Touch ID: what it is, how fingerprint works

What is Touch ID?

Touch ID is a biometric fingerprint sensor developed by Apple for user authentication on iPhone, iPad, and Mac devices. The technology is based on capacitive scanning: a thin layer of sapphire glass on the sensor protects a 500-point capacitive array that reads the finest details of the papillary pattern — minutiae, pores, and ridge direction.

Unlike optical scanners popular in Android devices of the time, Touch ID’s capacitive method delivers higher accuracy through direct finger contact with the sensor. A ceramic detection ring around the Home button detects finger contact and activates the array only when live contact is present, preventing false triggers from accidental touches of metal objects.

The first-generation Touch ID (iPhone 5S, iPad Air 2) had a thickness of 170 microns and a sensor resolution of 500 PPI. The second generation (iPhone 6S, iPhone SE 1st gen) upgraded the sensor to a 170-micron array with improved wet-finger recognition. The third generation is used in MacBook Air and MacBook Pro with the Touch ID button on the keyboard — the sensor connects directly to the Apple T2 chip or Silicon Secure Enclave.

How Does Touch ID Work?

The authentication process through Touch ID consists of two stages: enrollment and verification. Both stages are executed inside the Secure Enclave — an isolated security coprocessor that iOS cannot access even with root privileges.

Fingerprint Enrollment

The user places their finger on the Home button several times at different angles. The capacitive array scans an 8×8 mm fingerprint area at 500 PPI resolution. The system collects up to 12 different fragments of the same fingerprint at various tilt angles — this is necessary to recognize the finger when rotated 360 degrees. Each fragment is converted into a mathematical template, and all are combined into one reference fingerprint template.

Verification

When a finger touches the sensor, the detection ring sends a signal to the Secure Enclave, initiating the scan. The array captures the current fingerprint in 200–300 ms, extracts minutiae (endings and bifurcations of papillary lines), and compares them against stored templates. The Secure Enclave performs comparison across 50–100 points, computing a similarity metric. If the match exceeds the threshold, authentication is considered successful.

Failed Attempts and Lockout

After 3 failed attempts, Touch ID locks for 10 seconds. After 5 failed attempts, the device password is required, and Touch ID is disabled until a successful password entry. After a device restart or 48 hours since the last unlock, Touch ID also requires a password — this is a hardware requirement of the Secure Enclave that cannot be bypassed programmatically.

Touch ID Hardware Architecture

The Touch ID sensor is a multi-layer structure where each layer performs its function: from mechanical protection to touch detection and fingerprint capture. All sensor data is transmitted over an encrypted channel directly to the Secure Enclave.

The key architectural decision is no OS access to raw data. iOS cannot see the fingerprint image or the template itself. The Secure Enclave returns only a binary result: “success” or “failure.” This eliminates the possibility of programmatic interception of biometric data at the application or operating system level.

Touch ID vs Face ID

Touch ID and Face ID are two successive Apple biometric technologies. Despite the shared goal (user authentication), they differ in architecture, usage scenarios, and security characteristics. This comparison helps developers understand what limitations to consider when designing authentication in an application.

• FAR — Touch ID: 0.001% (1 in 50,000), Face ID: 0.0001% (1 in 1,000,000). Face ID is 10 times more accurate thanks to 3D scanning
• Speed — Touch ID takes 200–300 ms (simple touch), Face ID takes 600–1000 ms (scan + attention check). Touch ID is faster for simple unlocking
• Moisture resistance — Touch ID does not work with wet or greasy fingers; Face ID is not sensitive to moisture on the face but errors with a dirty IR camera
• Multiple scenarios — Touch ID can store up to 5 fingerprints for different fingers or different users. Face ID supports only one face plus an alternative appearance
• Form factor — Touch ID requires a physical button or dedicated area on the chassis; Face ID requires a notch or Dynamic Island on the display

In iOS development, both APIs are available through the unified LocalAuthentication framework. Calling canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics) returns biometric availability regardless of its type. This means an application with biometric authentication works correctly on all Apple devices.

