Education · · 3 min
Template protection: why a biometric template is not a photo
Irreversible templates and cancelable biometrics let systems verify identity without storing a reusable image — a cornerstone of privacy-by-design biometrics.
A common worry about biometrics is the “honeypot”: a central database of faces or eyes that, once breached, can’t be reset like a password. Template protection is the set of techniques designed to make that fear obsolete.
First, modern systems store a template, not an image. An iris is encoded into a binary feature vector that is not meant to be reversible into the original eye picture. Comparisons happen on these templates.
Second, “cancelable biometrics” apply a secret, repeatable transform to the template before storage, so the stored data is specific to one system and can be revoked and re-issued if compromised — without re-enrolling the person’s actual iris. The ISO/IEC 24745 standard on biometric information protection codifies these properties: irreversibility, unlinkability and renewability.
Regulators increasingly expect this by design. The UK’s ICO, for example, guides organisations to protect biometric data with encryption, access control and template-protection methods. Done well, a system can confirm identity while ensuring a leaked database reveals no usable biometric.