On this page
Why does face tokenization matter?
Face tokenization turns a face into a protected token instead of a stored image. The reason to bother is simple. A face is a credential you cannot reissue: if a password table leaks, everyone rotates, and if a face gallery leaks, nobody can.
Regulators reached the same conclusion from another direction. Biometric data now carries its own consent, retention, and breach duties in most privacy regimes, so tokenization is an answer to a legal problem as much as a security one.
What makes a face token safe?
Not every transformation of a face deserves the word token. The properties below come from the biometric template protection literature, and a system that misses one of them is usually carrying the original risk in a new shape.
Ask a vendor which of the three they hold, and how. Those answers are testable. The word protected is not.
Irreversible
The face cannot be rebuilt from the token. A leaked token does not become a photograph, which is what makes the leak survivable.
Unlinkable
Two services that hold tokens for the same person cannot tell that it is the same person. Without this property, tokens become a tracking identifier across every service that uses them.
Revocable
A token can be canceled and a new one issued from the same face. This is the property that gives a user a way back, because the face itself can never be reissued.
What standard guides template protection?
ISO/IEC 24745 is the standard for biometric information protection. It names the properties above, using renewability for the third, and sets out how a system should handle biometric references through their life.
One caution on how this gets quoted. A vendor builds to ISO/IEC 24745. A vendor does not get certified against it, because it is not that kind of scheme. Treat a claimed certification against 24745 as a reason to ask more questions.
How is face tokenization different from encryption?
Encryption is reversible by design. It hides data behind a key, and whoever holds the key gets the original back. That is the right tool when you need the data later, and it moves the risk to key custody rather than removing it.
Tokenization goes one way. The token cannot be turned back into the face, with or without a key, so there is no key whose compromise exposes the original. The trade is that you can never recover the image. For a face, that is the outcome you wanted.
How does SenseCrypt use face tokenization?
SenseCrypt uses patent-pending face tokenization, and each sign-in spends a single-use token. Matching runs on the user's own device. The server never receives a face image or a face template.
That one design choice settles several other questions for you. There is no gallery to breach, nothing useful to subpoena, and no template format to migrate if you change providers later.
One token, one sign-in
A token is spent by the ceremony that created it. Capturing it in transit gives an attacker a value that is already dead.
The match never leaves the device
Comparison happens against material held on the enrolled device. The identity provider sees the outcome of a ceremony, not the biometric that produced it.
No format lock-in
There is no template gallery to export or convert. Changing provider becomes a re-enrollment decision rather than a biometric data migration.
Frequently asked questions
What is face tokenization?
Face tokenization is a method that turns a face into a protected token, not a stored image. The token stands in for the face during a match.
Can someone rebuild a face from a face token?
No. A strong face token is irreversible. A system cannot rebuild the face from the token.
Can a system revoke a face token?
Yes. A revocable token lets a system cancel it and issue a new one. The user does not need a new face.
How does SenseCrypt protect the face?
SenseCrypt uses patent-pending face tokenization. A face becomes a single-use face token. Face matching runs on-device. SenseCrypt stores no face image and no face template.
Related