What biometrics are
A biometric is a measurable feature of your body or behavior that can be used to recognize you. Common examples are fingerprints, the shape and pattern of the face, and the pattern of the iris, the coloured ring around the pupil. Others include voice, the veins in a palm and, in some systems, the way a person types or walks.
Passwords rely on something you know and keys on something you have. Biometrics rely on something you are. That makes them convenient, because you cannot forget your finger, but also unusual from a security point of view, because you cannot change them if they are compromised.
Authentication versus identification
These two terms are often confused.
- Authentication (verification) is a one-to-one check. You claim to be the phone’s owner, and the system compares your finger or face against the single stored record for that owner.
- Identification is a one-to-many search. The system compares a sample against a whole collection to find who it might be.
One-to-one checks are generally easier and more reliable than one-to-many searches, because the more records you compare against, the more chances there are for a coincidental similarity. The social questions around identification in public are covered in the article on facial recognition ethics.
How the matching works
Whatever the body feature, the steps are broadly similar.
- Enrolment. A sensor captures a sample, such as an image of a fingertip. Software identifies distinguishing features. For fingerprints, these include the points where ridges end or split. For faces and irises, these are patterns in the image.
- Template creation. The features are converted into a compact mathematical description, called a template. Well-designed systems store this template rather than a raw picture, and often keep it in a protected area of the device.
- Matching. At login, a new sample is captured and converted in the same way, and the system calculates how similar it is to the stored template.
- Decision. If the similarity passes a threshold, the system accepts you.
No two captures are ever identical. Finger pressure, moisture, lighting, angle and ageing all change the sample, so matching is always about closeness, not exact equality.
Fingerprints
Sensors read the pattern of ridges and valleys on the fingertip, using optical, capacitive or ultrasonic methods. Software looks for characteristic points and their arrangement. Dry, wet, worn or damaged skin can make readings harder.
Faces
Face systems have moved from measuring distances between features to using machine learning, where a model trained on many images turns a face into a set of numbers that are close together for the same person and farther apart for different people. Some phone systems add depth sensing to make it harder to fool with a flat photo. Concepts like neural networks and machine learning sit behind this.
Irises
Iris patterns are detailed and are generally regarded as stable over time. Systems typically use near-infrared light and a close-range camera. They are less common on consumer devices than fingerprints and faces.
How accuracy works
Because matching depends on a threshold, there are two ways to be wrong:
- False match (false accept). The system accepts someone who is not the enrolled person.
- False rejection. The system rejects the genuine person.
These pull against each other. A strict threshold reduces false matches but rejects genuine users more often, which is annoying. A loose threshold is smoother but admits more impostors. Designers choose a balance suited to the setting: a phone may accept an occasional retry, whereas a high-security door may accept more inconvenience to keep false matches very rare.
Be careful with quoted figures. Published error rates depend heavily on the test conditions, the sensor and the population tested, so a single number rarely tells the whole story. A claim that a system is “one in a million” refers to specific conditions and should not be read as a promise.
Some systems also perform unevenly across different groups or conditions, an issue linked to the training data behind them and discussed under algorithmic bias.
Spoofing and defenses
Attackers may try to fool a sensor with a photograph, a mask, a recording or a fake fingerprint. Systems respond with liveness detection, which checks for signs that the sample comes from a living person, such as depth, texture, eye movement or heat. These defenses make casual attempts harder but are not infallible, and quality varies widely between products.
The privacy risks of storing biometrics
Biometric data is sensitive because it is permanent and personal. Key risks include:
- It cannot be reset. If a password leaks, you change it. If a stored fingerprint or face template leaks in a data breach, you cannot grow a new finger.
- Central databases are attractive targets. Storing templates on a company’s server concentrates risk. Many modern phones instead keep templates on the device in protected hardware, so they do not leave it. This is generally considered the safer design.
- Function creep. Data collected for one reason might later be used for another.
- Being compelled. In some situations, a person may be physically or legally pressured to unlock a device with their body, which is harder to do with a memorized passcode. Laws vary by country.
- Tracking. Where face or other biometric systems operate in public or across services, they can link activity to an individual.
Practical guidance
For everyday use, biometrics on a phone are usually a reasonable convenience, especially compared with a weak or reused password, and they encourage people to lock their devices at all. They work best as one layer. A strong passcode remains the fallback, and for important accounts, two-factor authentication or a passkey login offers stronger protection. If you are asked to give biometric data to a service, check whether it is stored on your device or on a server, how long it is kept, and whether you can delete it.
Biometrics are best understood as probability, not certainty. They answer “how likely is this the same person?”, and good design acknowledges that the answer can be wrong in either direction.