Why you should be using Windows Hello to secure your PC

Image: Chris Hoffman / IDG

Modern Windows PCs often include some kind of biometric hardware, mainly in the form of facial recognition (using infrared cameras) or fingerprint scanning. Both of these features let you use Windows Hello for better and more convenient PC security.

Not only are face IDs and fingerprints harder to hack than PINs and passwords, they’re much quicker to input when it comes to unlocking your PC. Signing in a lot faster and you’re better protected and you can use some really cool extra features in Windows Hello.

Keep reading to learn more about what Windows Hello is, why you should be using it, and how to set it up as painlessly as possible. (This applies to both laptops and desktop PCs!)

What is Windows Hello?

Windows Hello is an operating system feature that lets you securely sign into your PC without typing your Windows account password. It supports biometrics, so you can sign in with facial recognition or fingerprint scans (as long as you have the requisite hardware).

Windows Hello’s fingerprint scan prompt to unlock 1Password.
Windows Hello’s fingerprint scan prompt to unlock 1Password.Chris Hoffman / IDG

Windows Hello’s fingerprint scan prompt to unlock 1Password.Chris Hoffman / IDG

Chris Hoffman / IDG

But Windows Hello isn’t just for signing in. You can also use Windows Hello to unlock certain applications, like password managers. You can access your password vault without your huge master password.

And if you’ve ditched passwords altogether for passkeys instead, Windows Hello is doubly useful — it integrates with passkeys in web browsers like Google Chrome and Microsoft Edge. You can create a passkey for a website, which is then secured with Windows Hello so that you must authenticate (with your face or finger) to sign in.

Related: How to start using passkeys on Windows

Technically, Windows Hello also includes the PIN login method, but I don’t recommend using that. When security experts talk about Windows Hello, they’re mainly focusing on the more secure biometric options.

For starters, Windows Hello never syncs your facial recognition data, fingerprint data, or even your PIN between your devices or to your Microsoft account. It’s all stored only and entirely on your PC.

Windows Hello’s security relies on the underlying Trusted Platform Module (TPM) hardware that’s found on modern PCs (a required PC component if you want to install Windows 11). The TPM handles the authentication and signing in process, and it’s also used for other things like encrypting and decrypting your computer’s storage.

Related: What is the Trusted Platform Module? Explained

And again, Windows Hello is separate from your Microsoft account. Even if someone were to capture your fingerprint, face, or PIN, they would only be able to use it to log into your Windows Hello-enabled PC and wouldn’t be able to access your Microsoft account. (All of this Windows Hello data is stored securely in the TPM, so hackers can’t access it.)

Windows Hello is also secure against anyone who tries to unlock your PC via facial recognition trickery. For instance, Windows Hello isn’t fooled by someone holding up a photo of your face because Windows Hello facial recognition uses an infrared (IR) camera to ensure it’s looking at a real live person. That’s why you need a Windows Hello-compatible IR camera to even start using Windows Hello facial recognition.

Of course, Windows Hello isn’t perfect. Fingerprint scanners are still vulnerable to James Bond-style attacks where someone lifts your fingerprint off a glass and uses that to sign into your PC. (CEOs of major companies and political dissidents may want to be extra careful.) But it’s more than secure enough for the average person, especially since those spy movie-style attacks require access to both your physical laptop and a carefully duplicated copy of your fingerprint.

Facial recognition vs. fingerprint reader: Which method is better?

If your PC only has one or the other, you don’t really have a choice — use whichever Windows Hello method is available to you. If it has both, then you can actually use both. But if you only want to use one, then it ultimately comes down to personal preference.

I prefer facial recognition, especially on laptops. It works surprisingly well and the experience is seamless. As soon as you open your laptop, Windows scans your face with the IR camera, then signs you in. It all happens so quickly — an automatic sign-in without you having to press anything at all. Just open up your laptop.

And some newer, higher-end laptops even have “presence sensing” hardware that detects when you physically sit down in front of your PC. It then automatically wakes up and uses the IR camera to sign you in via Windows Hello. A secure way to sign into your laptop just by sitting down in front of it? It’s as awesome as it sounds.

Of course, fingerprint scanning also works almost as smoothly, especially if the fingerprint scanner is integrated into the power button. In that case, you go to press the power button to wake up the laptop, then keep your finger resting on the fingerprint reader to unlock your machine.

So, again, it’s a matter of personal taste.

Note: When you’re shopping for a laptop, make sure to check out the biometric options it offers — whether it has a Windows Hello-compatible IR camera, a fingerprint scanner, both, or neither. We always mention these features as a matter of course in our laptop reviews here at PCWorld.

How to set up Windows Hello

Windows normally prompts you to set up Windows Hello when you first sign into a new PC, but you probably skipped it when you were setting everything up. That’s okay, because you can always configure later.

If you’d like to set up Windows Hello (or maybe just see which biometric options are available on your laptop), you can do so from the Settings app on either Windows 11 or Windows 10.

To configure Windows Hello, open the Settings app, select Accounts, and select Sign-in options. You’ll see options for configuring your machine’s available sign-in methods under Ways to sign in.

Note: If your PC doesn’t have a certain option, like facial recognition or fingerprint scanning, then you’ll see the message: “This option is currently unavailable.”

Setting up Windows Hello options in Windows 11.
Setting up Windows Hello options in Windows 11.Chris Hoffman / IDG

Setting up Windows Hello options in Windows 11.Chris Hoffman / IDG

Chris Hoffman / IDG

Here, you can also tweak and configure facial recognition and fingerprint recognition. For example, you might want to scan your face in different lighting conditions, train Windows to recognize your face with and without glasses, or add an additional fingerprint.

Some applications will also prompt you to authenticate with Windows Hello. For example, the 1Password password manager lets you quickly use Windows Hello to unlock your password vault.

How to add Windows Hello to any PC

Not all PCs come with Windows Hello biometrics. Some laptops just don’t include Windows Hello hardware, which can be one way to keep costs down on otherwise expensive builds (e.g., gaming laptops).

Also, if you’re building your own desktop PC, you won’t get Windows Hello unless you incorporate compatible hardware.

If you don’t have Windows Hello but you want it, the easiest and most effective option is to buy a Windows Hello-compatible webcam. And not just one that has IR technology, but one that’s a high-quality webcam in its own right so you look good in video calls and meetings.

Related: The best webcams for Windows Hello

The other option is to hunt down a fingerprint scanner that plugs into your computer via USB. Be sure to pick one that explicitly states compatibility with Windows Hello! I’ve personally used this inexpensive Kensington USB fingerprint reader in the past, and I have no complaints despite it only costing $18 on Amazon.

Take the next step with Windows Hello

Windows Hello is far from mandatory. You can certainly use your PC without it — and along with millions of other PC users who have gotten by without biometrics thus far, you can probably get by just fine.

But biometric PC security is absolutely a step up, not only in terms of protection but also convenience. The first time you open your laptop or sit down at your desktop PC and you’re automatically signed in with facial recognition? It’s almost surreal. After that, it’s tough to go back to typing a PIN every time you need to sign back in.

Whenever I review a laptop and it turns out the manufacturer skipped Windows Hello hardware to keep costs down, I think it’s a real shame. It’s just an awesome feature that makes using Windows PCs a lot nicer.

I highly recommend you get Windows Hello hardware in your next laptop, or pick up a compatible webcam for your desktop PC.

Further reading: Is Windows 11’s built-in antivirus enough?

Author: Chris Hoffman, Contributor

Chris Hoffman is the author of Windows Intelligence, a free email newsletter that brings the latest Windows PC news, trips, and tricks to inboxes each week. He’s also the former editor-in-chief of How-To Geek and a veteran tech journalist whose work has appeared in The New York Times, PCMag, Reader’s Digest, and other publications.

Report