. Rest a finger on it, and a payment goes through. On the iPhone, Touch ID (fingerprint) arrived in 2013, and Face ID (face) in 2017.

Still, some people worry. Are photos of their fingerprint or face kept on the phone, or sent to the maker? Others wonder whether someone who looks just like them could open it.

Biometrics: checking who you are by your body

There are three broad kinds of clue for checking that you are you. There is something you know (a PIN or password), something you have (such as your phone) and something about your body. Checking who you are by features of your body is called biometric authentication. How to combine the three is covered in "How Are Passwords Cracked?"

The big difference from a password is that the reading is never exactly the same twice. The pattern the sensor reads shifts slightly with the angle and pressure of your finger, and with how dry it is. A face looks different with the lighting, your expression and glasses. So the phone doesn't ask "Is it an exact match?" It asks "How similar is it?"

It turns the similarity into a score, and treats you as the owner if the score passes a set line. This line is called the threshold. Where to set it comes up later, in "Two kinds of mistakes."

Fingerprint sensors: three types

The skin of your fingertip has rows of thin raised lines, called ridges. Between two ridges is a slight dip, called a valley. A fingerprint sensor is a semiconductor chip that reads this pattern of ridges and valleys as a grid of tiny dots. There are three main ways to read it.

Capacitive: measuring how much charge builds up

Under the sensor's surface sits a dense grid of tiny plates that conduct electricity. These plates are called electrodes. When you place a finger, the ridges come very close to the electrodes. The valleys sit a little farther away.

Each electrode and the finger above it can store a little electric charge. The amount they can store is called capacitance, and it grows the closer they are. So an electrode under a ridge gives a large value, and one under a valley gives a small value. Lay the values out as light and dark, and the fingerprint pattern appears. It is the same idea as a touchscreen, explained in "How Do Touchscreens Work?"

Apple's Touch ID uses this capacitive sensing method. According to Apple, it reads a detailed image from below the outermost layer of skin.

Optical: lighting the finger with the screen and taking a picture

Most sensors that read your finger through the screen itself are optical. Many phones have OLED screens. In these, each of the tiny dots that make up the picture (pixels) gives off its own light. When the spot under your finger lights up, the light bounces off the finger. Ridges and valleys reflect it differently, which creates a pattern of light and dark.

A small camera sensor under the screen picks up this light. It turns light into electricity the same way as the image sensor in a phone camera (see "How Do Image Sensors Work?"). Fingerprint sensors placed under the screen began appearing in phones around 2018.

Ultrasonic: measuring shape from sound that bounces back

Sound too high-pitched for human ears to hear is called ultrasound. An ultrasonic sensor sends ultrasound from under the screen toward the finger and measures what bounces back. The ridges touch the surface, but there is a tiny gap of air above each valley. This difference changes how the sound bounces back.

Qualcomm's "3D Sonic" ultrasonic sensor was used in Samsung's 2019 Galaxy S10 series.

Recognizing a face: flat images vs 3D shape

There are two broad approaches to face unlock. One compares images taken with the ordinary front camera. It needs no special parts, but the image is flat. Telling a real face apart from a photo, or from a face shown on a screen, takes extra measures.

The other also measures the bumps and hollows of the face, that is, its 3D shape. Apple's Face ID works this way. The top of the iPhone's front holds a cluster of parts that use infrared light (a kind of light human eyes can't see). Apple calls this the TrueDepth camera.

Three parts do most of the work. One lights the whole face with invisible light. Another projects many dots of invisible light (the dot projector). The third is an infrared camera that photographs them. Apple's support page says "thousands" of dots. The 2017 iPhone X announcement said "more than 30,000." Because the phone supplies its own light, it works in the dark too.

Shine the dots on a flat wall, and they appear in the same fixed pattern. Shine them on a face, and they appear slightly shifted where the nose sticks out or the eyes sit deeper. From these shifts, the phone works out the distance to each spot. The resulting "distance map" of the face is called a depth map.

Once the 3D shape is known, fooling the system with a flat photo becomes hard. Face ID combines the depth map with an infrared image, and turns the features of the face into numbers.

What's stored is not a photo but "feature numbers"

When you enroll a finger or face, the phone does not save the image as it is. It pulls out only the features needed for comparison and turns them into a list of numbers. This list is called a template. When you unlock, the phone turns the new reading into numbers the same way and compares them with the template.

Features often used for fingerprints are the points where a ridge ends and where it splits in two. A document from the US National Institute of Standards and Technology (NIST) also describes matching by the position and direction of such points. However, which features phone makers actually use is mostly not public.

For Touch ID, Apple says it stores only a mathematical representation of the fingerprint, not an image of the finger. Apple's explanation is that the original fingerprint image can't be rebuilt from the stored data.

Even so, you can't say feature numbers are safe just because they aren't images. A 2007 study produced closely matching fingerprint images from feature-point data in a standard format. And unlike a password, a fingerprint or face can't be replaced if it leaks. That's why the feature numbers are also encrypted and protected so they don't leave the device.

Where it's stored: a "protected area" inside the chip

Templates are stored and compared in a special area built into the phone's chip. Ordinary apps can't look inside it. Neither can the core software that runs the whole phone, the operating system (OS). On the iPhone, this area is called the Secure Enclave.

