What Is Windows Hello? Face, Fingerprint, PIN and Shortcut

Windows Hello is the built-in, free way to sign in to Windows 11 and 10 with your face, your fingerprint or a PIN instead of a password. You set it up in Settings → Accounts → Sign-in options, and you can make a one-click desktop shortcut to that page with ms-settings:signinoptions. Here's what almost nobody explains: the same face sign-in is a real cryptographic key locked to your PC when you use a Microsoft account, but on a local account it's only a convenience layer over your password, without that key behind it.

Jake's sign-in password was his shop's name followed by the year he opened it. Every staff member knew it, two former staff members still knew it, and it was written on a sticky note under the till, which, as Ethan pointed out, is the first place anyone looks.

The trigger for change was small and expensive. A part-time helper who had left on bad terms logged in to the shop laptop from the back room one afternoon and deleted a week of repair notes. Rebuilding them from receipts took Jake most of a Sunday, and he figured his time was worth about $300 of the week's turnover.

"You don't need a better password," Ethan said. "You need a sign-in that only works on this laptop and only for you. That's what Windows Hello is. It's been sitting in your Settings the whole time."

This guide covers what Windows Hello actually is, the three ways to sign in with it, how to set each one up on Windows 11 and 10, the shortcuts that take you straight there, why it sometimes refuses to work, how it differs from Windows Hello for Business, and what an IT admin needs to deploy it across a company.

What is Windows Hello, in plain English?

Windows Hello is the sign-in system built into Windows 11 and 10 that lets you prove it's you with something you are (your face or fingerprint) or something you know that only works on this device (a PIN), instead of a password that works anywhere.

The important word is device. When you set up Windows Hello with a Microsoft account, Windows creates a pair of cryptographic keys, a matched private and public key, a bit like a lock and its only key. The private key is sealed inside your PC's security chip, the TPM (Trusted Platform Module), a small tamper-resistant chip whose whole job is to guard secrets. Your face, fingerprint or PIN doesn't get sent anywhere. It only unlocks that key, on that PC.

That's why Microsoft describes Windows Hello as using key-based authentication with no password that could be stolen from a server or phished from you and used remotely. A thief who learns your password can try it from anywhere in the world. A thief who learns your Windows Hello PIN also needs your laptop in their hands.

The local account catch

Here's the part in the opening paragraph. Windows Hello also works with a local account, the kind that exists only on this PC and isn't tied to a Microsoft account. It's still convenient: you still glance at the camera or touch the reader. But on a local account, Windows Hello isn't backed by that public/private key pair, so it doesn't give you the same protection. It's a faster way to enter what is, underneath, your local password.

Microsoft's recommendation is to use Windows Hello with a Microsoft account or a work account for the stronger, key-based version. If you've kept a local account on purpose for privacy reasons, that's a reasonable choice, and Windows Hello still saves you typing. Just don't assume it's making a weak local password stronger.

The three ways to sign in with Windows Hello

Why infrared for faces? An IR camera sees heat and depth patterns that a photo on a phone screen doesn't have, which lets Windows tell a living person from a picture. Microsoft's requirements for face sensors set the false-accept rate, the chance of letting the wrong person in, at under 0.001%, or roughly one in 100,000.

Your face and fingerprint data stay on the PC, and Windows doesn't keep a picture of your face or an image of your fingerprint at all; it stores a mathematical representation of them. That data is kept locally only; it doesn't roam to your other devices and isn't sent to any server. There's no central collection of faces for anyone to steal.

How to set up Windows Hello on Windows 11

Do the PIN first. Windows won't let you add a face or a fingerprint until a PIN exists, because the PIN is what you'll use when the camera can't see you or your finger is wet.

1. Open Settings with Win + I.
2. Go to Accounts → Sign-in options.
3. Under Ways to sign in, select PIN (Windows Hello) → Set up. Confirm your account password, then choose a PIN. A six-digit PIN is a sensible length.
4. Select Facial recognition (Windows Hello) → Set up, and look at the camera until it finishes. If you wear glasses, choose Improve recognition afterwards and scan again without them.
5. Or select Fingerprint recognition (Windows Hello) → Set up, and touch the reader repeatedly as asked. Add a second finger; if you cut one, you'll be glad.

