Are Biometrics Better Than Passwords? What NIST Says

desk-laptop-notebook-table

Biometrics beat passwords in some ways and lose in others. You can't forget a fingerprint, reuse it across sites or type it into a phishing page, so logins get faster and harder to steal. But you can't change a face if its data leaks, which is why NIST says a biometric should never be used alone, only alongside a physical device.

This guide is for IT, security and HR leaders deciding how far to move their workforce away from passwords.

Key takeaways

  • Biometrics fix common password problems: reuse, weak choices and forgotten credentials.
  • NIST SP 800-63B says a biometric "is not recognized as an authenticator by itself."
  • The strongest pattern is a biometric that activates a key stored on a device, as with passkeys and security keys.
  • Workplace biometrics bring notice, consent and retention duties under some state laws.
  • Always offer a non-biometric alternative.

Why do passwords keep failing?

Passwords depend on people choosing, remembering and guarding secrets. In practice, people reuse them, pick predictable ones and type them into convincing fake login pages. Even a strong password can be stolen in a breach at some other service.

NIST's current guidance has changed the rules. SP 800-63B now requires passwords used as a single factor to be at least 15 characters, bans composition rules such as forced symbols, bans periodic forced changes unless there's evidence of compromise, and requires checking new passwords against a blocklist of common or compromised values. Those changes help, but they don't stop phishing. A user who types a long, unique password into a fake page still hands it over, and one-time codes sent by text can be relayed in real time. That gap is why security teams are moving to methods that never reveal a reusable secret.

Where are biometrics stronger?

  • Nothing to remember. Users can't forget a fingerprint or write it on a sticky note.
  • No reuse across sites. In modern designs, the biometric match happens on the device and is never sent to the website.
  • Phishing resistance when paired with device keys. When a biometric activates a cryptographic key, as in FIDO2 and WebAuthn, there's no secret for a fake site to capture. CISA calls phishing-resistant MFA "the standard all industry leaders should strive for" and names FIDO/WebAuthn as the widely available form of it.
  • Accountability on shared devices. On shared time clocks or kiosks, a biometric makes it harder for one person to act for another. Our guide to facial recognition time clocks covers that use case, and our piece on shared tablets for HR self-service looks at access control on shared hardware.

Where are biometrics weaker?

  • You can't reset them. A leaked password can be changed. A leaked fingerprint template can't.
  • Matching is probabilistic. A match produces a score, so there will be false matches and false rejections. NIST requires a false match rate of one in 10,000 or better for all demographic groups.
  • Spoofing. Photos, masks or fake fingerprints can fool weak sensors. NIST requires presentation attack detection (PAD) for facial recognition and recommends it for fingerprint and iris.
  • Privacy and legal exposure. Collecting biometric data creates obligations. Read the BIPA ruling HR leaders need to know before deploying biometrics to employees in Illinois or states with similar laws.

What does NIST SP 800-63B say about biometrics?

NIST SP 800-63B, part of the 800-63-4 guidelines, sets clear limits:

  • A biometric is not an authenticator on its own. It may only be used as part of multifactor authentication with a physical authenticator, such as a phone or security key.
  • A non-biometric option "SHALL always be provided."
  • Failed attempts are capped: five consecutive failed biometric attempts, or ten with PAD, and a hard overall limit of 50, or 100 with PAD, after which the user has to sign in another way.

Here's how common methods compare:

MethodPhishing resistant?Can be reset?Fits NIST?
Password onlyNoYesAs single factor, if 15+ characters and screened
Password plus SMS codeNoYesMultifactor, but weaker
Biometric only (central match)VariesNoNo
Biometric activating a device key (passkey, security key)YesKey can be revoked and reissuedYes, as multifactor

The pattern to notice: the biometric is never the thing being verified by the server. It just proves to the device that the right person is holding it. That's why a leaked template does far less damage in a passkey design than in a system that stores everyone's face in one database.

How should organizations roll out biometrics? A checklist

  1. Prefer device-bound passkeys or security keys, activated by biometric or PIN.
  2. Keep biometric templates on the device where possible, not in a central database.
  3. Require liveness or presentation attack detection for face matching.
  4. Offer a non-biometric alternative for every user, including those who decline or can't enroll.
  5. Give written notice, get consent where state law requires it and publish a retention and deletion schedule.
  6. Get HR, legal and IT in the same room before launch, as described in our article on HR's role in cybersecurity.

A common mistake is starting with the broadest population. Teams often get better results by piloting passkeys with administrators and email first, where phishing risk is highest, then expanding once support processes are proven. Large public-sector rollouts raise their own issues; see our guide to implementing a government biometric project.

When does this not apply? If your users share devices with no personal key storage, or work where gloves and masks are routine, biometrics may cause more friction than they remove. A hardware security key with a PIN can be the better choice there. If you are evaluating dedicated fingerprint hardware, our overview of the DigitalPersona 4500 HD fingerprint scanner walks through one example.

