Does Face ID or my fingerprint get sent when I sign?

What happens when you tap Sign with your passkey

Signing with Attest uses a passkey: a cryptographic key only you control, unlocked with Face ID, Touch ID, Windows Hello or the device PIN. Passkeys follow the W3C's Web Authentication standard (WebAuthn) and the FIDO Alliance's specifications, and the step that uses your face or finger happens entirely on your side.

1. Attest prepares the exact statement you are about to sign, naming the document and your entries by their fingerprints (SHA-256 hashes, short codes calculated from a file's contents). How a passkey signs a document shows the statement in full.
2. Your browser asks for your passkey for attest.datahubz.com, with the statement's SHA-256 as the WebAuthn challenge: the passkey signs it together with the website's address.
3. Your device asks for Face ID, Touch ID, Windows Hello or its PIN, and checks your face or finger against what it already holds. In Chrome on a computer, a passkey saved in Google Password Manager can ask for your Google Password Manager PIN instead, which Google says is "requested every time you log in to a website where you have a passkey saved in Google Password Manager". WebAuthn calls this user verification: "The technical process by which an authenticator locally authorizes" the use of a passkey.
4. If it matches, the passkey signs, and the response carries a flag that means "the user is verified".
5. Your browser sends Attest the signature and the data around it. Attest checks the signature against your passkey's public key, refuses it unless the verified flag is set, and records it.

What the standards, Apple, Google and Microsoft say

The rule that biometrics stay put is written into the standard. WebAuthn's section on biometric recognition says:

Biometric data is not revealed to the WebAuthn Relying Party; it is used only locally to perform user verification authorizing the creation and registration of, or authentication using, a public key credential.

A "Relying Party" is the website, Attest in this case. The same section adds that "a security breach at a Relying Party cannot expose biometric data for an attacker to use for forging logins at other Relying Parties". The FIDO Alliance says biometric information "is never sent to any remote server", and that "the server only sees an assurance that the biometric check was successful."

The platforms say the same about their own sensors:

• Apple, Face ID: "Face ID data doesn't leave your device, is never available to iOS or iPadOS, apps, or Apple, and is never backed up to iCloud or anywhere else." And: "Apps are notified only as to whether the authentication is successful."
• Apple, Touch ID: fingerprint data is "never stored on Apple servers, it's never backed up to iCloud or anywhere else, and it can't be used to match against other fingerprint databases."
• Google: "Your biometric data, used for fingerprint or face unlock, stays on your device and is never shared with Google."
• Microsoft, Windows Hello: "Windows stores biometric data that is used to implement Windows Hello securely on the local device only. The biometric data doesn't roam and is never sent to external devices or servers." Microsoft's passkey page adds that "any biometric information used in the authentication process remains on the user's device and isn't transmitted across the network or to the service."

Exactly what Attest receives, and what it never does

Item	Sent to Attest?	What it is
Your face or fingerprint, or any template of it	Never	Checked inside your device
Your device PIN or passcode	Never	Checked inside your device
Your passkey's private key	Never	WebAuthn expects it "to never be exposed to any other party, not even to the owner of the authenticator"
Your passkey's secret that unlocks your Attest key	Never	It stays in your browser and decrypts your private key there
Your passkey's public key	Once, when you set the passkey up	Used to check your signatures. As Apple puts it, "This public key is not a secret"
Your private key, encrypted under your passkey's secret	Once, when you set the passkey up	Ciphertext Attest can't open
The passkey's ID	Each time you sign	Tells Attest which of your passkeys signed
The signature	Each time you sign	Your passkey's signature over the statement you approved
The authenticator data	Each time you sign	The SHA-256 of the website's domain (its RP ID), a counter, and flags such as "user present" and "user verified"
The client data	Each time you sign	The value that was signed and the website it was signed on

When you set up a passkey, Attest also stores a short label naming the type of device and browser, such as "iPhone · Safari", which the Security page shows so you can tell your passkeys apart, and when each passkey was created and last used. The same label appears in the email Attest sends you whenever a passkey is added to your account, so you can tell at once if one isn't yours.

The signature, the passkey's public key and the WebAuthn data are the evidence of your signature. A public certificate shows them, and anyone can re-check them with any WebAuthn library. They show that the statement was signed by that passkey, on Attest, with you verified: nothing about what your face or finger looks like.

What "verified" proves, and what it doesn't

The verified flag shows that the person who unlocked the passkey passed the device's own check. WebAuthn is careful about what that means: "user verification does not give the Relying Party a concrete identification of the user", and some devices "allow multiple natural persons to enroll fingerprints or know the same PIN".

So on Attest, each signature is made by a passkey registered to the signer's email address, and the passkey must confirm the signer was present and verified. Attest confirms control of the email link and the passkey, not a government ID. Two habits keep that evidence strong:

• Keep only your own face and fingerprints enrolled on the devices you sign with.
• Don't share your device PIN.

If you'd rather not use biometrics

You don't have to. The device PIN or passcode works as user verification too: if Face ID or Touch ID isn't set up on an iPhone, Apple says to "enter your device passcode". On a computer without its own passkey, you can use your phone's passkey through the browser's "Use a phone or tablet" option and approve on the phone. How to sign with Face ID, Touch ID or Windows Hello walks through each device.