# What is Biometric authentication?

> Using a physical characteristic such as a fingerprint or face to unlock a device or approve access.

Last reviewed: 2026-09-01

## Biometric authentication

Category: Authentication

Also called: fingerprint login, Face ID, biometrics

Canonical page: https://moolkey.com/glossary/biometric-authentication

Biometric authentication uses a physical characteristic such as a fingerprint, face, or iris to verify you. On modern devices the biometric template stays in secure hardware and unlocks a locally stored key. It is a convenient replacement for typing a PIN, not a replacement for the PIN itself.

### Biometrics unlock, they do not authenticate remotely

Your fingerprint is not transmitted to any website. It releases a key held in your device's secure element, and that key does the cryptographic work. This is why a device PIN always exists as a fallback: the biometric is a convenient gate in front of it, not a substitute for it.

### The property that makes them different

You cannot change your fingerprint. A leaked password is replaceable; a compromised biometric template is not. This is the argument for keeping biometrics as a local unlock mechanism rather than as a shared credential sent to services.

### Sources

- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [W3C: Web Authentication: Level 3](https://www.w3.org/TR/webauthn-3/): The web standard behind passkeys and FIDO2 security keys.
- [OWASP: Multifactor Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html): A comparison of authentication factors, recovery paths, and common attack routes.