Once face sign-in works, look under Additional settings for Automatically dismiss the lock screen if Windows recognizes your face. With it on, recognizing your face takes you straight to the desktop. With it off, Windows recognizes you and then waits for a key press, which some people prefer in a busy room.

Windows 10

The path and labels are the same on Windows 10: Settings → Accounts → Sign-in options, with the same three Windows Hello entries. Windows 10 reached its end of support in October 2025, so if this PC can run Windows 11, plan the move; your Windows Hello setup doesn't carry across a clean install and you'll enroll again, which takes two minutes.

The shortcut: open Windows Hello settings in one click

The original version of this page was about a desktop shortcut, and it's still handy for anyone who sets up PCs for other people, as Jake now does for customers. Windows Settings pages have addresses that start with ms-settings:, like web links for Settings.

1. Right-click an empty part of the desktop and choose New → Shortcut.
2. In the location box, type one of the addresses from the table below.
3. Select Next, give it a name like "Windows Hello," and select Finish.
4. Double-click it to jump straight to that page.

You can also paste any of these into the Run box (Win + R) without making a shortcut at all. The face and fingerprint addresses only do something on PCs that have the matching hardware.

Windows Hello and passkeys: the same lock for websites

Windows Hello isn't only for signing in to the PC. Websites and apps that support passkeys can use it too. A passkey is a sign-in that replaces a password with a key stored on your device; when a site asks for it, Windows asks for your face, fingerprint or PIN and hands the site a proof, not a password. That's the FIDO2 standard, the open standard for passwordless sign-in that Windows Hello supports.

For Jake, that meant the supplier portal he logs into every morning offered "Sign in with a passkey," and his fingerprint now does the job his reused password used to do. If a website he uses is ever breached, there's no password of his in the pile.

Ethan's view on it was blunt. "Every password you replace with a passkey is one less thing that can leak. Start with your email, because email resets everything else."

Windows Hello not working? The causes in order

When Windows Hello misbehaves, the message usually points to one of these causes. Work down the list; the first ones are the most common and the cheapest to fix.

"We couldn't find a camera compatible with Windows Hello Face"

Your camera isn't an infrared Windows Hello camera. That's hardware, not a setting, and no driver will turn an ordinary webcam into one. The fix is a Windows Hello compatible camera, built in or on USB, or using fingerprint or PIN instead.

"This option is currently unavailable"

The Set up button for face or fingerprint is grayed out. The usual reasons, in order: no PIN has been set up yet; a policy on the PC has turned off biometrics; the camera or reader driver is missing; or Windows can't use the camera because Camera access is off in Privacy & security. Set up a PIN first, then check each of the others.

Face or fingerprint stopped working after an update or a BIOS update

1. In Sign-in options, remove the face or fingerprint enrollment and set it up again.
2. If the option says no compatible device was found, open Device Manager, find the sensor under Biometric devices (or the camera under Cameras), right-click it, choose Uninstall device, and restart so Windows reinstalls the driver.
3. Still failing? Restart the Windows Biometric Service. In an administrator terminal run net stop wbiosrvc and then net start wbiosrvc.

An external Hello camera or fingerprint reader does nothing (Copilot+ PCs)

This one catches people who buy a USB Hello camera for a new laptop. Copilot+ PCs ship with Enhanced Sign-in Security turned on. It protects face and fingerprint data inside a walled-off part of memory, and while it's on, sensors that don't support it are simply not used for Windows sign-in. External camera modules don't support it at all.

On Windows 11 version 24H2 and later, go to Settings → Accounts → Sign-in options → Additional settings → Enhanced sign-in security and turn the toggle off to use a non-compatible external sensor. On version 23H2 the toggle was worded the other way round: Sign in with an external camera or fingerprint reader, which you turn on. Be aware that switching this can remove existing enrollments and passkeys, which you'd then set up again.

"Something happened and your PIN isn't available" or error 0x80090010

These mean the protected container that holds your Windows Hello keys is damaged or can't be read. The fix is to reset the PIN: in Sign-in options select PIN (Windows Hello) → I forgot my PIN, confirm your account, and create a new one. If that's not available from the lock screen, the PIN isn't available guide walks through the deeper fix.

Windows Hello vs Windows Hello for Business

These two names cause more confusion than anything else on this topic, especially for small businesses. Windows Hello for Business is an extension of Windows Hello, not a different product you install. It adds the controls a company needs.