According to Apple's developer documentation, the Secure Enclave is a computing circuit for security, isolated from the rest of the system. An app that uses your fingerprint or face receives only one answer: success or failure. Fingerprint images and the like are never handed to the app.

The Secure Enclave sits inside the chip at the center of the phone's computing (on the 2013 iPhone 5s, the A7). The chip as a whole is introduced in "What Chips Are Inside a Smartphone?"

Attacks on secrets don't only use software. Some disturb the power supply voltage, and some open up the chip to examine what's inside. The ability to withstand such physical attacks is called tamper resistance. Apple says it deliberately runs the Secure Enclave's circuit at a lower speed. This protects it against attacks that disturb its power supply and similar inputs.

Android's official documentation also requires that neither the raw images from the sensor nor the templates be visible outside an isolated environment. The leading example of such an environment is the trusted execution environment (TEE).

A widely used way to build a TEE is Arm's TrustZone. It lets one chip switch between a normal world and a protected world. The circuitry itself keeps the normal world from reaching the protected world's memory.

When a template is saved, it is encrypted with a key that only the TEE knows. Android's documentation also requires that a template file be unusable if moved to another device. The enrolled data has meaning only on that one phone. How the dedicated parts that store keys differ is compared in "TPM vs HSM vs Secure Element."

Two kinds of mistakes

Biometrics can make two kinds of mistakes. One is judging another person to be you. The rate at which this happens is called the false acceptance rate, or FAR for short.

The other is rejecting you even though it really is you. This rate is called the false rejection rate (FRR). When you have to place your finger again and again, false rejections are happening. Making the threshold stricter lowers the false acceptance rate and raises the false rejection rate. The two pull against each other.

Some attacks try to fool the sensor with a fake instead of a real finger or face. Separately from the false acceptance rate, Android tests the rate at which fakes get through (SAR). That's because the false acceptance rate is the chance that a randomly chosen other person gets in by chance. It doesn't show how well the system resists fakes. Android uses this rate, among others, to sort biometrics into three classes. The strongest is Class 3.

Apps can choose to accept only Class 3 biometrics. So on some phones, face unlock can open the lock screen but can't be used in some apps.

By the numbers

Here are the published chances that "someone else gets in by chance," next to the chance of guessing a PIN in one try. Each value is as stated in its source as of 2026.

Apple's values are its own estimates of the chance that one randomly chosen person gets in by chance. Enrolling more fingers or appearances gives more to compare against, so the chance goes up. Apple warns that the chance is higher for twins, siblings who look alike, and children under 13. That's because a child's facial features may not have fully developed yet. If this concerns you, Apple recommends using a passcode.

Android's 1 in 50,000 is the rate for a randomly chosen other person, and it is a target shared by every class. What separates the classes is mainly how well they resist fakes.

The PIN values assume the digits are picked at random. A PIN that's easy to guess, like a birthday, is much weaker than the table shows.

There's also a limit on failed attempts. For Face ID and Touch ID, Apple requires the passcode after five failed matches. So someone else can't just keep trying and wait to get lucky.

Why you still need a PIN or passcode

To use biometrics, you first have to set a PIN or passcode. Biometrics don't replace the passcode. They are a shortcut that saves you typing it every time.

The first reason is that biometrics sometimes can't be used. Your finger may be wet or injured, or something may be in front of your face. Apple also requires the passcode in cases like these:

• Right after the phone is turned on or restarted
• When it hasn't been unlocked for more than 48 hours
• After five failed match attempts
• When the passcode hasn't been used for six and a half days (156 hours) and biometrics haven't been used for 4 hours

The second reason is data encryption. Photos and messages on the phone are encrypted with keys tied to the passcode (see "What Is Encryption?"). Always asking for the passcode after a restart is part of this protection. To put it simply, biometrics are a check that lets you keep using a key the passcode has already unlocked.

The third reason is that you can't change your fingerprints or face. You need a separate method that you can replace if something leaks.

Passkeys: your fingerprint is not sent to the site

More and more services let you sign in with a passkey instead of a password. With a passkey, your phone creates and keeps a secret key for each site. The site is given only the matching key meant to be shared, called the public key. This approach is based on public-key cryptography.

When you sign in, the phone uses the secret key to make a signature and sends it to the site. A signature is a mark that only a device holding that key can make (a digital signature). The fingerprint or face check decides whether the secret key may be used (a PIN or similar can also do this job). Once the check passes, the key can be used inside the device.

The FIDO Alliance, an industry group, explains that biometric information and its processing stay on the device and are not sent to servers. All the server learns is that checking who you are succeeded. Even if data is stolen from a site, there's no fingerprint or face data in it.

In short, your fingerprint or face is not "a certificate you show the site." It is "a signal that unlocks the key on your own device."

Common myths

Learn more

• How PC and server CPUs protect secrets: enclaves
• Running only trusted software from the moment of power-on: Secure Boot vs Measured Boot
• The basics of keys and signatures: What Is Encryption? Symmetric vs Public-Key
• Check the two kinds of mistakes with real counts: Confusion matrix calculator