How do you choose biometric authentication software for a business in 2026?

Biometric authentication proves a person is who they say they are by checking a body feature or behaviour, such as a fingerprint, face, iris, voice or typing rhythm, against a stored mathematical template. For business software, the safest design keeps the match on the user’s own device and uses FIDO2 passkeys, so no biometric ever sits on your servers.

What this guide covers, and what it leaves out

The words “biometrics” and “biometric” get searched for many reasons. Some people want the biology of body measurements. Others want forensics, border control or immigration appointments, or just a phone fingerprint reader. This page is not for those readers.

It covers one slice: a business buying software that uses biometrics to let employees or customers sign in, or to confirm that a new customer is a real person. We explain how the technology works, which standards matter, what the law demands, and which platforms to look at. Where a vendor lists a price on its own page, we show it with the date we read it. Where it does not, we say so.

What is biometric authentication in plain words?

Authentication is how software decides that the person at the screen is allowed in. There are three classic ways to prove it: something you know (a password), something you have (a phone or a security key) and something you are (a body trait). Biometric authentication is the third kind.

The process has two stages. First comes enrolment: the user scans a finger or face, and the software turns the scan into a template. A template is a string of numbers that describes the features of the scan. It is not a photo. Second comes matching: each time the user signs in, the software takes a new scan, builds a fresh template and compares the two. The comparison produces a similarity score. If the score clears a set threshold, the user is in.

Two error rates define how good a system is. The false match rate (FMR) is how often a stranger is wrongly accepted. The false non-match rate (FNMR) is how often the real user is wrongly rejected. The two pull against each other. Tighten the threshold and strangers get through less often, but real users get locked out more often. NIST, the US standards agency, notes in SP 800-63B-4 that a good system keeps both very low and that the threshold usually leans toward a low FMR for security.

One rule in that same document matters for buyers. NIST states that a biometric characteristic is not recognised as an authenticator by itself. It has to unlock something else, such as a phone or a security key that holds a cryptographic secret. Hold on to that idea. The whole modern design, covered below under passkeys, rests on it.

Which biometric modalities exist, and where does each fit?

A modality is the type of body trait being measured. Each one fails in its own way, so the right pick depends on where your users sit and what they do all day.

Modality	Best fit	How it fails
Fingerprint	Laptops, phones, security keys, shared-office doors	Wet, dry or worn fingertips; cuts; manual workers and older users with faint ridges; lifted prints and fake fingers
Face	Phone and laptop unlock, remote onboarding with a selfie	Poor light, masks, glasses, big appearance changes, printed photos, screen replays, deepfakes
Iris	High-security sites, border and secure-facility access	Needs close, well-lit capture; specialist cameras; high-resolution photo attacks
Voice	Phone-based call centre checks	Colds, noise, poor phone lines, and cloned or synthetic speech
Behavioural	Quiet background checks during a session	Changes with injury, a new keyboard, stress or a different device; weak as a sole check

How does fingerprint matching hold up for business use?

Fingerprint is the most familiar modality and the cheapest to deploy, because most laptops and phones ship with a reader. The weak spots are physical. A fingertip that is wet, dry, scarred or worn flat by years of manual work reads poorly, and the user gets rejected even though they are genuine. Plan a fallback for them. The NIST fingerprint recognition programme tests algorithms independently, which helps when you weigh vendor claims.

Is face recognition safe enough for sign-in?

Face is the modality customers meet most, both on their phones and in “take a selfie to verify” flows. It also faces the broadest range of attacks: a printed photo, a video replayed on a screen, a 3D mask, or an AI-made fake injected straight into the camera feed. This is why NIST goes further for face than for any other modality. In SP 800-63B-4 it says a facial recognition system shall implement presentation attack detection, while for fingerprint and iris it only says it should. We explain that term in the liveness section below.

Where do iris, voice and behavioural checks belong?

Iris recognition is very accurate but needs specialist cameras, so it suits secure facilities more than office software. Voice is the modality to be most careful with. NIST’s guidance states that biometric comparison based on voice shall not be used. Cloned and synthetic speech has made voiceprints unreliable as a lock,. Behavioural biometrics, such as typing rhythm or how someone moves a mouse, work quietly in the background and can raise a flag when a session looks wrong. They are a signal, not a gate, because a sprained wrist or a new keyboard changes the pattern.

Which standards matter now: FIDO2, WebAuthn and passkeys?

Three names come up in nearly every vendor pitch. They fit together, and each does a different job.