Microsoft counts Windows Hello for Business as two-factor authentication on its own: something you have (the private key protected by the device's security chip) plus something you know (the PIN) or something you are (your face or finger). That's why companies use it to satisfy multifactor sign-in requirements without handing out code-generating apps for every Windows login.

For IT admins: deploying Windows Hello for Business

For a small shop like Jake's, consumer Windows Hello on Microsoft accounts is enough. Once there's a company tenant, a handful of PCs and a compliance question, Windows Hello for Business is the tool. The fleet checklist:

Editions, licensing and trust model

• Editions: Windows Pro, Enterprise, Pro Education/SE and Education support it. Home doesn't.
• Licensing: the entitlement comes with Windows Pro/Pro Education/SE, Enterprise E3/E5 and Education A3/A5. There's no separate Hello license to buy.
• Trust model: choose cloud Kerberos trust, key trust or certificate trust. For Entra-joined and hybrid fleets without an existing PKI, cloud Kerberos trust is the simplest starting point.
• Not supported: Windows Hello for Business doesn't work with Microsoft Entra Domain Services.

Turn it on and set the rules

• Intune: Endpoint security → Account protection, or a settings catalog policy under the Windows Hello For Business category, covering PIN complexity, biometrics and whether a hardware security chip is required.
• Group Policy: Computer Configuration → Administrative Templates → Windows Components → Windows Hello for Business.
• Biometrics on or off: Windows Components → Biometrics → Allow the use of biometrics. If users see "This option is currently unavailable," check this first.

PIN reset that doesn't wipe everything

By default a forgotten Windows Hello for Business PIN is a destructive reset: the user's container, keys and any certificates in it are deleted and provisioned again. Deploy the Microsoft PIN reset service and turn on Enable Pin Recovery (Intune settings catalog) or Use PIN Recovery (Group Policy) to get non-destructive reset, which keeps the keys and changes only the PIN. It requires hybrid or cloud deployments and Microsoft Entra identities; there's no extra licensing for it.

Check a PC's state from the command line

dsregcmd /status

In the User State section, NgcSet : YES means Windows Hello for Business is provisioned for the signed-in user, and CanReset tells you whether non-destructive PIN reset is enabled (DestructiveAndNonDestructive) or not (DestructiveOnly). It's the fastest single check for a "Hello isn't working for this user" ticket.

Plan for Copilot+ hardware

If you're buying Copilot+ PCs, Enhanced Sign-in Security is on by default and external non-compatible Hello cameras won't be used for sign-in. Enhanced Sign-in Security is also a system-level setting: on a shared device, the lowest security posture among users applies, and upgrading a device to it means every user re-enrolls. Decide on peripherals before the purchase order, not after the first "my webcam doesn't work" ticket.

Is Windows Hello safe, and should you use it?

For almost everyone, yes. The strongest reasons are the ones from the top of this page: with a Microsoft account there's no reusable password to steal, the biometric data stays on the device, and the PIN only works on that one PC with built-in protection against guessing.

The honest limits are worth knowing, too. On a local account it's a convenience, not an upgrade. Face recognition doesn't support masks. If someone has your unlocked laptop in their hands, no sign-in method helps, which is what the lock screen and Dynamic lock are for. And Windows Hello protects sign-in, not everything after it; you still want Windows updates, a backup and a BitLocker recovery key saved somewhere safe.

Ethan's summary for Jake's customers fits on a receipt: "Use a PIN, add your fingerprint, sign in with a Microsoft account, and save your recovery key. That's ninety percent of home PC security in five minutes."

Frequently asked questions

If you've put off Windows Hello because it sounded like a gadget feature, that's a completely normal reaction, and it's also the one change I'd make first on any family or shop PC. Set the PIN, add a finger, and take the sticky note off the till. If something on your screen doesn't match what's written here, tell me; pages like this stay accurate because readers do.

Revision note. I first wrote this in December 2016 as a short shortcut tip for the Anniversary Update. I rewrote it in September 2026 for Windows 11 25H2, because the real questions now are about passkeys, Copilot+ PCs and Hello for Business. The parts I'd re-check first next year are the Enhanced sign-in security toggle wording and the passkey settings, since both have changed twice already. If you're setting this up for a parent or a small team, be patient with the first enrollment; everyone looks at the camera wrong the first time.