How Facial Recognition Unlock Works on Your Phone

Two phones can both list "face unlock" in their settings and still be running entirely different technology underneath. One uses infrared light to project a grid of dots across your face and build a 3D map from how that grid warps. The other just snaps a photo with the front camera and compares it, pixel pattern to pixel pattern, against a stored image. The lock-screen animation looks identical either way, but the gap between these two approaches is why one phone unlocks confidently in a pitch-dark room and the other struggles even with the lights on.

Two very different technologies hiding behind one setting

The premium version — used in iPhones since the iPhone X, and in the higher-end Android flagships that support it — relies on structured light or a similar depth-sensing method. The budget version, found in most mid-range and low-cost Android phones, just uses the regular selfie camera and a software algorithm to compare what it sees against a stored face profile. No depth data, no infrared, just 2D pixels. Android itself distinguishes between these under the hood: Google's BiometricPrompt API classifies authentication methods into security classes, and a plain camera-based face unlock usually only qualifies for the weaker class, which is why many banking and payment apps refuse to accept it for login even when it's enabled for unlocking the phone.

How the 3D version builds a face map

Structured-light systems (Apple calls its version TrueDepth) work by projecting a grid of thousands of invisible infrared dots onto your face from a dedicated dot projector next to the front camera. An infrared camera then photographs how that dot pattern distorts across the contours of your nose, cheeks, and jaw. Because the dots warp differently depending on the depth of the surface they land on, the phone can reconstruct a rough 3D mesh of your face in a fraction of a second — entirely independent of ambient light, which is why this method still works in a dark room. A flat photo or video played on another screen doesn't have depth, so the dot pattern lands flat and gets rejected immediately.

Turning a face into numbers, not a photo

Neither method stores a picture of your face. Instead, the depth map (or the 2D image, for cheaper phones) gets fed into a small on-device neural network that outputs a mathematical vector — essentially a long list of numbers describing proportions and distances between facial landmarks: eye spacing, nose bridge width, jaw curvature, and dozens of similar measurements. That vector is encrypted and stored locally, usually in a secure hardware enclave separate from the main OS, and every unlock attempt just compares a freshly generated vector against the stored one for a close-enough statistical match. This is also why face unlock degrades gracefully with a new haircut or glasses but fails completely if you cover half your face — the underlying proportions change enough that the vectors stop matching within tolerance.

Liveness detection: stopping photo and video spoofing

Any system relying only on 2D comparison is theoretically vulnerable to a printed photo or a video played on another phone. To counter this, both 2D and 3D systems add liveness checks — looking for subtle eye movement, blink detection, or asking (invisibly, via the neural network) whether the depth pattern is consistent with living skin rather than paper or a screen. 3D systems have a structural advantage here because a flat photo simply cannot fake a 3D depth signature, no matter how good the print quality is. This is precisely why Apple and most Android manufacturers using true depth sensors are comfortable certifying face unlock for payment authorization, while 2D-only face unlock is generally kept restricted to unlocking the home screen.

Why performance varies so much between phones

The gap in real-world reliability — some phones unlock instantly in pitch darkness, others struggle even in daylight with a slightly turned head — comes down to whether infrared hardware is present at all, how many reference points the depth sensor captures, and how much the manufacturer has trained the on-device model on diverse face angles and lighting. Cheaper phones cut costs by skipping the infrared dot projector entirely and leaning on software-only matching, which is faster to unlock in good light but noticeably less reliable and less secure.

Why Face Unlock Sometimes Fails After Waking Up

Puffiness, changed lighting, or a slightly different angle right after waking up can push the freshly generated face vector just outside the matching tolerance, even though the underlying face hasn't changed. This isn't a flaw specific to any one phone — it's an inherent property of statistical matching against stored proportions, and it's exactly why every face unlock system falls back to a PIN or password rather than being the sole authentication method.

Twins and Close Relatives: A Genuine Edge Case

Identical twins share close enough facial proportions that both 2D and, less commonly, some 3D systems have been documented unlocking for the wrong twin. Apple explicitly warns about this specific scenario for Face ID, recommending Touch ID or a passcode instead for households with identical twins or very similar-looking siblings — a rare but real limitation worth knowing about rather than assuming face unlock security is absolute.

Can a 3D Mask Trick Face Unlock

In controlled research settings, yes, extremely detailed, professionally made masks have defeated some 3D face unlock systems. That takes resources and access way beyond a typical theft scenario, though. Against realistic everyday threats, someone grabbing your phone and holding up a photo, 3D systems stay highly resistant, which is really the threat they were designed to stop in the first place. And why do some phones let you register multiple face profiles? Mostly to handle big appearance changes, growing or shaving a beard, wearing glasses or not, by storing more than one valid reference rather than locking you into a single rigid profile. It's not meant to let multiple different people unlock the same phone with their own faces.

How to Tell Which Version You Have

If your phone's face unlock refuses to authorize a UPI payment or an app login and asks for a PIN instead, it's very likely running the weaker 2D-only version. Check which version your phone has before assuming something's broken — a phone without a dedicated depth sensor is being deliberately kept out of the higher security tier, and no amount of retrying the scan will change that classification.