Frequently asked questions

Are biometrics more secure than passwords?

Used correctly, yes. A biometric that activates a key stored on your device resists phishing and password reuse. Used alone, especially with templates stored centrally, biometrics carry real risk because they can't be changed if leaked. NIST guidance requires biometrics to be paired with a physical authenticator rather than used as the only factor.

Can a stolen fingerprint be used to log in?

It's harder than using a stolen password, but not impossible, especially against weak sensors. That's why NIST requires presentation attack detection for face recognition, recommends it for fingerprints and requires biometrics to be combined with a physical device. An attacker would need both your device and a convincing spoof.

Should employers require biometrics for employees?

Employers should offer biometrics as an option rather than the only method, provide a non-biometric alternative and follow state privacy laws on notice, consent, retention and deletion. Some states have specific biometric privacy statutes with strict requirements and private lawsuits, so involve legal counsel before rollout rather than after.

What to do next

  • Inventory your login methods and list accounts still protected by a password alone.
  • Pilot passkeys or security keys for administrators and email first.
  • Align password rules with NIST SP 800-63B: length over complexity, no forced rotation, blocklist screening.
  • Publish a biometric privacy notice and retention policy before expanding biometrics to the wider workforce.

Sources

Last reviewed: October 2026.

Comments

Post a Comment

Popular Posts

Why Workday Onboarding Breaks Down for Frontline Employees

Image
Workday onboarding breaks down for frontline employees because its default setup assumes every new hire has an email address, a personal device, time at a desk and comfort with a web portal. Warehouse, retail, food service and healthcare aide roles often have none of those. The fix is mostly configuration and process, not a new system. This guide is for HR, HRIS and operations leaders who run Workday and keep seeing incomplete onboarding records, late I-9s and new hires who quit before their first paycheck. Key takeaways Default Workday onboarding is built around desk workers. Frontline failures are predictable and mostly fixable through configuration. The five usual breakpoints are email-based logins, no reliable device, digital comfort, shift timing and language. Split compliance-critical tasks (I-9, tax forms, direct deposit) from tasks that can wait, and handle I-9 in person. Kiosks, ID-based logins, text reminders and a supervisor checklist close most of the gap. Measure...
Read more

How to Improve the Customer Experience (CX)

To improve customer experience, find the moments where customers struggle most, fix those first, and make good service consistent across every channel. Then close the loop on feedback, give front-line staff the time and tools to solve problems, and track a small set of metrics someone actually owns. This guide is for leaders and managers who own some part of the customer relationship, whether that's support, sales, operations or the product itself. Customer experience is the sum of every interaction someone has with your company, from the first ad they see to how a return is handled years later. Teams that struggle usually confuse a good satisfaction score with real improvement, or fix the wrong things. Key takeaways Look at behavior (drop-offs, ticket spikes, failed searches), not just surveys. Fix the biggest sources of friction before polishing what already works. Collecting feedback and doing nothing with it makes customers more frustrated. Consistency across people an...
Read more

Interview Tips for Beginners: A Step-by-Step Prep Plan

The best interview tips for beginners come down to preparation you can repeat: study the job description, research the employer, prepare four to six short stories that prove your skills, practice answering out loud, prepare your own questions and follow up within a day. Confidence comes from rehearsal, not from experience you don't have yet. This plan is for students, recent graduates and career changers facing their first few interviews, and for anyone who freezes when asked "tell me about yourself." Key takeaways Match your preparation to the job description, line by line. Use the STAR format (situation, task, action, result) for behavioral questions. School, volunteer and part-time examples count when you have little work history. Practice aloud at least twice; silent rehearsal isn't enough. Prepare two or three thoughtful questions for the interviewer. What does a one-week interview prep plan look like? If you have an interview scheduled, this plan sp...
Read more

How Do I Log In and Sign In to Workday HCM

To log in to Workday HCM, open your organization's own Workday URL (there's no single public login page), then sign in either with your Workday username and password or through your company's single sign-on. If you're locked out, use "Forgot password" for native logins, or your corporate password reset for SSO, and contact HR or IT if neither works. This guide is for employees and managers signing in for the first time, people who've just switched employers, and anyone stuck at the login screen. Most Workday access problems come down to the wrong URL, the wrong login method, or an account that needs an admin to reset it. Key takeaways Each employer has its own Workday tenant and URL. Get it from HR, IT or your onboarding email; don't guess. If your company uses SSO, your Workday password is your normal work password, and resets happen through your company, not Workday. The mobile app asks for your organization's details first, then signs yo...
Read more

