I couldn't find such a standard which mention about TouchID or fingerprint log in expiration date.

Suppose I have an application and allow users to log in using the fingerprint. I would like to know for how long should I allow my user to log in with fingerprint before I required them to enter the password again. For example, allow the user to log in using fingerprint for 3 months and every 3 months user need to re-enter the password.

Is there such a standard specify about the time length? or it can last forever?

3 Answers 3


In mobile banking apps for Android, use the OS settings for fingerprint login. As mentioned in the answer above (by @Jesse P.) where to use passcode and where to use fingerprint is fully clear.

Now, as you asked for expiration of fingerprint: it should not expire until its settings are not changed or the app where you are using fingerprint is reset.


Why not treat it the same way as a password? It is just another factor of authentication.

NIST800-63B recommends re-authentication at 30 minutes for inactivity or 12 hours of active use. https://pages.nist.gov/800-63-3/sp800-63b.html .


Excerpt from Apple's iOS Security document

You can read the full security document here

  • Already read this but just doubt about like when you logging in to mobile banking service, you can log in with fingerprint and there is no expiration date here.
    – Kong
    Aug 31, 2018 at 3:01
  • 1
    Mobile banking apps (or any app) that use TouchID are using your device's settings and restrictions. They don't have their own TouchID on top of your device's. The same restrictions in the doc apply everywhere.
    – Jesse P.
    Aug 31, 2018 at 3:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .