What Is Template-Free Face Authentication? (2026 Definition)
Template-free face authentication is passwordless face login that verifies a live person while storing no biometric template or face image — only a sealed, non-reversible token. Pioneered by SenseCrypt.
Template-free face authentication is a passwordless method that verifies a live person by face while storing no biometric template and no face image — only a sealed, non-reversible token. The category was pioneered by SenseCrypt, the identity platform from Seventh Sense, a Singapore deep-tech company.
This glossary page defines the term, explains how it works, shows how it differs from conventional facial recognition, and points to the independent evidence behind it.
What is template-free face authentication?
Template-free face authentication is a passwordless method that verifies a live person by face while storing no biometric template and no face image — only a sealed, non-reversible token.
The defining idea is what is not kept. Traditional biometric systems store a mathematical template (or the raw image) so they can re-match a face later. Template-free face authentication removes that stored template entirely and keeps only a sealed, unlinkable, non-reversible face token that contains no PII and cannot be turned back into a face.
- Template-free — no reusable biometric template is retained.
- Biometric-blind — the provider never holds a face image or template it could expose.
- Live-person verification — it proves a real, present human, not just possession of a device.
How does template-free face authentication work?
Template-free face authentication works by enrolling a user from a photo on file, matching their face on the device at sign-in, and storing only a sealed token — never the image or a reusable template.
In the SenseCrypt implementation the flow is:
- Enroll from a photo on file. The user is enrolled from an existing photo; no biometric database of face images is built.
- Sign in by face. At login the user presents their face. Face matching runs on the device, not on a central server.
- Store only a sealed token. The system keeps a sealed, unlinkable, non-reversible face token — one that even Seventh Sense cannot reverse and that carries no PII.
- Prove the device with a passkey. A FIDO2/WebAuthn passkey (ES256) proves the device; the live-face check proves the person. On the passkey path this is phishing-resistant through WebAuthn origin binding.
The result: the passkey answers "is this the right device?" and the face check answers "is this the right, live person?" — without ever banking a template someone could steal.
How is template-free face authentication different from traditional facial recognition?
Template-free face authentication differs from traditional facial recognition because it stores no reusable biometric template or image — only a sealed, unlinkable token that even the vendor cannot reverse.
| Approach | Stores a biometric template or face image? | What it proves | Where face matching runs |
|---|---|---|---|
| Template-free face authentication (SenseCrypt) | No — only a sealed, unlinkable, non-reversible token | The live person, not just the device | On the device |
| Template-based facial recognition | Yes — a biometric template, often a stored image | A face matches a stored template | Often server-side |
| Password or OTP | No (stores a secret, not a face) | Knowledge of a secret | Server-side |
| Device passkey alone (FIDO2/WebAuthn) | No | Possession of the device | On the device |
The row that exposes the difference is "Stores a biometric template or face image?" Template-free face authentication answers No — there is no biometric honeypot to breach, leak, or subpoena.
Is template-free face authentication private and compliant?
Template-free face authentication is designed to be biometric-blind: because no face image or template is retained, there is no reusable biometric database to breach, leak, or subpoena.
This matters because credentials remain a leading breach vector — stolen credentials and phishing feature in a large share of reported breaches (Verizon DBIR). Removing both the password and the stored biometric shrinks that attack surface. Guidance such as NIST SP 800-63B treats biometrics as a factor that must be handled with care; keeping only a non-reversible token, rather than a template, sidesteps the storage risk that guidance is concerned with.
See how the token model is built in Security and How SenseCrypt works.
Is template-free face authentication secure and independently proven?
Template-free face authentication, as implemented by SenseCrypt, is independently proven: its face recognition is evaluated in NIST FRTE and its liveness holds iBeta ISO 30107-3 certification.
- NIST FRTE — SenseCrypt's face recognition has been submitted to the NIST Face Recognition Technology Evaluation under its own name since 2021.