Dollar General Store Walkout: Lessons for Retail HR

In March 2024, every employee at a Dollar General store in Mineral Point, Wisconsin, quit at once and taped "We quit" signs to the doors. They cited a lack of appreciation, being overworked and being underpaid, plus a dispute over a rule about which unsold items could be donated. The store reopened about three hours later. The story went viral because it was so visible, but the lesson is quieter. For HR and operations leaders who run hourly, small-team locations, this is a case study in how a minor policy can become the last straw. Key takeaways A policy change triggered the walkout, but the notes employees left pointed first to workload, pay and recognition. Rules that clash with frontline values, such as throwing away usable goods, become flashpoints when trust is already low. Explaining why a rule exists, and giving local teams a way to push back, costs far less than losing a whole store team. Treat a mass resignation as a lagging indicator. The warning signs show ...
Read more

Boss Retaliation and False Accusations: Protect Yourself

To protect yourself from boss retaliation and false accusations, keep a dated written record, answer accusations with facts rather than anger, use your employer's complaint channels, and learn which laws cover you. Retaliation for protected activity, like reporting discrimination or a safety hazard, is illegal under federal law, and agency filing deadlines can be very short. This guide is for employees who sense that something changed after they spoke up, and for anyone suddenly facing an accusation they know is untrue. Key takeaways Retaliation is illegal when it follows protected activity, such as reporting discrimination or safety concerns. A dated, factual record is your strongest protection. Respond to false accusations in writing, with evidence, and without counterattacking. Use internal channels first when it's safe, but know the external deadlines. An employment attorney can advise on your specific situation. This article is general information, not legal ad...
Read more

The End of Remote Work: Why Companies Want You Back

Companies are calling employees back to the office because leaders believe in-person work improves collaboration, culture, mentoring and management, and because empty buildings are expensive. Amazon and JPMorgan Chase have moved to five-day mandates, and many others now require several fixed office days. Remote work has not ended, but the default has shifted. This article is for HR leaders and managers who have to design, explain or live with a return-to-office (RTO) policy, and for employees trying to understand what is driving it. Key takeaways RTO mandates are driven by collaboration, culture, management visibility and real estate costs. Work from home has settled at a stable level in the U.S. rather than disappearing. A large randomized trial found hybrid work cut quit rates by a third with no measurable hit to performance or promotions. Strict mandates without clear reasons tend to push out the people with the most options. The most durable policies tie office d...
Read more

Apple Watch Health Features: Blood Pressure and Glucose

Image
Apple Watch can now alert you to possible high blood pressure, flag signs of sleep apnea and check for irregular heart rhythms, but it still can't give you a blood pressure reading like a cuff, and it can't measure blood sugar at all. The blood pressure feature is a pattern-based notification, not a measurement, and non-invasive glucose sensing remains out of reach for every consumer wearable. This guide is for buyers deciding whether to upgrade, and for HR and IT leaders fielding questions about wearables in wellness programs. Key takeaways Apple announced hypertension notifications in September 2025 for Apple Watch Series 9 and later and Ultra 2 and later, running watchOS 26. They flag possible chronic high blood pressure; they don't show readings. Sleep apnea notifications use the accelerometer to track breathing disturbances over 30-day periods. No smartwatch or smart ring is FDA-authorized to measure blood glucose without piercing the skin, and the FDA ha...
Read more

ERP Solution Guide: How to Choose the Best ERP for You

The best ERP for your business is the one that fixes your top operational problems, fits your IT capacity and budget over five years, and comes with an implementation partner you trust. Start with a written requirements list, shortlist three or four systems that match it, and judge them on real references, not demos. This guide is for owners, finance leaders and operations managers who are buying their first ERP or replacing one that no longer fits. A common mistake we see: a team falls for a polished demo, signs, and only later discovers the system doesn't handle the one workflow that was causing all the pain. Key takeaways Write down your requirements and top five pain points before you talk to any vendor. Cloud ERP suits most small and mid-size firms; on-premise and hybrid make sense for specific control or compliance needs. Judge vendors on references from companies like yours and on who will actually implement the system. Compare total cost of ownership over five year...
Read more

Local Marketing: 12 Tips to Win Customers Near You

Local marketing works when people nearby can find you, trust you and pick you over the shop down the street. Start with a complete Google Business Profile, a steady flow of honest reviews and consistent listings, then add local content, community presence and tightly targeted ads. Measure calls, direction requests and repeat visits, not likes. This guide is for owners and marketers of storefronts, service-area businesses and multi-location brands who want a practical order of work rather than a list of trends. Key takeaways Your Google Business Profile is usually the highest-return free asset. Google ranks local results on relevance, distance and prominence. Ask for reviews every week and reply to all of them, but never pay for positive ones. The FTC now bans incentives tied to a review's sentiment. Consistent name, address and phone details across directories prevent confusion for people and search engines. Geotargeted ads and email work best with a narrow area and clear t...
Read more