Biometric security used to belong to airports and spy films. Now most people unlock their phones with a fingerprint or face, approve payments with a glance and sign in to banking apps without typing a password. For product teams, biometrics have become an expected part of a modern login.

They are still easy to get wrong. Spoofing, deepfakes, privacy and regulation all raise real questions, and the technology is often misunderstood. This guide covers what biometric authentication is, how it works, how it relates to passkeys and FIDO2, and where biometrics are heading in 2026.

What is biometric authentication?

Biometric authentication verifies who you are using physical or behavioural characteristics instead of, or in addition to, something you know (a password) or something you have (a phone or security key). The system compares a fresh sample, such as a fingerprint scan or face image, with a stored reference called a template, and accepts the user if the match is close enough.

People often mix up two terms. Verification (1:1) asks "Are you the person you claim to be?" and compares the sample with one template, for example the owner of a phone. Identification (1:N) asks "Who are you?" and searches the sample against many templates, as in border control or access control systems. Identification raises much bigger privacy and regulatory questions.

Most consumer and business apps only need verification, and it often happens entirely on the user's own device.

Types of biometric authentication

  • Fingerprint is mature, cheap and available on most phones and laptops. Accuracy can drop with wet, worn or injured fingers.
  • Face recognition is convenient and contactless. Secure implementations use depth or infrared sensing and liveness checks; simple 2D camera matching is easier to fool.
  • Iris recognition relies on highly distinctive patterns and is very accurate, using algorithms John Daugman developed in the 1990s, but it needs specialised cameras.
  • Voice works for call centres and hands-free flows. AI voice cloning makes it easier to attack every year, so it should not be used alone for high-risk actions.
  • Palm and vein patterns are hard to capture without the person's cooperation and appear in some payment and access control systems.
  • Behavioural biometrics look at typing rhythm, swipe patterns, how a device is held and navigation habits. They run continuously in the background and are popular for fraud detection in banking and fintech.

How biometric authentication works in an app

A typical flow has four steps: enrolment (capturing the biometric and creating a template), secure storage of that template, capture of a new sample at login, and matching against a decision threshold.

On modern phones your app usually never sees the biometric at all, and that shapes the whole design. Apple's LocalAuthentication framework (Face ID and Touch ID) and Android's biometric authentication APIs do the matching inside protected hardware. They return only success or failure, or unlock a cryptographic key kept in the device's secure hardware. That is far safer than writing your own face or fingerprint matching and storing templates on a server.

Accuracy is measured with two error rates: the false acceptance rate (an impostor gets in) and the false rejection rate (the genuine user is turned away). Tightening the threshold lowers one and raises the other, so the right setting depends on how risky the protected action is.

Biometrics, passkeys and FIDO2

The biggest change in authentication in recent years is passkeys, built on the FIDO2 standards (WebAuthn in the browser and CTAP for authenticators) from the FIDO Alliance and W3C. The major operating systems and browsers all support them now.

With a passkey, the device creates a key pair for each site or app. The private key stays on the device or in the user's platform credential manager, and the server stores only the public key. At sign-in the server sends a challenge, the device signs it and the server checks the signature. The biometric is how the user unlocks the private key: a fingerprint or face scan tells the device that the right person is holding it.

For a product team this has three consequences:

  • The biometric never leaves the device, so the server holds no fingerprint or face data that could leak.
  • Passkeys resist phishing. Each one is bound to the real domain, and a fake login page cannot collect a usable credential.
  • Users have no passwords to remember, reset or reuse.

For most products in 2026, "adding biometric login" should mean adopting passkeys with the platform's biometric unlock. Collecting biometric data yourself is rarely the right call.

Advantages of biometric security

  • Sign-in and approvals are fast and there are no passwords to forget, which cuts drop-off and support tickets.
  • Combined well, it is stronger: a biometric unlocking a hardware-bound key gives you two factors (possession of the device and inherence) in one gesture.
  • Credential stuffing and password reuse stop working when there is no password to steal.
  • Step-up checks come naturally, since an app can ask for a fresh biometric before a payment or a change to account details.

