What is Windows Hello? Definition, AAGUID and Role in WebAuthn

Windows Hello is a biometric-based technology that allows Windows users to securely access their devices and online services using e.g. facial recognition, fingerprints or PINs instead of traditional passwords. This method offers enhanced security and convenience, integrating seamlessly with Windows devices to provide a user-friendly experience while maintaining high security standards. A prerequisite for Windows Hello is a trusted platform module (TPM) where the private keys of passkeys are also stored.

For WebAuthn operations, Windows Hello utilizes the following Authenticator Attestation Global Unique Identifiers (AAGUIDs):

• 08987058-cadc-4b81-b6e1-30de50dcbe96
• 9ddd1817-af5a-4672-a2b9-3e3dd95000a9
• 6028b017-b1d4-4c02-b4b3-afcdafc96bb2

These identifiers are used to identify Windows Hello as an authenticator in passkey-/ WebAuthn-based systems. Read more about this in the article about AAGUID.

---

• Offers a password-free sign-in option to unlock your devices.
• Uses biometric data for a more personal and secure user authentication experience.
• Supported by hardware such as infrared cameras and fingerprint readers.

Windows Hello enables users to sign into their Windows devices more personally and securely. Here are the steps to set it up:

1. Access Settings: Go to Start > Settings > Accounts > Sign-in options.
2. Choose Your Sign-in Option: You can select from facial recognition, fingerprint recognition, or a PIN.
3. Follow On-screen Instructions: Set up the chosen method by following the guided setup process.

Windows Hello for Business extends the basic features of Windows Hello with added enterprise-grade security. It is designed to meet organizational security and compliance needs. See also our blog post on Microsoft Entra passkeys.

• Authentication: Supports enterprise and cloud-based services, enhancing security with two-factor authentication and built-in brute force protection.
• Security Features: Utilizes the TPM to store credentials that cannot be extracted safeguarding against external threats.

---

Windows Hello is a secure, biometric-based technology that allows users to sign in to their Windows devices using facial recognition, iris scans, or fingerprints.

Windows Hello enhances security by using biometric data, which is way more difficult to crack than traditional passwords. By requiring the device and a second factor (e.g. biometrics, PIN, …) Windows Hello provides two-factor authentication and resists brute-force attacks.

Windows Hello is available on most modern Windows devices (Windows 10 and Windows 11) that have the necessary hardware like infrared cameras or fingerprint readers.

Windows Hello for Business provides robust security features, such as device attestation and certificate-based authentication, making it suitable for enterprise environments seeking to enhance security and compliance. See also our blog post on Microsoft Entra passkeys.