# biometric-authentication

Source: https://startwithidentity.com/glossary/biometric-authentication/
Last updated: 2026-10-17
License: content by Start with Identity. Cite the source URL.

---

Biometric authentication confirms a person by comparing a live measurement of a physical characteristic, such as a fingerprint or face, against a template captured at enrollment. [NIST SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) (section 3.2.3) says biometrics "SHALL only be used as part of multi-factor authentication with a physical authenticator", so a face or fingerprint is never a credential on its own.

The architecture matters more than the sensor. In a local match, the phone or laptop compares the biometric and uses it only to release a key held on the device; FIDO says that with passkeys "biometric information and processing continues to stay on the device and is never sent to any remote server" ([FIDO Alliance](https://fidoalliance.org/passkeys/)). Server-side matching stores templates centrally, which NIST ranks below local verification and which turns a breach into a permanent loss, because a fingerprint cannot be reissued. Where biometrics are used, NIST requires a false match rate of 1 in 10,000 or better across demographic groups, presentation attack detection for facial recognition (recommended for fingerprint and iris, tested per [ISO/IEC 30107-3](https://www.iso.org/standard/79520.html)), no voice matching, and a non-biometric alternative. A local biometric only gates the key: in August 2026 malware already running in a signed-in Windows session [used a Windows Hello for Business key with no biometric prompt](https://startwithidentity.com/blog/2026-08-07-windows-hello-for-business-keys-abused-for-entra-id-persistence/).

See also: [biometric authentication as a regulatory frontier](https://startwithidentity.com/blog/biometric-authentication-regulatory-frontier/), [top biometric authentication tools](https://startwithidentity.com/articles/top-5-biometric-authentication-tools/), [passkey](https://startwithidentity.com/glossary/passkey/), [FIDO2](https://startwithidentity.com/glossary/fido2/), [BIPA](https://startwithidentity.com/regulations/united-states/bipa/), [EU AI Act](https://startwithidentity.com/regulations/european-union/eu-ai-act/)