Face ID and fingerprint unlock make it easier to keep your devices locked. That’s promising, especially if typing a long passcode dozens of times a day gets old. But you still need a strong passcode: biometrics approve access locally, and the passcode takes over when they can’t.
The useful distinction is between your biometric and what it authorizes. Your face or fingerprint can unlock a device, approve a purchase, or let a passkey sign you in. A website doesn’t receive your face or fingerprint when you use a passkey.
How Face ID and fingerprint scanning work
Face ID checks the shape of your face
Apple’s Face ID uses the iPhone’s TrueDepth camera to capture depth and infrared information. It turns that information into a mathematical representation, then compares it with the protected representation you enrolled. Apple says the Face ID data is encrypted, stays in the Secure Enclave, and isn’t available to apps or Apple. (Apple’s Face ID privacy information)
That depth check matters. An ordinary photo shouldn’t unlock a properly functioning Face ID system. Face unlock on another device may rely on a regular camera, so don’t assume every face scanner offers the same protection.
Fingerprint readers compare a stored template
Touch ID reads your fingerprint and compares its distinguishing features with a protected mathematical template. The device keeps that template locally; an app gets an approval result, not your fingerprint image.
You’ll find Apple’s reader in the Home button on some iPhones and iPads, the top button on some iPads, and the Touch ID key on compatible Macs. Other devices may put a reader under the display or in a power button. Sensor placement affects convenience: wet fingers, dirt, and a poorly fitted screen protector can interfere with a scan.
Are biometrics secure enough?
For everyday use, a strong passcode paired with Face ID or fingerprint unlock is a solid choice. So far, the trade-off is a good one: you can lock your device consistently without entering that passcode every time.
There are limits. You can change a stolen passcode, but you can’t change your face or fingerprints. A close relative may also be harder for facial recognition to distinguish, and a damaged sensor can leave you relying on the passcode. Never enroll someone else’s biometric unless you want that person to have access.
Keep Require Attention for Face ID on if you can use it. It checks that you’re looking at the iPhone, which helps when you’re asleep or looking away. Turning it off can make Face ID usable for someone who can’t reliably look at the screen, but removes that safeguard. (Apple’s Face ID and attention guide)
A fingerprint reader doesn’t have an equivalent attention check. If someone may physically take your device or press your finger to its sensor, use the temporary passcode requirement described below.
Set up biometric unlock on your devices
You need a device passcode, PIN, or login password before enrolling a face or fingerprint. That credential remains your fallback after a restart, repeated failed scans, and other security events.
Set up Face ID on iPhone
- Open Settings > Face ID & Passcode and enter your passcode.
- Tap Set Up Face ID. Hold the iPhone in front of you and follow the two head-movement scans.
- Tap Done, then choose which actions Face ID can approve under Use Face ID For.
You can manage purchases, password filling, and supported apps in the same screen. If your appearance regularly changes, Set Up an Alternate Appearance is there too. Apple’s instructions cover the enrollment steps and available controls. (Apple’s Face ID setup guide)
Add a fingerprint on iPad or Mac
On a Touch ID-equipped iPad, open Settings > Touch ID & Passcode, enter the passcode, and tap Add a Fingerprint. Rest and lift your finger as prompted, changing its position so the reader captures the edges.
On a compatible Mac, open System Settings > Touch ID & Password > Add Fingerprint. Enter your Mac login password and follow the prompts. The same pane lets you choose whether Touch ID unlocks the Mac, approves purchases, or fills passwords.
Set up biometrics on Android
- Open Settings and search for Fingerprint, Face unlock, or Biometrics. Menu names and placement vary by manufacturer; use your phone maker’s current support page if the search doesn’t find them.
- Enter your screen-lock PIN, pattern, or password.
- Enroll a finger by touching the sensor in different positions, or follow the face-framing prompts.
- Review what the biometric can approve, including device unlock, apps, and payments.
Check the security description before enabling face unlock. A camera-only system may be offered mainly for convenience, while a depth-aware system can provide stronger resistance to a photo. Keep a strong screen lock either way. (Android’s device security guide)
Set up Windows Hello on Windows 11
- Open Settings > Accounts > Sign-in options.
- Choose Facial recognition (Windows Hello) or Fingerprint recognition (Windows Hello), then select Set up.
- Create or enter your Windows Hello PIN and follow the enrollment prompts.
Windows Hello facial recognition needs compatible infrared camera hardware; a standard webcam generally won’t qualify. If an option doesn’t appear, check your computer’s hardware specifications or use fingerprint recognition if it has a compatible reader.
Use biometrics with passkeys
Passkeys are where biometric unlock becomes especially useful. A service stores a public key, while your device or credential manager protects the corresponding private key. Face ID, Touch ID, a fingerprint, or your device screen lock approves use of that private key; the service receives a cryptographic response rather than your biometric. (Google’s passkey guidance)
When a site offers a passkey, choose its passkey sign-in option and approve the prompt on your device. If you’re signing in on another device, the service may show a QR code to scan with the device holding your passkey. This is worth trying on accounts you use often because a passkey is tied to the legitimate service, which makes a copied sign-in page much less useful to an attacker.
A password manager still earns its place for sites without passkeys. For accounts where targeted phishing is a concern, a FIDO2 security key is another good option (and can give you a separate way back in if you lose your phone).
When Face ID or a fingerprint stops working
If your device asks for its passcode after a restart or several failed scans, enter it. That request is expected security behavior. If biometric checks keep failing afterward:
- Clean the camera or fingerprint sensor and clear anything covering it. Check whether a screen protector obstructs an under-display reader.
- Try again with a dry finger or an uncovered face. Face ID settings on supported iPhones include Face ID with a Mask if you regularly wear one.
- Restart the device and install an available system update.
- If failures continue, remove and enroll the face or fingerprint again. On iPhone, Settings > Face ID & Passcode > Reset Face ID erases the existing enrollment.
To require your iPhone passcode temporarily, press and hold the side button and either volume button until the power-off and Emergency SOS screen appears. The next unlock requires your passcode before Face ID works again. (Apple’s personal safety guide)
The setup I’d use
Use a strong device passcode, keep Face ID’s attention check enabled when practical, and turn on biometric unlock for everyday access. Passkeys are a good option when a service offers them; your face or fingerprint stays with your device.
I’d skip biometric unlock for a device you expect someone to access physically against your wishes. For everyone else, it’s a sensible convenience layer, as long as you give the fallback passcode the same attention.