Is face or fingerprint unlock safe to use?

On modern phones, biometric data is converted to a mathematical representation and stored in a dedicated secure area of the processor, never leaving the device and not accessible to apps or the manufacturer. The system compares new scans against that stored representation locally. This design means using face or fingerprint unlock does not upload your biometrics anywhere, which is the most common concern and largely an unfounded one for the built-in phone systems, though third-party apps using biometrics for their own purposes are a different question worth reading the policy on.

Security-wise, biometrics are strong against the realistic threat, which is someone picking up your unattended phone, and they encourage people to lock devices they would otherwise leave open. Sophisticated attacks against face and fingerprint sensors exist and have been demonstrated, but they require targeted effort well beyond the opportunistic theft most people face. Every biometric system still has a passcode fallback, and that passcode remains the actual security floor, which is why a six-digit or alphanumeric passcode meaningfully beats a four-digit one.

The distinction that matters most is legal rather than technical. Courts in the United States have generally treated compelling someone to provide a passcode as potentially protected by the Fifth Amendment because it reveals the contents of the mind, while compelling a fingerprint or face scan has more often been treated as non-testimonial and permissible, though rulings vary and the law remains unsettled. Practically, if you are in a situation where this matters, both major mobile platforms include a quick way to disable biometrics and force passcode entry, and knowing that shortcut before you need it is worthwhile. Restarting a phone also requires the passcode on first unlock, which is the simplest version of the same protection.