Face ID — what it is, how face recognition works

What is Face ID?

Face ID is Apple’s biometric authentication system based on three-dimensional scanning of the user’s face. It first appeared in the iPhone X in September 2017, replacing Touch ID as the primary biometric protection method for Apple’s flagship devices. Unlike 2D face recognition using a photo from the front camera, Face ID builds an accurate depth map of the face by analyzing over 30,000 invisible infrared points.

The system uses a specialized neural processor Neural Engine as part of Apple A12 and newer chips. The Neural Engine performs 600 billion operations per second, processing biometric data directly on the device without transmitting it to the cloud. The mathematical face templates are encrypted and stored exclusively in the Secure Enclave — a hardware security module isolated from the iOS operating system.

Face ID is supported on all Apple devices with a TrueDepth camera: iPhone X and newer (except iPhone SE), iPad Pro 11" and 12.9" (3rd generation and newer), as well as iPad Air and iPad mini with the corresponding module. The technology is used not only for device unlocking but also for authorizing payments in Apple Pay, purchases in the App Store, and filling passwords via iCloud Keychain.

How does Face ID work?

Face ID goes through three sequential stages: face detection, infrared depth map projection, and attention awareness check. Each stage is performed by the TrueDepth camera hardware modules without involving the central processor, eliminating the possibility of data interception at the OS level.

Detection and point projection

The TrueDepth IR camera detects the presence of a face in the module’s field of view. The Flood Illuminator — an infrared illuminator — lights up the face with invisible light, ensuring the system works in complete darkness. The Dot Projector projects over 30,000 infrared points onto the face in a regular grid. The camera captures the deformation of this grid relative to the face’s contours — similar to how structured light works in professional 3D scanners.

Creating the depth map and template

From the obtained points, the Neural Engine builds a mathematical model of the face — a depth framework accurate to tenths of a millimeter. Unique features are extracted from this model: distances between key points (eyes, nose, lips), cheekbone and jaw shape, volumetric proportions. The template, approximately 20 KB in size, is encrypted with a cryptographic key unique to the Secure Enclave and stored in the module’s non-volatile memory.

Attention Awareness and adaptation

The system checks that the user is consciously looking at the screen — the Attention Awareness feature. Additional IR emitters check gaze direction and pupil fixation. Without this check, Face ID is locked by default and requires passcode entry for authentication. The system also adapts to natural appearance changes: beard, glasses, headwear, makeup. With each successful recognition, the template updates, capturing the new face image and improving accuracy over time.

TrueDepth camera: components and structure

The TrueDepth module consists of several hardware components working synchronously. Each component performs a strictly defined function: from illuminating the face in the dark to projecting the depth map for subsequent analysis in the Neural Engine.

An important feature of the module is hardware isolation of the video stream. The infrared camera transmits data directly to the Secure Enclave via a dedicated secure channel. Neither the iOS operating system nor third-party applications have access to raw face images. This eliminates the class of attacks related to intercepting biometric data from application memory.

Face ID vs Touch ID: accuracy and speed comparison

Both Apple biometric authentication technologies have different characteristics that influence the choice between them in various usage scenarios. The comparison is based on key metrics: recognition accuracy, response speed, and attack resistance.

• FAR (False Acceptance Rate) — Face ID: 0.0001% (1 in a million), Touch ID: 0.001% (1 in 50,000). Face ID is 10 times more accurate thanks to 3D scanning
• Speed — Touch ID responds in 200–300 ms, Face ID in 600–1000 ms accounting for gaze check. Touch ID is faster in a static scenario
• Spoof resistance — Face ID is protected against photos, masks, and silicone casts thanks to the live gaze requirement and IR projection. Touch ID can be fooled by a high-quality fingerprint copy
• Environmental conditions — Touch ID doesn’t work with wet or dirty fingers. Face ID works in complete darkness thanks to Flood Illuminator but may err under direct sunlight on the IR camera lens
• Multiple users — Touch ID allows storing up to 5 fingerprints (different fingers or other users). Face ID recognizes only one face by default but supports an alternative appearance

For mobile applications, both technologies are used through the unified LocalAuthentication API. The developer doesn’t choose between Face ID and Touch ID — the system automatically uses the available biometric sensor on the user’s device. This means that an application implementing biometric authentication via LAContext works correctly on all Apple devices.

Implementing Face ID via LocalAuthentication

In iOS, developers use the LocalAuthentication framework to integrate Face ID and Touch ID into applications. The API abstracts the details of the specific biometric sensor — the code looks the same for face recognition and fingerprint recognition. All biometric computations are performed inside the Secure Enclave without transmitting data to the developer.

import LocalAuthentication

func authenticateUser() {
    let context = LAContext()
    context.localizedReason = "Verify your identity for access"

    var error: NSError?
    guard context.canEvaluatePolicy(
        .deviceOwnerAuthenticationWithBiometrics,
        error: &error
    ) else {
        // Biometrics unavailable — show passcode entry screen
        showPasscodeFallback()
        return
    }

    context.evaluatePolicy(
        .deviceOwnerAuthenticationWithBiometrics,
        localizedReason: "Authentication required"
    ) { success, error in
        if success {
            DispatchQueue.main.async {
                // User confirmed via Face ID
                self.showProtectedContent()
            }
        }
    }
}

The LAContext framework provides the .deviceOwnerAuthenticationWithBiometrics policy, which automatically selects the available biometric sensor: Face ID on devices with TrueDepth, Touch ID on devices with a Home button. If the biometric sensor is unavailable or 3 consecutive failed attempts occur, the system prompts for the device passcode — without additional code on the developer’s side.

In iOS 16+, an extended AuthenticationServices API appeared for asynchronous biometric authentication via ASAuthorizationController. This approach is recommended by Apple for new projects as it integrates with iCloud Keychain and supports Passkeys — passwordless authentication based on the FIDO2 standard.

Face ID security and data protection

The Face ID security architecture is built on three levels: Secure Enclave hardware isolation, cryptographic binding of the template to the device, and algorithmic protection against spoofing attacks. None of these levels rely on iOS software protection, eliminating OS-level vulnerabilities.

Secure Enclave is a dedicated coprocessor based on ARM TrustZone architecture, running its own micro-OS (SEPOS). It has a direct hardware channel to the TrueDepth infrared camera, bypassing the main processor’s data bus. The face template is encrypted inside the Secure Enclave using a key tied to the device’s unique identifier (UID), which is fused into the chip during manufacturing and is unreadable even by Apple.

To protect against spoofing, Face ID uses two mechanisms: liveness detection and attention awareness. Liveness detection analyzes skin texture via IR imaging: the material of a photo, silicone mask, or 3D-printed copy has a different infrared reflectance coefficient compared to live skin. The FIDO2 standard and ETSI EN 319 411 regulatory requirements classify Face ID as a High Assurance biometric system suitable for authorizing financial transactions.