• WebAuthn is the browser standard from the W3C. It lets a website ask a device to create and use a public and private key pair for a user. The site keeps the public key. The private key never leaves the device. The W3C Web Authentication Level 3 specification is listed as a W3C Recommendation dated 25 August 2026.
• CTAP is the Client to Authenticator Protocol from the FIDO Alliance. It lets a phone or a hardware security key talk to the browser or laptop.
• FIDO2 is the name for WebAuthn and CTAP working together. The FIDO Alliance page on FIDO2 describes the pair.
• Passkeys are the user-facing name for FIDO credentials that can be saved and synced across a person’s devices. The FIDO Alliance passkeys page explains the idea and lists adopters.

When a user signs in with a passkey, the fingerprint or face scan only unlocks the private key on their own device. The scan is never sent anywhere. Your server receives a signed proof, nothing more. That means a breach of your database cannot leak fingerprints, because you never held any.

For a buyer, the practical question is simple. Does the platform support passkeys and FIDO2 security keys for sign-in, and can it enforce them by policy? If the answer is yes, you get strong biometric sign-in without taking on biometric storage. If the platform instead asks you to collect and hold face or fingerprint images, you take on the legal exposure described in the compliance section.

Where is the biometric matched: on the device or on a server?

This choice drives your risk more than any other. There are two designs.

Design	Where the template lives	What it means for you
On-device matching	Inside the phone or laptop’s secure hardware	You never see or store the biometric. Used by Windows Hello, Touch ID, Face ID and passkeys
Server-side matching	In the vendor’s or your own database	You or your vendor hold regulated data. Needed for remote identity checks, where a selfie is compared to an ID photo

Workforce sign-in almost always fits the first design. Each employee’s laptop or phone does the match, and your identity platform only receives the yes. Customer onboarding often needs the second, because a new customer has no device you trust yet. You must confirm that a live person matches the face on a passport or driving licence. That job belongs to identity verification software, and that is where the strictest laws apply.

Ask any vendor three direct questions. Does the biometric leave the device? If a template is stored, where, for how long and under whose control? Can the user delete it, and does deletion reach backups?

What are liveness detection and presentation attacks?

A presentation attack is when someone shows a fake trait to a sensor: a photo, a silicone fingertip, a mask, or a video on a screen. Presentation attack detection (PAD) is the set of checks that tells a live person from a fake. Vendors often call it liveness detection.

The international test standard here is ISO/IEC 30107. Part 3 of it defines how to test and report PAD performance, and it gives the metrics labs use, including the share of attacks that wrongly get through. ISO blocks automated fetching of its catalogue pages, so we cannot link a page we were able to read. Ask any vendor for a test report against ISO/IEC 30107-3 from an accredited lab, and treat a claim without a named lab as unproven.

NIST ties its guidance to the same family of tests. In SP 800-63B-4 it says a deployed system should show an impostor attack presentation accept rate (IAPAR) below 0.07 in testing, and it says the false non-match rate should be under 5 percent. It also requires a fixed threshold, so a vendor cannot quietly loosen it for one group of users.

There are two kinds of liveness check. Passive checks analyse a single selfie or short video for signs of a screen, a print or a mask, and ask nothing of the user. Active checks ask the person to blink, turn their head or follow a light. Active checks add friction but can stop some replay attacks. A newer threat is the injection attack, where a fake video is fed to the app as if it came from the camera. Ask vendors how they detect injected streams.

What does the law say about biometric data?

This is the section most buying guides skip, and it is where the real money sits. Biometric data is not like an email address. You cannot change a fingerprint after a leak. Lawmakers treat it as especially sensitive, and several rules allow large penalties.

What is the Illinois Biometric Information Privacy Act (BIPA)?

BIPA is Illinois law 740 ILCS 14. It governs how private companies collect, store and share biometric identifiers, such as fingerprints, face geometry and iris scans. It requires a written policy on retention, and informed written consent before collection. The Illinois General Assembly publishes the statute, though its site blocked our automated fetch, so we link the court ruling that quotes the key provisions instead.

What makes BIPA dangerous for employers and vendors is Section 20, which gives individuals a private right of action. A person can sue directly. Per the Illinois Supreme Court’s opinion in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, a prevailing party may recover liquidated damages of $1,000 for a negligent violation, or $5,000 for an intentional or reckless one, plus attorneys’ fees. The same ruling held that a person does not need to show extra harm beyond the violation itself. That is why BIPA suits over time-clock fingerprint scanners became common. Illinois amended the law in 2024 with Senate Bill 2979, so that collecting the same person’s biometric data more than once counts as a single violation rather than one violation per scan, as Greenberg Traurig’s summary of the amendment sets out (read 11 November 2026). Collection and disclosure are still counted separately, so one person can give rise to two violations. The $1,000 and $5,000 amounts did not change. Whether the amendment reaches cases already filed is unsettled, so check the current statute with counsel.