Risks and limitations

Spoofing, deepfakes and liveness

A biometric is not a secret. Your face is public and you leave fingerprints on every glass you touch. Security therefore depends on liveness, or presentation attack detection, which checks that a live person is in front of the sensor and not a photo, mask, replayed video or fake fingerprint. Generative AI has made realistic fake faces and voices cheap. Remote identity verification also faces injection attacks, where a synthetic video stream is fed straight into the app instead of coming from the camera. Systems that verify people remotely need liveness checks evaluated against standards such as ISO/IEC 30107-3, along with device and app integrity checks.

Biometrics cannot be changed

You can reset a password but not your fingerprints. That is why storing raw biometrics on a server is so risky, and why on-device matching and passkeys are the preferred architecture.

Accuracy and inclusion

Disability, age, injury or skin conditions stop some people from using certain biometrics, and some systems perform worse for some demographic groups. Offer an accessible fallback every time and test with a varied group of users.

Recovery and fallback

Every biometric login has a fallback, whether a device PIN, a recovery flow or a support process, and attackers go after the weakest one. Design account recovery as carefully as the main login.

Privacy and regulation

Many jurisdictions treat biometric data as highly sensitive. In the EU, GDPR classifies biometric data used to uniquely identify a person as a special category of personal data, with stricter conditions for processing. Several US states have their own biometric privacy laws (Illinois' BIPA is the best known), and the EU AI Act restricts some uses of biometric identification and categorisation. Requirements differ by country and use case, so get legal advice for your product. The general principles hold almost everywhere:

  • Prefer on-device verification so you never collect biometric data.
  • If you have to process biometrics, get explicit, informed consent and explain the purpose.
  • Collect the minimum, encrypt it, restrict access, and decide how long you keep it and how you delete it.
  • Check vendors carefully and document data flows.
  • Do not reuse authentication biometrics for anything else, such as marketing analytics.

The future of biometrics

These are the trends we expect to shape biometric security:

  • Passwordless login is becoming the default, with passkeys and biometric unlock replacing passwords for consumers and employees.
  • Authentication is becoming continuous and risk based. Behavioural biometrics and device signals assess risk throughout a session, not only at login.
  • Generative AI has started an arms race. Deepfake detection, injection attack prevention and stronger liveness checks now sit at the centre of remote identity verification.
  • Digital identity wallets are arriving. Government-backed credentials such as the European Digital Identity Wallet initiative combine document data with biometric binding on the user's device.
  • Designs are moving toward privacy: more processing on the device, less central storage of templates, and closer regulatory scrutiny of identification.

Implementing biometric authentication: practical advice

  1. Use platform APIs and passkeys. Do not build your own biometric matching for login.
  2. Tie biometric unlock to a cryptographic key in secure hardware, not to a simple "success" flag that someone could tamper with.
  3. Ask for step-up authentication before sensitive actions, and re-authenticate after device or account changes.
  4. Give recovery and fallback flows the same attention as the main login.
  5. For remote identity verification, pick vendors whose liveness and injection attack detection has been tested independently.
  6. Run a privacy impact assessment and a threat model before launch.

EmphaSoft has built identity, security and face recognition features for clients in several industries, and some of them are in our case studies. Our teams do native iOS development in Swift, cross-platform React Native apps and fintech products, where authentication has to be secure without getting in the user's way.

FAQ

Is biometric authentication more secure than passwords?

Usually yes, if it is on-device verification that unlocks a cryptographic key, as with passkeys. A biometric by itself is not a secret, so the security comes from liveness detection, secure hardware and a solid recovery process.

Do passkeys store my fingerprint or face?

No. The device checks the biometric locally to unlock the private key. Websites and apps get only a signed response and store a public key.

What is liveness detection?

Liveness detection checks that a biometric sample comes from a live person present at capture time, and not from a photo, mask, recording or synthetic deepfake.

What are the main privacy concerns with biometrics?

Biometrics are permanent and personal, so a leak cannot be fixed with a reset. The main worries are central databases, identification without consent and reuse of the data for other purposes. Many laws give biometric data special protection.

Planning biometric login for your product?

If you are adding passkeys, biometric sign-in or remote identity verification to your app, talk to EmphaSoft. We can help you pick the approach, weigh security against user experience and meet privacy requirements.

Biometrics are great at preventing fraudulent access to services and locations, but in the wrong hands, they can quickly turn our lives into a Black Mirror episode. The question of who has the right to store and utilise such extremely sensitive data remains open. Guidelines for the development of the technology, as well as collection, use, and storage of information, must be developed and implemented, despite it not always being clear how to identify and track wrongful practices.