How face unlock actually works

Android publishes a document every handset maker has to satisfy before it can ship with Google’s apps, and buried in it is a grading scheme for biometrics. Three classes. The top one has to keep false acceptances at or below one in fifty thousand and survive an active spoofing test, letting no more than 7% of physical fakes through. The middle class gets a 20% allowance on that spoof test. The bottom class has no meaningful ceiling on it at all.

Only the top class is permitted to release a key from the hardware keystore.

That single rule tells you almost everything. Two of the three face unlocks on the market are, by the platform’s own assessment, decorations. They open a lock screen and stop. No payment approval, no stored credential. The operating system knows which one your phone has, and never puts it on the screen in words a buyer would understand.

Two technologies, one icon

The cheap implementation photographs you. Front camera, an image, a model that reduces the face in it to numbers, a comparison against the numbers it made when you enrolled.

Everything it will ever receive is a flat grid of pixels. So anything producing a close enough grid gets through, which is why a printed photograph has been sufficient against some of these. Nobody neglected to patch that. A sensor measuring brightness and colour cannot know whether the object in front of it has any thickness.

The expensive implementation does not photograph you at all. It projects onto you.

An emitter throws a pattern of infrared dots across your face, roughly thirty thousand of them on the best documented version. A second camera, mounted a fixed distance away, records where each dot landed. The geometry is fixed, so the displacement of each dot is arithmetic: a dot on the tip of your nose lands somewhere slightly different from a dot on your cheek, and the difference resolves to a distance. Run that across the whole pattern and the output is a depth map. A grid of distances, not brightnesses.

A different family of sensors reaches the same output by timing how long a pulse of infrared light takes to come back, per pixel. Either way, the thing being compared is a shape.

Why the dark stops mattering

There is a second infrared emitter that floods the face evenly, giving the system a clean infrared frame alongside its depth map.

Infrared is not visible light. A dark bedroom at 2am is not dark to it.

So the thing people find slightly magical, that it works with the lights off, is just the device bringing its own illumination in a band your eyes cannot see. It also stops caring about most of what varies on the surface of a face. Beard, makeup, the colour temperature of a lamp. None of that moves a cheekbone.

And against a depth sensor, a photograph does not fail because it looks wrong. It fails because it is flat. Every dot in the pattern returns from the same plane, and the depth map reports an object with no nose. A screen is worse than paper, because it emits almost nothing in the infrared band the sensor watches. Layered on top is a model trained to recognise physical fakes, which the vendors built by attacking their own hardware first.

The published error rate for the depth-sensing version puts the odds of a random stranger opening your phone at about one in a million, against one in fifty thousand for the fingerprint reader it replaced. The same documentation states plainly that the figure does not hold for identical twins, or for children under thirteen whose features have not settled.

There is also a setting most people have never opened, on by default, requiring that your eyes be open and pointed at the screen before the unlock proceeds. Turn it off and the phone opens while you are asleep. Almost nobody knows which side of that hinge they sit on.

Nobody stores your face

Here is where the popular anxiety and the actual mechanism part company.

Enrolment does not save a picture. It produces a vector of numbers describing relationships in the geometry, from a model trained so that the same face lands in the same neighbourhood and different faces land far apart. No routine expands it back into an image and no API hands it to an app.

It is also not held anywhere the operating system can read.

Modern phones carry a second processor on the same die that runs its own software, boots from its own read-only code, and owns memory the main processor cannot address. Apple calls theirs the Secure Enclave; Android’s equivalent lives in a trusted execution environment, and on some boards a physically separate chip. It is the same component underneath device attestation and passkeys, both of which I have taken apart on their own.

The representation goes in there and stays. It is not backed up, it does not sync, and moving to a new handset means enrolling again from scratch. The camera talks to that processor over a channel the rest of the system cannot listen in on, using keys negotiated when the two parts were paired in the factory. That pairing is why replacing a camera module can kill face unlock on a phone that is otherwise healthy.

The comparison runs inside. Raw frames never surface. What comes back out is one bit.

That bit does more than reveal a home screen. It releases a key: the private half of a stored credential, created with a condition attached saying it may only be used after a successful biometric check. Your face never travels to the site you are logging into. It unlocks something local, and the local thing does the proving.

Which produces an operational detail that has cost me time. On Android a key can be generated with a flag that permanently destroys it the moment biometric enrolment changes. Add a fingerprint, or wipe a device and enrol a new face, and every key bound to the old enrolment is gone. Not locked. Gone. I run a rack of Android handsets that get wiped between renters, so I meet this constantly. For an ordinary person it shows up as a banking app demanding a full login the day after they added a second fingerprint, with no explanation offered.

The word is doing two jobs

Worth drawing a line here, because “biometric” covers two things that have almost nothing in common.

What I have described is a physical measurement of your body, taken once, at a gate you deliberately walked through.

The other family measures how you behave. The rhythm of your typing, the arc your finger draws across glass, the angle you hold a handset at. That one runs continuously in the background with no prompt, and you never agreed to it in any way you would recognise as agreement. One is a door. The other is a camera in the corridor.

The credential you cannot rotate

So if the face is not on a server, where is the real problem.

Every credential system ever built assumes that a leaked credential gets replaced. Passwords rotate. Cards get reissued. Your face does neither.

For a phone holding the representation in silicon that never emits it, exposure is close to zero, and the people worried about that specific case are aiming at the wrong target. But a phone is not the only thing that has asked you for your face. The office door. The airport gate. The time clock at a warehouse job. Those systems mostly have no secure enclave. They have a database, on a server, operated by a vendor you never chose and cannot name.

In 2019 researchers found an access control platform with its database sitting open on the internet: millions of records, including fingerprint data, facial recognition data, and administrator passwords in plain text. Four years before that, the US government office that runs background checks lost 5.6 million fingerprints. The passwords in the first case were rotated inside a week. There is no mechanism by which the fingerprints could be.

One adjacent claim gets overstated in both directions. A stored template is not a photograph and nobody decompresses it into one. But there is a serious research literature on running a template backwards to synthesise a face that scores well enough against the stored numbers to be accepted, with no need for the original image at all. Results vary heavily by system and by how many attempts an attacker gets. Treating a template as harmless because it is not a picture is optimistic. Treating it as equivalent to a picture overshoots the other way.

The part with lawyers in it

American law distinguishes between compelling the contents of your mind and compelling something physical. The old illustration is a strongbox: a court can make you produce the key, while the combination is in your head and that is a different question.

A passcode is a combination. Your face is a key.

The courts have not resolved it. A federal decision in California found that forcing a biometric unlock did engage the protection against self-incrimination. In 2024 a federal appeals court went the other way, holding that physically pressing a man’s thumb to his own phone was not testimonial. Two credentials on one handset, guarding identical data, sitting in different legal positions, and which one protects you at any moment depends on which one you last used. Both major platforms ship a documented way to force the device back to its passcode without a reboot, and it exists because the vendors know the distinction is there.

For years I told people the depth-sensing version was overkill on a consumer phone, a threat model built for a targeted adversary sold to people whose actual risk is leaving the handset in a taxi. I was measuring the wrong axis. The value sits elsewhere. Depth sensing is good enough to be trusted with a key, and a lock screen that can release a key is an authentication system. A lock screen that cannot is a convenience feature. Payments, passkeys and every serious login hang off that distinction.

More on the machinery running underneath the ordinary internet at The Hidden Internet.

Get new guides and videos first — join the Telegram channel.