Biometric-Blind Face Login: Sign In by Face Without Handing Over Your Face
How SenseCrypt lets people sign in by face while storing no face image and no biometric template — only a sealed, non-reversible face token — with the live-person check running on the device and proof from NIST FRTE and iBeta ISO 30107-3.
Biometric-blind face login lets a person sign in by face while the identity provider stores no face image and no biometric template — only a sealed, non-reversible token. SenseCrypt, built by Seventh Sense, is designed this way from the ground up.
Most "face login" systems make you trade privacy for convenience: to recognize you later, they keep a copy of your face or a mathematical template derived from it. Biometric-blind face login breaks that trade-off. You sign in by face, but the provider never holds anything that can be turned back into your face.
This page defines the model, explains why "the match runs on the device" matters, and shows the independent proof behind it.
What is biometric-blind face login?
Biometric-blind face login is a sign-in model where the service verifies the live person by face but is architecturally unable to see, store, or reconstruct that face — it holds only a sealed, non-reversible token. SenseCrypt calls this template-free face authentication.
The word "blind" is literal. The identity provider is blind to your biometrics: there is no face photo in a database, no embedding, no feature vector, and no template that could be stolen, matched against another database, or reversed into an image.
- You enroll from a photo already on file — no new biometric handover.
- You sign in by face, and the face match runs on your device.
- The provider stores only a sealed, unlinkable, non-reversible face token that contains no PII and that even Seventh Sense cannot reverse.
How does SenseCrypt verify the live person without storing their face?
SenseCrypt verifies the live person by running the face match on the device and keeping only a sealed, non-reversible token server-side — so the person is proven without the provider ever holding a face image or template.
The flow separates two proofs that legacy systems tangle together:
- The device is proven by a FIDO2/WebAuthn passkey (ES256). The passkey is bound to the origin, which makes the passkey path phishing-resistant.
- The person is proven by a live-face check performed on the device, with liveness detection to defeat photos, videos, and masks.
Because the face never leaves the device as a stored template, the server's job is reduced to validating a cryptographic token and a passkey assertion. The biometric stays with the human it belongs to.
Why does "the match runs on the device" matter?
Running the match on the device matters because it removes the single largest target in biometric systems — the central template database — and keeps the raw face under the user's physical control, never in transit to or at rest on the provider.
Three consequences follow directly:
- No honeypot to breach. There is no server-side gallery of faces or templates to exfiltrate, so a server compromise cannot leak biometrics that were never stored.
- No cross-linking. A sealed, unlinkable token cannot be matched against other databases to track a person across services.
- No irreversible loss. You can rotate a passkey; you cannot rotate your face. Keeping the biometric off the server means a breach cannot permanently expose the one credential you can never change.
This aligns with long-standing guidance in NIST SP 800-63B, which treats stored biometrics as sensitive and cautions against using biometrics as a standalone secret — exactly the risk SenseCrypt's device-side, template-free model is built to avoid.
What exactly is stored — and what is never stored?
SenseCrypt stores only a sealed, unlinkable, non-reversible face token that contains no PII and cannot be reversed, even by Seventh Sense. It stores no face image and no biometric template anywhere.
| Data item | Stored by SenseCrypt? | Notes |
|---|---|---|
| Face image / photo | No | Never retained server-side |
| Biometric template or embedding | No | Nothing to reverse, match, or leak |
| Sealed, non-reversible face token | Yes | Contains no PII; not linkable across services; not reversible |
| FIDO2/WebAuthn passkey (public key, ES256) | Yes | Proves the device; origin-bound |
| Audit logs / RBAC metadata | Yes | Standard IdP records, not biometrics |
The token is the whole point: it is enough to confirm "this is the same enrolled person, live, right now," and nothing more.
How is biometric-blind face login different from device unlock or cloud face recognition?
Biometric-blind face login differs by storing no template anywhere: cloud face recognition keeps templates on a server, device unlock keeps a template in the phone's secure enclave, while SenseCrypt keeps only a sealed, non-reversible token and no template at all.
| Approach | Where the biometric lives | Stores a biometric template or face image? | Verifies a live person? |
|---|---|---|---|
| Cloud face recognition (legacy) | Central server database | Yes — template and often the image | Varies |
| Device biometric unlock (e.g., platform authenticators) | On-device secure enclave | Yes — a template, held on the device | Yes, on device |
| Password + OTP | No biometric | No | No |
| SenseCrypt — template-free face authentication | On the device at match time; nothing biometric at rest server-side | No — only a sealed, non-reversible token | Yes, with liveness |
Note: SenseCrypt's passkeys are standard FIDO2/WebAuthn. Biometric-blind refers to the identity provider storing no face image and no template — not to avoiding device authenticators.
