Almost every phone now offers face or fingerprint unlock, and they’re convenient. But convenience and protection aren’t the same thing, and there’s a meaningful difference between unlocking with your face and unlocking with a passcode. The gap matters most in exactly the moments you’d care about.

The everyday case

For day-to-day use, biometrics are fine, and in one way they help: people will set up face unlock when they’d refuse to type a passcode every time, so it nudges people who’d otherwise use no lock at all. Against a thief who grabs your phone and runs, a fingerprint or face is a solid barrier. If that’s your threat, biometrics with a strong passcode underneath is a reasonable setup.

The case most people miss

The difference shows up when someone can compel you. A face or a fingerprint is something you are, and it can be used without your cooperation. Someone can hold a phone up to your face, or press your finger to the sensor, and in many places the legal protections around being forced to do that are weaker than the protections around being forced to reveal something you know. A passcode lives in your head. It can’t be lifted off you physically, and you keep the choice of whether to give it up. That distinction is why people in higher-risk situations, and a lot of people crossing borders, turn biometrics off and rely on a passcode alone.

What “something you are” really means

The deepest difference between biometrics and a passcode comes down to an old security idea: the distinction between something you are and something you know. A fingerprint or a face is something you are, permanently attached to you, visible to the world, and impossible to change if it’s ever compromised. A passcode is something you know, invisible, changeable, and impossible to extract without your cooperation. Both can unlock a phone, but they fail in opposite ways. You can be compelled to provide what you are far more easily than what you know, and while you can change a leaked passcode in seconds, you can’t change your face. Understanding which category you’re relying on, and when, is the whole game.

The legal landscape, in plain terms

This isn’t only a technical distinction, because the law in many places treats the two differently. Without offering legal advice, the broad pattern in a number of jurisdictions is that compelling someone to reveal something they know, like a passcode, runs into stronger protections than compelling something physical, like placing a finger on a sensor or holding a phone up to a face. The details vary widely by country and are still being worked out by courts, so the safe assumption is simply this: a passcode gives you a meaningful choice in a moment of confrontation that a biometric does not. For anyone who might face a border, a checkpoint, or any situation involving authorities, that difference is worth taking seriously.

The shoulder-surfing trade-off

It’s only fair to note the one place biometrics are stronger: nobody can watch you unlock with your face the way they can watch you type. A passcode can be observed over a shoulder, captured on a camera, or simply guessed if it’s weak, and a thief who saw you enter it before grabbing your phone has everything they need. A fingerprint or face can’t be shoulder-surfed. This is why the honest answer isn’t to always use a passcode but to use the right one for the moment, leaning on biometrics for everyday convenience against casual theft, and switching to a passcode-only state when the threat shifts to someone who might compel you.

A practical middle ground

You don’t have to pick once and live with it. Use biometrics for convenience when your risk is low, and know how to instantly disable them when it isn’t. Most phones can be put into a passcode-only state quickly, and powering the phone fully off does the same thing, since it requires the passcode on next boot. The habit worth building is simple: when you’re walking into a situation where someone might compel you, take a second and lock it down to the passcode. Convenience the rest of the time, control when it counts.

Related reading

• What the Titan M2 Secure Chip Actually Does
• Traveling With a Secure Phone: A Practical Checklist
• How to Choose a Secure Phone: A Threat-Model-First Buyer’s Guide