Face Biometric

Face Biometric

Introduced in v1.7, hardened in v1.7.1 (WebAuthn PRF vault, ArcFace, anti-spoof + liveness).

Register and verify face biometric descriptors for visual rights protection — 100% browser-based, nothing is uploaded.

Overview

Face Biometric lets creators register a biometric descriptor of their face and later verify whether a presented photo matches the registered descriptor. It is designed for visual rights protection: proving that the person in a photo is (or is not) the registered rights holder.

The entire pipeline — detection, descriptor extraction, registration, and matching — runs locally in your browser via the @vladmandic/human models (SSD / Tiny Face Detector, facial landmarks, recognition embeddings, WebGL backend). No image, descriptor, or biometric data ever leaves your device.

Features

Capability	Description
Face detection	Detects faces with @vladmandic/human models (SSD for accuracy, Tiny for speed)
Descriptor registration	Extracts a recognition embedding from a detected face and stores it locally
Verification / matching	Compares a presented photo's embedding against registered descriptors (distance + threshold)
WebAuthn PRF vault (v1.7.1)	Registered descriptors are encrypted with a WebAuthn PRF-derived key — replaces the old passphrase storage; passkey can be auto-registered during onboarding
Session-scoped consent (v1.7.1)	Biometric consent is granted per browser session and must be re-confirmed after it expires
Anti-spoof + liveness (v1.7.1)	Presentation-attack checks and liveness signals gate registration and verification
ArcFace ONNX (v1.7.1)	ONNX recognition path alongside the Human.js embeddings
BioHash + fuzzy matching	BioHash and fuzzy extractor tests cover template comparison edge cases
Visual rights protection	Confirm whether the person in a photo matches the registered rights holder
Privacy-first	All biometric data stays in your browser — no server, no uploads, no tracking

Browser Support

Models are loaded from a CDN and run with a WebGL backend when available (CPU fallback included). The tool shows a clear notice when a required capability is unavailable. WebAuthn PRF requires a platform authenticator (Windows Hello, Touch ID, Android biometrics); without one, the tool falls back to local-only storage with a visible warning.

Usage

1. Open the Face Biometric page
2. Register — upload or capture a photo containing a face; consent is confirmed for the session; the encrypted descriptor is computed and stored locally (IndexedDB, PRF-sealed)
3. Verify — upload the photo to check; the tool compares descriptors and shows the match result

First run downloads the detection/recognition models (cached afterwards). All processing is local (client-side).

Architecture

File	Purpose
Face_Biometric/face_engine.js	Face detection (@vladmandic/human) + descriptor extraction + matching
Face_Biometric/face_registry.js	Persistence of registered descriptors (IndexedDB-backed store)
Face_Biometric/face_crypto.js	WebAuthn PRF vault — descriptor encryption/sealing
Face_Biometric/face_antispoof.js / face_liveness.js	Presentation-attack and liveness checks
Face_Biometric/face_embed_onnx.js	ArcFace ONNX recognition path
Face_Biometric/face_ui.js	UI handlers for register/verify flows
Style/pages/face-biometric/index.html	Standalone MPA page

Testing

Dedicated suites cover engine, registry, crypto/WebAuthn, VC, UI, biohash, fuzzy matching, liveness, anti-spoof, camera, alignment, and the ONNX embedder (13 test files: face_engine_test.js, face_registry_test.js, face_crypto_test.js, face_vc_test.js, face_ui_test.js, face_biohash_test.js, face_fuzzy_test.js, face_liveness_test.js, face_antispoof_test.js, face_camera_test.js, face_align_test.js, face_webauthn_test.js, face_embed_onnx_test.js).

npm run test:face          # unit suites
npm run test:e2e-face      # camera E2E suite

Related

• [Home]
• [Iris Biometric]
• [Voice Biometric]
• [Architecture]
• [Security]
• [FAQ]