What does Texas require under its biometric law?

Texas covers biometric identifiers in Texas Business and Commerce Code section 503.001, often called CUBI. It defines a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry. A company must inform the person and get their consent before capturing it for a commercial purpose. It must protect the data with at least the care it gives other confidential information, and destroy it within a reasonable time, and no later than the first anniversary of the date the purpose for collecting it ends. For employers, that purpose is presumed to end when employment ends. The penalty is up to $25,000 per violation, and only the state attorney general can sue. There is no private right of action, which makes Texas different from Illinois.

What does Washington require?

Washington’s rule is RCW 19.375.020. A person may not enrol a biometric identifier in a database for a commercial purpose without first giving notice, obtaining consent, or providing a way to prevent later commercial use. The statute says the exact notice and type of consent depend on context. It also limits selling or disclosing an enrolled identifier without consent, with listed exceptions such as completing a financial transaction the person asked for.

How does GDPR treat biometric data?

In the European Union and the UK, biometric data for identifying a person is special-category data. Article 4 of the GDPR defines biometric data as personal data from specific technical processing of physical, physiological or behavioural characteristics, which allows or confirms the unique identification of a person, such as facial images or fingerprint data. Article 9 then prohibits processing biometric data to uniquely identify a person unless a listed exception applies. The one most often relied on is explicit consent under Article 9(2)(a). Consent must be a real choice. If a worker is told to scan a finger or lose access, regulators tend to doubt the consent is freely given, so offer a non-biometric option such as a PIN or a security key.

What should consent actually look like?

Across these laws, a defensible process has the same shape:

1. Tell people before capture what you collect, why, who receives it and how long you keep it.
2. Get a clear, recorded yes, in writing or an equivalent form, for each purpose. Do not bundle it into general terms.
3. Publish a retention schedule and delete on schedule. Texas sets one year after the purpose ends as an outer limit.
4. Offer an alternative that does not use biometrics, and make it easy to pick.
5. Keep an audit record of who agreed, when and to what.

This is general information, not legal advice. Have counsel review your flow before launch.

What about accessibility and people who cannot enrol?

Every modality has users it fails. Some people have worn or missing fingerprints. Some have facial differences or injuries that stop a camera from reading them. The industry term is failure to enrol, and it is a real operating cost, because each failed user needs another route in.

NIST addresses part of this. Its guidance says that when the limit on failed biometric attempts is hit, the system must disable biometrics and offer another factor. The overall limit is no more than 50 consecutive failures, or 100 when PAD is in place. A good rollout treats a non-biometric path as a standard feature, not a favour. Security keys with a PIN, an authenticator app, or a help desk process with strong ID checks all work.

Which platforms offer biometric authentication, ranked for business buyers?

This ranking weighs three things: how well the platform supports phishing-resistant biometric sign-in through passkeys and FIDO2, how clear its data handling is, and how broad its fit is for a typical company. Remote identity verification vendors are ranked after the sign-in platforms, because they solve a different problem. Prices below were read from each vendor’s own page on 11 November 2026, in the dollar figures those pages served. A vendor with no figure published no figure we could read.

Rank	Platform	Best for	Published price (read 11 Nov 2026)
1	Microsoft Entra ID	Companies already on Microsoft 365 and Windows Hello	Entra ID P1 $7.00 and P2 $10.00 per user per month, paid yearly, per the Microsoft Entra pricing page
2	Okta	Mixed app estates that need one neutral sign-in layer	Starter $6 and Essentials $17 per user per month, billed annually with a $1,500 annual contract minimum, per the Okta pricing page
3	Duo Security	Small teams that want passkeys and MFA fast	Free for up to 10 users; $3, $6 and $9 per user per month, per the Duo editions and pricing page
4	Auth0	Developers adding passkeys to a customer-facing app	Free up to 25,000 monthly active users; Essentials $35 a month and Professional $240 a month at the 500-user setting, per the Auth0 pricing page
5	Ping Identity	Large enterprises with workforce, customer and partner identities	No figure published. Its pricing page describes tiers by identity count and type
6	Alice Biometrics	SMBs adding face-based onboarding and customer sign-in	No price readable on its pricing page
7	Veriff	Pay-per-check ID and selfie verification at low volume	$0.80, $1.39 and $1.89 per verification, with monthly minimums of $49, $99 and $209, per the Veriff pricing page
8	Persona	Teams that want to design their own verification flows	No price readable. The vendor site returned an access-denied response to automated fetching, so we did not work around it
9	Sumsub	Regulated firms that need ID checks plus AML screening	$1.35 per verification with a $149 monthly minimum, and $1.85 with a $299 minimum on the regulated-business plan, per the Sumsub pricing page
10	Onfido	Document and face checks for onboarding at scale	No price read

Which sign-in platforms are strongest for workforce biometrics?

