What Is Biometric Authentication?

Biometric authentication is the process of confirming a claimed identity by comparing a freshly captured physiological or behavioral measurement against a reference stored for that specific person. It is a one-to-one comparison: the subject asserts who they are through a card, an account name, or a device, and the system decides whether the presented sample matches the enrolled template closely enough to accept the claim. This distinguishes it from biometric identification, which searches an entire database to determine who a sample belongs to without any prior claim.

The field sits within biometrics and borrows from pattern recognition, signal processing, sensor design, and information security. Common modalities include fingerprint ridge structure, face geometry, iris texture, finger and palm vein patterns, voice, and behavioral traits such as keystroke dynamics and gait. Each modality trades off distinctiveness, permanence over a lifetime, sensor cost, and how easily a sample can be captured without cooperation from the subject.

Enrollment, Templates, and Comparison

A biometric system runs in two phases. During enrollment, one or more samples are captured, quality-checked, and reduced to a template: a compact feature representation such as fingerprint minutiae coordinates, an iris code derived from Gabor filter responses, or a face embedding produced by a convolutional or transformer network. Authentication then repeats capture and feature extraction and computes a comparison score against the stored template. Because no two captures of the same trait are ever identical, the decision is statistical rather than exact, which is the fundamental difference between a biometric and a password. Interoperability across vendors depends on standardized data interchange formats, so that a template generated by one supplier's sensor remains usable by another's matcher.

Error Rates and Threshold Selection

System behavior is characterized by the false match rate, the proportion of impostor comparisons accepted, and the false non-match rate, the proportion of genuine comparisons rejected. Moving the decision threshold trades one against the other, a relationship plotted as a detection error tradeoff curve and sometimes summarized by the equal error rate. Which point to choose depends on the consequences of each error type, so an unlocking gesture on a phone and a border control gate are tuned very differently. The digital identity guidance in NIST Special Publication 800-63B sets a floor on this tuning, requiring that a biometric used as an authentication factor operate at a false match rate of one in a thousand or better, and treating the biometric as something bound to a physical authenticator rather than as a secret in its own right. Independent measurement matters because vendor-reported figures are gathered under favorable conditions, and programs such as the NIST Face Recognition Vendor Test evaluate submitted algorithms on large common image sets, reporting accuracy separately across demographic groups and image quality conditions.

Presentation Attacks and Template Protection

A biometric trait is not secret. Fingerprints are left on surfaces, faces appear in photographs, and voices can be recorded, so systems must resist artifacts presented at the sensor: gelatin or silicone fingerprint casts, printed or displayed face images, video replays, and synthetic speech. Countermeasures are grouped under presentation attack detection, which looks for liveness evidence such as blood perfusion, subsurface skin scattering, involuntary eye movement, or challenge response. Testing and reporting methodology is standardized in ISO/IEC 30107-3, which defines the error rates used to report detection performance for both attack and genuine presentations. A separate concern is the stored template itself, since a compromised biometric cannot be reissued. Template protection schemes, secure enclave storage, and on-device matching are used to keep raw reference data from leaving the sensor platform.

Applications

Biometric authentication has applications in a range of fields, including:

• Smartphone, laptop, and workstation unlocking and payment confirmation
• Physical access control for buildings, data centers, and secure areas
• Banking and financial transaction authorization, including remote onboarding
• Border control and electronic passport verification at automated gates
• Healthcare record access and patient identification at the point of care
• Time and attendance systems in industrial and logistics operations