What is Windows Hello?
Windows Hello replaces password typing at the Windows sign-in screen with a gesture that works only on that device. Its methods are configured in Settings > Accounts > Sign-in options:
- PIN: must be set up before any biometric method can be added, and is the fallback when a sensor fails. It can be longer than four digits and, if allowed, include letters and symbols.
- Fingerprint: needs a compatible fingerprint reader, built into many laptops and keyboards or added by USB.
- Facial recognition: needs an infrared (IR) camera that supports Windows Hello. An ordinary color webcam will not work. The IR camera is part of what makes face sign-in hard to fool with a photo.
Why a PIN can be safer than a password
This point surprises many people. A Microsoft account or domain password works from anywhere, so a stolen password can be used on any computer. A Windows Hello PIN is local: it unlocks a credential stored on that one device, protected by the TPM when one is present, and the PIN itself is never sent over the network or stored on a server. Someone who learns the PIN also needs the physical device. The TPM also limits repeated wrong guesses, which blocks guessing attacks. Biometric data stays on the device too; Windows keeps a mathematical representation of the face or fingerprint, not the image.
Windows Hello for Business
Windows Hello for Business is the managed version for organizations. Users make the same PIN and biometric gestures, but the sign-in proves possession of a key pair or certificate registered with Active Directory or Microsoft Entra ID instead of sending a password. Administrators enable and configure it with Group Policy or an MDM tool such as Intune, and it is a common step toward passwordless sign-in.
Related sign-in features
- Passkeys: Windows can store passkeys for websites and apps and unlock them with Windows Hello.
- Dynamic lock: in Sign-in options, locks the PC automatically when a paired Bluetooth phone moves out of range.
- Passwordless setting: Sign-in options can allow only Windows Hello sign-in for Microsoft accounts on the device, which hides the password option at the sign-in screen.
Troubleshooting
- Face option missing, or Windows reports no compatible camera: the camera lacks an IR sensor or its driver is missing. Check Device Manager under Cameras and Biometric devices and install the manufacturer's driver.
- Fingerprint stops matching: clean the sensor, remove the fingerprint and enroll it again, and check for a driver update.
- PIN rejected or unavailable: choose I forgot my PIN at the sign-in screen, which asks for the account password, or sign in with the password and remove and re-add the PIN in Sign-in options. Clearing the TPM in firmware also invalidates existing PINs, so they must be set up again.
- Options grayed out: a Group Policy or MDM setting controls Windows Hello on that PC.
Windows Hello on the CompTIA A+ exam
Windows Hello falls under Core 2 (220-1202) objective 2.2, which covers Windows sign-in options and OS security settings. Know the three methods (PIN, fingerprint and facial recognition), that face sign-in needs an IR camera, and that a Hello PIN is tied to the device and its TPM rather than sent across the network. Fingerprint and face are "something you are"; the PIN is "something you know" that only works with "something you have", the device. If a scenario asks for a sign-in method on a Windows laptop that resists stolen passwords, Windows Hello is a strong answer.