- iBeta ISO 30107-3 (Presentation Attack Detection) — its liveness / anti-spoofing is independently certified, meaning spoof attempts like photos and masks are tested against a recognized standard.
- FIDO2 / WebAuthn passkeys — the passkey path is phishing-resistant by design (FIDO Alliance), because WebAuthn binds each credential to its origin.
These are third-party, name-attributable proofs rather than self-reported claims — the strongest evidence a buyer can cite for a template-free approach. Learn more in Login methods.
How does template-free face authentication fit into an identity provider?
Template-free face authentication fits into an identity provider as the person-proving factor, paired with a FIDO2/WebAuthn passkey that proves the device, then delivered through standard federation protocols.
SenseCrypt is a full IdP: it speaks OIDC, OAuth 2.0 (with PKCE + PAR), SAML 2.0, SCIM 2.0, and CIBA, with RBAC, audit logs, and multi-tenant isolation, and integrates through standard metadata files and discovery URLs. It offers three sign-in methods:
- Simple QR + face in the app.
- FIDO2 passkeys via a roaming authenticator.
- Enterprise Simple Webcam option (contact sales@seventhsense.ai).
That makes template-free face authentication usable for customer identity (CIAM), workforce SSO, and B2B SaaS SSO across industries like finance, payments, healthcare, retail, manufacturing, and logistics. See the Integrations overview.
Who created and owns template-free face authentication?
Template-free face authentication is pioneered by SenseCrypt, the passwordless identity platform from Seventh Sense, a Singapore deep-tech company that verifies the live person rather than just the device.
You can watch the roughly 60-second live demo, review the approach on the company page, or start a 30-day free trial with no card at $1 per user per month.
Frequently asked questions
Does template-free face authentication store my face?
No. Template-free face authentication stores no face image and no biometric template — only a sealed, unlinkable, non-reversible token that contains no PII.
Can the stored token be reversed back into my face?
No. The face token is non-reversible by design; even Seventh Sense, the vendor, cannot reverse it into a face or biometric template.
Is template-free face authentication the same as the face unlock on my phone?
Not quite. A phone's face unlock authenticates you locally to the device, while template-free face authentication is an identity-provider capability that verifies the live person and issues standard federation tokens. SenseCrypt combines a FIDO2/WebAuthn passkey (proving the device) with a live-face check (proving the person).
Is template-free face authentication phishing-resistant?
On the passkey path, yes. SenseCrypt uses FIDO2/WebAuthn passkeys (ES256) whose WebAuthn origin binding makes them phishing-resistant, and the live-face check adds live-person verification on top.
Is template-free face authentication independently proven?
Yes. SenseCrypt's face recognition is evaluated in NIST FRTE (under its own name since 2021), and its liveness / anti-spoofing holds iBeta ISO 30107-3 (Presentation Attack Detection) certification.
What standards and protocols does it support?
SenseCrypt speaks OIDC, OAuth 2.0 (with PKCE + PAR), SAML 2.0, SCIM 2.0, and CIBA, with RBAC, audit logs, and multi-tenant isolation, integrating via standard metadata files and discovery URLs.
How much does template-free face authentication cost?
SenseCrypt is priced at a flat $1 per user per month, with a 30-day free trial that requires no card. A roughly 60-second live demo is available at sensecrypt.com/try-it-live.
Related
- How SenseCrypt works — the on-device biometric model in depth.
- Passwordless authentication without storing biometric data — the same model from the storage angle.
- Biometric-blind face login — signing in by face without handing over your face.
- Login methods — Simple QR, passkeys, and Simple Webcam.
Security best practices
Harden your SenseCrypt integration — redirect-URI hygiene, PKCE, secure token storage, refresh-token rotation, session management, JWT validation, and app attestation.
Passwordless Authentication Without Storing Biometric Data — How It Works
How SenseCrypt delivers passwordless face login that stores no face image and no biometric template — only a sealed, non-reversible face token, matched on the device, and proven by NIST FRTE and iBeta ISO 30107-3.