Touch ID Security and Secure Enclave

The security architecture of Touch ID is based on three principles: hardware isolation, cryptographic binding to the device, and no storage of the original image. These principles are implemented through the Secure Enclave — a coprocessor running its own SEPOS firmware.

The Secure Enclave generates a unique device identifier (UID) during manufacturing, which is fused into the chip and cannot be read even through JTAG or probe stations. The fingerprint template is encrypted with a key derived from the UID and stored in encrypted flash memory inside the Secure Enclave. At each device boot, SEPOS verifies firmware integrity through a hardware verifier — if the firmware is modified, the Secure Enclave permanently locks itself.

Touch ID meets FIDO2 requirements for biometric verification and is used for payment authorization in Apple Pay. The PCI DSS (Payment Card Industry Data Security Standard) recognizes Touch ID as a valid authentication factor for mobile payments when used in combination with the device PIN for multi-factor authentication. If the device is compromised, an attacker cannot extract the fingerprint template from the Secure Enclave — data is destroyed at any attempt of unauthorized access through system mode.

Implementing Touch ID via LocalAuthentication

In iOS development, Touch ID integration is done through the LocalAuthentication framework — the same API used for Face ID. The code is universal for both biometric types and does not require specifying a particular sensor. The system automatically determines the available biometric method on the user’s device.

import LocalAuthentication

func authenticateWithTouchID() {
    let context = LAContext()
    context.localizedReason = "Verify your identity to access data"

    var error: NSError?
    guard context.canEvaluatePolicy(
        .deviceOwnerAuthenticationWithBiometrics,
        error: &error
    ) else {
        // Touch ID unavailable — show password entry screen
        showPasscodeScreen()
        return
    }

    context.evaluatePolicy(
        .deviceOwnerAuthenticationWithBiometrics,
        localizedReason: "Touch the Touch ID sensor with your finger"
    ) { success, authError in
        DispatchQueue.main.async {
            if success {
                // Touch ID confirmed
                self.unlockContent()
            } else {
                // Authentication error
                handleError(authError)
            }
        }
    }
}

This code shows a standard authentication implementation using Touch ID. The canEvaluatePolicy method checks for registered fingerprints in the Secure Enclave and sensor availability on the device. If the device has Face ID instead of Touch ID, the same code works unchanged — LAContext automatically selects the available sensor. After three failed attempts, hardware lockout triggers, and the user must enter the device password.

For cryptographic binding of biometric authentication to specific operations (e.g., signing payments in Apple Pay), the evaluateAccessControl method with a SecAccessControl parameter is used. This approach links the Touch ID result with a key in Keychain: successful authentication unlocks access to a secret key for performing a cryptographic operation. Without a successful fingerprint scan, the key remains locked in the Secure Enclave, eliminating the possibility of programmatic bypass of biometric verification.

Touch ID Usage Scenarios

Touch ID is used in several key scenarios both at the iOS system level and in third-party applications. Each scenario uses the unified LocalAuthentication API but imposes different security policy requirements — from simple unlocking to cryptographically signed transaction authorization.

Main scenarios include device unlocking, purchase authorization in the App Store and iTunes, payment confirmation through Apple Pay, automatic password filling from iCloud Keychain, and authentication in third-party applications via LocalAuthentication. In each scenario, Touch ID replaces password entry: the user touches the sensor, the Secure Enclave confirms identity, and the action is performed without entering credentials.

In iOS 14+, the additional ASAuthorizationAppleIDRequest API was introduced, integrating Touch ID with Apple ID for passwordless login to websites through Safari. The user touches Touch ID, and the browser receives a cryptographically signed token from the Secure Enclave, which the server can verify without storing a password. This mechanism is the foundation of Apple’s Passkeys ecosystem.