instantpwa
Help centre

Answer

Can a PWA use Face ID or Touch ID?

Short answer

Yes. The Web Authentication API (WebAuthn) lets a PWA prompt for the device’s built-in biometric authenticator — Face ID and Touch ID on Apple devices, Windows Hello on PC, or a fingerprint sensor on Android — to register or verify a user without ever handling the raw biometric data, which stays on-device. It is widely supported across modern Chrome, Safari, Edge and Firefox.

By InstantPWA engineering·Reviewed July 25, 2026

How it works

The site never sees fingerprint or face data — the OS authenticator verifies the user locally and returns a signed cryptographic credential to the page.

Common use case

Passwordless login (passkeys) and step-up authentication for sensitive actions like payments, without needing a native app.

Support

Broadly supported in Chrome, Safari, Edge and Firefox on both desktop and mobile as of 2026.

Sources

Related
What is a passkey and can a PWA use one?
A passkey is a phishing-resistant credential built on the WebAuthn standard that replaces passwords: it is a cryptographic key pair, unlockable with the device’s biometric sensor or PIN, that can sync across a user’s devices via their platform account (Apple iCloud Keychain, Google Password Manager). A PWA can offer passkey sign-in using the same navigator.credentials API as any website — no native app is required.
Can PWAs accept payments?
Yes. A PWA can accept payments through any standard web checkout — Stripe, PayPal, Adyen — and can also use the native Payment Request API to surface Apple Pay on iOS 16.4+ and Google Pay on Android. There is no App Store 30% cut because payments run through the web, not through a native store SDK.
What is the Idle Detection API?
The Idle Detection API lets a page detect, with the user’s permission, whether they have been idle (no keyboard/mouse/touch activity) for a specified threshold or have locked their screen — commonly used by chat and collaboration apps to automatically show an "away" status. It requires an explicit permission prompt and is supported on Chromium browsers only.
What is the Web Locks API for?
The Web Locks API lets scripts across multiple tabs, workers or a service worker of the same origin coordinate exclusive or shared access to a named resource, so only one context runs a given operation at a time — for example, preventing two open tabs of a PWA from both triggering the same background-sync network request simultaneously.
What is the app install banner (mini-infobar)?
The mini-infobar is a small automatic prompt Chrome for Android can show at the bottom of the screen once a site meets install criteria and engagement heuristics, offering a one-tap install without opening the browser menu. Developers can call preventDefault() on the beforeinstallprompt event to suppress it and instead show their own custom "Install" button, triggering the native dialog later at a more relevant moment.