Unlocking a phone with a finger or a glance feels like magic, and it is also genuinely convenient: no password to type, no pattern to draw, nothing to forget. But it raises a fair question — is it actually safe to hand your phone a copy of your face or fingerprint? The honest answer is: for most people, yes, with a few clear limits you should understand. This guide explains, in plain language, how fingerprint and face unlock work, what they protect you against, where they fall short, and how to set them up so that convenience does not quietly weaken your security. Everything here is defensive: it is about protecting your own device, never about defeating someone else's lock.
How fingerprint unlock actually works
When you register a fingerprint, your phone does not store a photograph of your finger. It scans the pattern of ridges and valleys, converts that pattern into a mathematical template — a string of numbers that describes the pattern but cannot be turned back into a fingerprint image — and stores that template in a locked-off part of the phone's hardware, often called a secure enclave or trusted execution environment. The fingerprint data never leaves the phone, is never uploaded to the manufacturer, and is not included in backups.
Each time you unlock, the sensor takes a fresh scan, converts it to a template, and compares it with the stored template inside that secure hardware. If it matches closely enough, the phone unlocks. The comparison happens inside the protected hardware, not in the normal operating system, which is why even a compromised app cannot simply read your fingerprint data out of the phone.
Modern under-screen sensors and side-mounted sensors are both reliable for everyday use, but they are not identical. Ultrasonic sensors, found on some premium phones, read the three-dimensional shape of the ridges and work better with slightly wet fingers. Optical sensors take a two-dimensional image and can struggle with wet or very dry fingers. Neither is "unsafe" in normal use — the difference is convenience, not a security hole you need to worry about.
How face unlock actually works — and why the type matters
Face unlock comes in two very different kinds, and knowing which one your phone has matters more than any other detail in this guide. The first kind, found on a few premium phones, projects thousands of invisible dots onto your face and builds a three-dimensional depth map. It can tell a real face from a photograph, and it works in the dark. The second kind, found on most mid-range and budget phones, simply uses the front camera to take a two-dimensional picture and compare it with a stored picture. It is convenient, but it is much easier to fool with a photograph, and it struggles in low light.
Check your phone's settings or specifications to find out which kind you have. If the description mentions "3D", "depth", "infrared" or "structured light", you have the stronger kind. If it only says "face recognition" using the front camera, assume it is the weaker kind — and treat it as a convenience feature, not as your main security. That single check decides how much you should rely on face unlock, as the next section explains.
What biometrics protect you against — and what they do not
Biometrics are excellent against the most common real-world threat: a stranger picking up your lost or stolen phone and opening it. A thief cannot guess your fingerprint, and a strong face system cannot be opened with a photo. Compared with a weak four-digit PIN or a simple swipe pattern — both of which a thief can guess, observe or smudge-trace — a fingerprint is a large step up in everyday security.
But biometrics have limits that passwords do not, and honest security advice must name them. First, you cannot change a fingerprint or a face. If a password leaks, you change it; if a biometric template were ever compromised, you cannot grow a new finger. In practice, templates are locked in secure hardware and have not been a realistic leak for ordinary users, but the principle matters. Second, biometrics do not protect you against someone who can physically compel you — a person holding your finger to the sensor, or holding the phone up to your face. A password, by contrast, can be withheld. This is a real consideration for people in genuinely risky situations, such as journalists or activists, and for them a strong password alone may be the wiser choice.
Third, biometrics on their own do not protect your online accounts. Your fingerprint unlocks your phone, but your email, bank and social accounts still need their own strong passwords and two-factor authentication. A fingerprint on the lock screen is not a substitute for two-factor authentication on the accounts inside — the two protections do different jobs, and you need both. Our guides on password security and two-factor authentication explain the account side in detail.
Setting up biometrics safely
If you decide to use biometrics — and for most people, the recommendation is yes — set them up carefully:
- Set a strong backup password first. Your phone will ask for a PIN, password or pattern as a fallback. Make it long and genuinely secret, not your birth year and not a simple pattern. This fallback is what protects you after a restart, after too many failed biometric attempts, and in every situation where biometrics are not available — so it deserves to be strong.
- Register the same finger twice, or two fingers. Registering your main thumb twice, or both thumbs, makes unlocking faster and less frustrating, which means you are less tempted to turn the feature off or weaken the fallback.
- Register your face in normal light, looking straight at the phone. Poor registration is the most common cause of unreliable face unlock. If your phone offers an "eyes open" requirement, keep it switched on — it prevents unlocking while you are asleep, which is a real, if uncommon, risk.
- Check whether your phone locks biometrics after a restart. Almost all phones require the fallback password after a restart, before biometrics work again. That is a security feature, not a bug — it means a stolen phone that has been switched off cannot be opened with a finger alone.
- Keep your phone's software updated. Biometric security depends on the secure hardware and the operating system working together. Software updates patch the vulnerabilities that could, in theory, weaken that protection.
Everyday habits that keep biometrics safe
- Use biometrics plus a screen lock timeout. Set the screen to lock quickly — 30 seconds is a good choice — so a phone left on a table does not stay open for minutes.
- Do not register other people's biometrics casually. Adding a partner's or child's fingerprint for convenience gives them full access to everything on the phone, including messages, photos and payment apps. If you share a phone, use separate user profiles or a guest mode instead.
- Be careful with apps that request biometric login. Banking and password-manager apps that offer fingerprint login are generally safe — they use the same secure hardware. But check which app is asking: a game or a random utility app has no good reason to need your fingerprint, and granting it adds nothing but risk.
- Wipe biometrics before selling or giving away a phone. Factory-reset the phone, which deletes the biometric templates along with everything else, and remove the device from your accounts. Our guide to wiping an old phone safely covers the full checklist.
- Know your lockdown option. Many Android phones let you press and hold the power button and choose "Lockdown", which immediately disables biometrics until the fallback password is entered. Learn where yours is before you need it — it is the fastest way to switch from convenience to maximum security in an uncomfortable situation.
Biometrics or password: which should you choose?
For most people, the best answer is both, in layers: a fingerprint or strong face unlock for everyday convenience, backed by a strong fallback password, with two-factor authentication on the important accounts inside. That combination beats either option alone, because it is strong against the common threat — a stranger with your phone — while remaining usable enough that you will actually keep it switched on. Security that is too annoying gets switched off, and a switched-off lock protects no one.
Choose a password alone instead if you face a specific risk of physical coercion, if your phone only offers the weaker camera-based face unlock and you do not want to use a fingerprint, or if you simply prefer it. There is no shame in that choice — a long, random password is excellent security, and it has the unique advantage that it exists only in your head. What you should not choose is no lock at all, a four-digit PIN like 1234, or a simple pattern. Those are the options that fail in the real world, every day, against ordinary thieves.
Key Takeaways
- Templates, not photos: Your phone stores a mathematical template in secure hardware, not an image of your finger or face, and it never leaves the phone.
- Not all face unlock is equal: 3D depth-based face unlock is strong; camera-only face unlock is a convenience feature and can be fooled by a photo.
- Strong against strangers, weak against coercion: Biometrics stop a thief with your phone, but they cannot be withheld like a password can.
- Strong fallback first: The PIN or password behind your biometrics must itself be strong — it is the real lock underneath.
- Lockdown is your friend: Learn your phone's lockdown option so you can disable biometrics instantly when you need to.
- Accounts need their own protection: Biometrics unlock the phone; strong passwords and two-factor authentication protect the accounts inside it.
- Everything here is defensive and legal — securing your own device, with no attempt to defeat anyone else's lock.