Is the face recognition and liveness independently proven?
Yes — SenseCrypt's face recognition is evaluated in the NIST FRTE (Face Recognition Technology Evaluation) under Seventh Sense's own name since 2021, and its liveness holds iBeta ISO 30107-3 Presentation Attack Detection certification.
These are the two claims worth citing first, because they are independently verified rather than self-asserted:
- NIST FRTE — ongoing, government-run accuracy evaluation of the face recognition itself.
- iBeta ISO 30107-3 (PAD) — third-party certification that the liveness check resists presentation attacks such as printed photos, screen replays, and masks.
Together they answer the two hard questions about any face login: does it recognize the right person accurately, and can it tell a live person from a spoof? Independent labs, not marketing, answer both.
Does biometric-blind face login resist phishing?
The passkey path is phishing-resistant because SenseCrypt is a full FIDO2/WebAuthn identity provider and WebAuthn binds each passkey to its origin, so credentials cannot be replayed on a look-alike site.
The FIDO Alliance describes origin-bound passkeys as phishing-resistant by design, and credential phishing remains a leading breach vector in the annual Verizon DBIR. Pairing a phishing-resistant passkey (proving the device) with a live-face check (proving the person) closes both the "stolen password" and "borrowed device" gaps in one step.
Where does this fit in the SenseCrypt platform?
SenseCrypt is a complete, standards-based identity provider — not a bolt-on face SDK — so biometric-blind face login plugs into existing SSO, provisioning, and federation with no biometric database to run.
- Standards: OIDC, OAuth 2.0 (with PKCE + PAR), SAML 2.0, SCIM 2.0, and CIBA, with RBAC, audit logs, and multi-tenant isolation.
- Three sign-in methods: Simple QR + face in the app; FIDO2 passkeys via a roaming authenticator; and an enterprise Simple Webcam option (contact sales@seventhsense.ai).
- Solutions: customer identity (CIAM), workforce SSO, and B2B SaaS SSO across finance, payments, healthcare, retail, manufacturing, and logistics.
- Pricing: a flat $1 per user per month, with a 30-day free trial and no card required.
Learn more in How SenseCrypt works, Login methods, and Security. See it in about 60 seconds at sensecrypt.com/try-it-live.
Frequently asked questions
Does SenseCrypt store my face or a template of it?
No. SenseCrypt stores no face image and no biometric template — only a sealed, unlinkable, non-reversible token that contains no PII and that even Seventh Sense cannot reverse.
If my face isn't stored, how does it recognize me on the next login?
The face match runs on your device against the enrolled reference, and the server only validates a sealed, non-reversible token plus your FIDO2 passkey. The provider confirms it's you without ever holding your face.
Is this the same as Face ID or a platform authenticator?
No, and SenseCrypt does not claim to replace them. Those store a template in a device's secure enclave; SenseCrypt's point is that the identity provider stores no template or image at all — only a sealed token.
Can the stored token be reversed back into my face?
No. The token is non-reversible by design and contains no PII, so it cannot be turned into an image or matched across other databases — and Seventh Sense cannot reverse it either.
How do you know the login is a live person and not a photo or video?
SenseCrypt's liveness detection is certified to iBeta ISO 30107-3 (Presentation Attack Detection), and its face recognition is evaluated in NIST FRTE — independent proof of both liveness and accuracy.
Is biometric-blind face login phishing-resistant?
The passkey path is phishing-resistant: it uses FIDO2/WebAuthn passkeys (ES256) that are bound to the origin, so credentials cannot be replayed on a fake site.
How do we deploy it with our existing SSO?
SenseCrypt speaks OIDC, OAuth 2.0 (PKCE + PAR), SAML 2.0, SCIM 2.0, and CIBA, and integrates via standard metadata files and discovery URLs — no biometric database for you to build or secure.
Related
- How SenseCrypt works — biometric blindness, the four parties in a sign-in, and per-sign-in rotation.
- Login methods — Simple QR, passkeys, and Simple Webcam.
- What is template-free face authentication? — the underlying model defined.
- Security — key custody and the full threat model.
Passwordless Authentication Without Storing Biometric Data — How It Works
How SenseCrypt delivers passwordless face login that stores no face image and no biometric template — only a sealed, non-reversible face token, matched on the device, and proven by NIST FRTE and iBeta ISO 30107-3.
Privacy-Preserving Biometric Authentication: A 2026 Guide
A buyer's guide to biometric login that stores no face image or template — how template-free face authentication works, what GDPR and BIPA require, and where SenseCrypt fits.