Windows Inside & Out · Settings & Accounts · Lesson 3 of 5

Sign-in Options and Windows Hello

Set up a PIN, face or fingerprint sign-in, and lock the PC when you walk away.

Setting up a PIN and Windows Hello

Typing a long password every time you open your laptop gets old fast. Windows offers quicker ways to sign in, called Windows Hello. You'll find them in Settings > Accounts > Sign-in options.

There are three main choices:

• PIN. A PIN is a short code you choose, at least 4 digits. You can also allow letters and symbols to make it stronger. Every Windows computer can use one.
• Facial recognition. The computer looks at your face and signs you in. It needs a special camera with an infrared sensor, a kind of light people can't see. A normal webcam won't do.
• Fingerprint recognition. You touch a small sensor, often on the power button or near the keyboard.

If your computer lacks the camera or sensor, the face or fingerprint option shows as unavailable. That is normal. Nothing is broken.

Here is the important part. A Windows Hello PIN only works on this one computer. If someone learns your PIN, they can't use it to sign in to your account from their own computer. They would need your laptop in their hands too. Your password is different. It works anywhere.

Your face and fingerprint data also stay on the device. They are not sent to Microsoft.

On a Mac, the same idea is Touch ID, the fingerprint sensor on many Mac keyboards. Set it up in System Settings > Touch ID & Password.

On the practice computer, set up a PIN and look at the Face and Fingerprint options. Then turn on Dynamic lock.

Why a PIN beats a reused password

A four-digit PIN sounds weaker than a long password. So why does Microsoft recommend it?

It comes down to where each one works. Think of a password as a key that opens your door from anywhere in the world. A Windows Hello PIN is a key that only works while you stand in front of your own door.

Many people reuse the same password on lots of websites. When one of those sites is hacked, criminals try that password everywhere else, including Microsoft. This is called credential stuffing. A PIN is never typed into a website, so it can't leak that way.

A PIN is also protected by a security chip in the computer called the TPM, short for Trusted Platform Module. After too many wrong guesses, the computer locks and makes you wait. Guessing a PIN by trying every number takes far too long.

Still, choose a PIN that isn't obvious. Avoid 1234, 0000 and your birth year.

One more helpful feature is Dynamic lock. It locks your computer when you walk away with your phone. First pair your phone with the computer using Bluetooth, the short-range wireless link used for earbuds and mice. Then turn on Dynamic lock in Sign-in options. When your phone goes out of range, Windows locks the screen about a minute later.

It's a backup, not a replacement. The surest habit is to press Windows+L to lock the screen yourself whenever you step away. On a Mac, press Control+Command+Q.