Microsoft Entra ID sits first because most companies already run Windows laptops, and Windows Hello gives staff face or fingerprint sign-in with the match staying on the machine. Entra also supports FIDO2 security keys and passkeys. The catch is lock-in: it works best when you live in the Microsoft world. See alternatives to Entra ID if you do not. Compare it head to head with Entra ID vs Okta or Entra ID vs Duo.

Okta is a neutral layer that sits across many different apps and device types. It suits a company with Mac, Windows and cloud apps that wants one policy. Check the contract minimum before a small pilot. More options are on the Okta alternatives page, and the closest rival match-ups are Auth0 vs Okta, Duo vs Okta and Okta vs Ping Identity.

Duo Security is the quickest route for a small team. It has a free plan for up to 10 users, so you can test passkey and biometric sign-in before paying anything. See Duo alternatives and Duo vs Ping Identity.

Ping Identity targets large enterprises that run workforce, customer and partner identities together. Expect to talk to sales for a quote. Browse Ping Identity alternatives or Auth0 vs Ping Identity.

Which platforms suit customer-facing apps?

Auth0 is built for developers who add sign-in to their own product, including passkeys. Its free plan covers up to 25,000 monthly active users, which makes it a common first stop for startups. The Essentials and Professional figures in the table depend on the user count chosen on the slider, so read your own number off the page. Auth0 alternatives are listed on its own page.

Alice Biometrics is the one product in our catalogue that puts biometrics in its name. Its Spotsaas listing describes face recognition and liveness detection for identity verification and onboarding, aimed at SMB teams, and the listing is still unclaimed by the vendor. Because it matches faces on a server, the laws above apply directly. See Alice Biometrics alternatives and Alice Biometrics vs Onfido.

Which platforms verify a new customer’s identity with a selfie?

These vendors match a live selfie to a government ID photo, which is server-side biometrics and falls under the strictest laws. Browse the full identity verification software category.

• Veriff publishes per-check prices on three plans and suits companies that want to start small. Compare Persona vs Veriff, Onfido vs Veriff and Sumsub vs Veriff, or see Veriff alternatives.
• Persona lets teams build custom verification flows. Compare it with Sumsub on Persona vs Sumsub or read Persona alternatives.
• Sumsub lists liveness and deepfake detection alongside AML screening and monitoring, which suits regulated firms. See Sumsub alternatives.
• Onfido is established in document and face checks. See Onfido alternatives. Socure sits in the same category with a focus on identity and fraud decisions; see Socure alternatives.

Which vendors are worth knowing but lack a Spotsaas page?

Three vendors come up in biometric buying and have no product page on Spotsaas yet. iProov is known for face liveness checks. HYPR sells passwordless sign-in built on FIDO. Yubico makes YubiKey hardware security keys, including models with a built-in fingerprint reader. We have not read any prices for them and make no claims about their plans. For storing and syncing passkeys across a team, 1Password is in our catalogue. For wider reading, see the multi-factor authentication software category and the CIAM software category.

How do you roll out biometric authentication? A checklist

1. Name the job. Is this staff sign-in, customer sign-in, or onboarding identity checks? The answer decides the design and the law that applies.
2. Prefer on-device matching. Use passkeys and FIDO2 wherever you can, so the biometric never reaches your servers.
3. Map your states. List where your staff and customers live. Illinois, Texas and Washington each have a statute, and the EU and UK have GDPR.
4. Write the consent and retention text first. Do this before any pilot, and get counsel to read it.
5. Ask for test evidence. Request PAD results against ISO/IEC 30107-3 from a named lab, and the vendor’s FMR and FNMR figures at a stated threshold.
6. Plan for people who cannot enrol. Provide a security key, a PIN or an assisted route, and measure how often it gets used.
7. Check where data lives. Get written answers on storage location, retention, deletion and sub-processors.
8. Pilot with a small group. Track failed sign-ins and help desk tickets for a month before you widen it.
9. Set a deletion routine. Delete templates when staff leave or customers close accounts, and log it.
10. Re-review each year. Laws and vendor terms change.

Frequently asked questions

Statutes and standards were read from the linked pages on 11 November 2026. Pricing changes often, so confirm any figure on the vendor’s page before you budget.