Biometric authentication is a method of verifying identity using a person’s unique physical or behavioral characteristics (such as a fingerprint, face, voice, or typing pattern) rather than something they know or carry. It’s the "something you are" factor, and it underpins much of modern passwordless login.

Biometrics are popular for a simple reason: they’re convenient and hard to forget or lose. You can’t misplace your fingerprint the way you misplace a password. But they come with distinct properties that shape how they should be used.

Physical vs. behavioral biometrics

• Physical biometrics, fingerprint, facial geometry, iris, voiceprint. Measured at a point in time to confirm identity, typically at login.
• Behavioral biometrics, typing rhythm, swipe gestures, mouse movement, gait. Measured continuously, often used for fraud detection and continuous authentication rather than a single login check.

How device biometrics enable passwordless

An important nuance: in passkey-based login, the biometric usually stays on the device. Your fingerprint or face unlocks the private key stored in your phone’s secure hardware; the biometric data itself is never sent to the website. This is what makes device biometrics both convenient and privacy-preserving, the service gets a cryptographic proof, not your face.

Benefits and cautions

Biometrics remove password friction and resist the reuse and phishing problems of shared secrets. The cautions are real, though: biometrics can’t be "reset" like a password if the underlying template is ever compromised, so template storage and matching must be handled carefully (on-device where possible). And any server-side biometric matching (as in identity verification) must defend against spoofing and deepfakes with liveness and presentation-attack detection. Used well (on-device for authentication, with strong anti-spoofing where server-side matching is required) biometrics are a cornerstone of secure, low-friction identity.

Biometrics, privacy, and regulation

Because a biometric is permanent and personal, it carries obligations a password doesn’t. You can reissue a leaked password; you can’t reissue someone’s face. That permanence is why regulation treats biometric data as sensitive: under GDPR it’s a special category requiring explicit consent and a lawful basis, and several jurisdictions (such as Illinois’ BIPA in the US) impose specific consent and handling rules with real penalties. The design principles that follow are practical: keep biometric templates on the user’s device wherever possible so the service never holds them; where server-side matching is required (identity verification), minimize what’s stored, secure it, and obtain clear consent. Handled this way, biometrics enhance both security and privacy rather than trading one for the other: the biometric proves the user locally, and only a cryptographic result travels.

Frequently asked questions

Is biometric data stored on servers?

In passkey-based login, the biometric stays on the device and unlocks a local key; it isn’t sent to the service.

Can biometric authentication be spoofed?

Server-side biometric matching can be targeted by spoofs and deepfakes, which is why liveness and presentation-attack detection are essential.

What’s the difference between physical and behavioral biometrics?

Physical traits (fingerprint, face) verify at a point in time; behavioral traits (typing, gestures) are evaluated continuously.

Is biometric data regulated?

Yes: laws like GDPR treat it as sensitive data requiring explicit consent, and some jurisdictions (e.g., Illinois’ BIPA) add specific handling rules.

Can a compromised biometric be reset?

No, unlike a password, you can’t reissue a fingerprint or face, which is why templates should stay on-device and server-side matching must be strongly protected.

Related: Face Authentication · Voice Authentication · Behavioral Biometrics · Passkeys · Liveness Detection · Presentation Attack Detection (PAD)