Biometric Authentication
Bind accounts to real people.
Helix uses the human voice to tie a real person to an account in about four seconds. Zero biometric data leaves the device which means zero compliance overhead.
The problem
Authentication is broken for the AI era.
Login factors prove strings, numbers, or devices, not people.
Passwords
The password is not a weak factor. It is the attack surface.
Catches synthetic and deepfake voices instantly, so you know a real person is on the other end.
SMS one-time codes
A code proves a number, and numbers change hands
The FBI logged more than $68 million in SIM-swap losses in 2021, the year one-time codes were delivered to the attacker's phone instead of your user's. The code still arrived. It just wasn't your user reading it.
MFA itself
MFA security can be bypassed for the right price
Barracuda found MFA bypass in 48% of the phishing attacks it tracked through 2025. The bypass is off the shelf: the number of known phishing kits doubled over the year, and 90% of high-volume campaigns ran on a kit somebody else built and sold.
The problem
Attackers rent devices. They cannot rent people.
Every factor in a normal login stack proves something other than a person. A password proves a string. An SMS code proves a number. A passkey proves a device.
Attacker Cost Today
$0.08
a phone-verified Meta, Grindr or Shopify account
$0.10
an X or Instagram account
$0.10
an SMS verification in the UK. Twenty-six cents in the US.
Cambridge researchers spent a year pricing this market. Devices go by the hour, residential proxies by the gigabyte, eSIMs and numbers by the unit. All rented, all disposable, all running at the same time.
With
One live human
speaking, at the moment of the action
Recruited and paid
and awake when the challenge fires
Spent once
the same voice collides on the next signup
There is no bulk rate on people. A thousand accounts stops being a budget line and becomes a thousand recruited humans, each one a payment trail, a working hour, and a hard ceiling on throughput.
How it works
Two seconds of speech.
The user reads a short phrase. The SDK builds the voice template on the phone, matches it in the secure enclave, and hands your server one signed verdict without audio or PII.
Why on-device matters
Server-side biometrics are a liability.
Server-side biometrics are a liability. Facebook paid $650 million to settle one biometric privacy class action. Helix keeps the data on the user's device, so you never hold it.
How it works
Capture
a short phrase, about two seconds, on any device with a microphone
Verify
Template computed and matched in the device's secure hardware, never uploaded.
Prove
your server gets one signed verdict and a stable identity handle
- