Is it safer to unlock my phone with my face / fingerprint or with a passcode?

More context

Biometrics in everyday consumer use means three things: fingerprint scanning (Touch ID, Android fingerprint), face recognition (Face ID, Pixel Face Unlock, Samsung Face), and to a lesser extent iris scanning on a few devices. All three are forms of convenience authentication — a fast, locally-verified replacement for typing your passcode dozens of times a day.

The correct mental model is biometrics on top of, not instead of, a strong passcode. Here is why:

• Your phone’s actual master secret is the passcode. When you set up Face ID or a fingerprint, the phone stores a mathematical template of your biometric inside a tamper-resistant chip (Apple’s Secure Enclave, Android’s Trusted Execution Environment). That chip refuses to release the encryption keys unless the biometric matches.
• The phone always allows passcode as a fallback. After several failed biometric attempts, after a reboot, after 48 hours without unlocking, after an explicit force-passcode action — your phone falls back to the passcode. The passcode is the master, biometrics are the shortcut.
• This means: a strong passcode is what defends your device; biometrics let you have a strong passcode without typing it 50 times a day. Choose a long passcode (8+ digits, alphanumeric if your phone allows) and turn on biometrics.

What biometrics protect well against:

• Shoulder-surfing of your passcode. Anyone who sees you type a 4-digit PIN at a café can replay it later; nobody can replay your face.
• The “I left my phone unlocked on the table” scenario — Face ID and fingerprint timeouts re-lock quickly.
• Casual snooping by family, colleagues, classmates. They have your number — but not your fingerprint.

What biometrics do not protect against:

• A determined attacker who has your passcode. The passcode beats biometrics every time.
• A phone you handed over while logged in — once unlocked, biometrics are not asked again until lock.
• Legal compulsion in some jurisdictions (see FAQ above). You can disable biometrics on the fly: iOS by holding side button + a volume button for 2 seconds, Android via the power-menu “lockdown” option.
• Phishing of your accounts. Your phone biometrics protect the device, not the website you log into. For accounts, two-factor authentication — preferably passkeys, which use exactly the same biometric chip to log into websites — is the equivalent layer.

A useful practical bundle for most people in 2026:

1. Long passcode (8+ digits or an alphanumeric phrase). Type it the first time of the day; biometrics handle the rest.
2. Biometrics on (Face ID + Touch ID where available, the platform’s face/fingerprint elsewhere).
3. Passkeys instead of passwords for as many accounts as support them — the same chip that unlocks your phone now logs into websites the same way, and phishing pages cannot trick it.
4. Know the disable-biometrics gesture for situations (border crossings, demonstrations, traffic stops in some countries) where you want passcode-only.

Biometrics are not a magic security solution, and they were never sold as one by Apple or Google. They are a convenience that makes the right thing — a long, unique passcode — practical to live with.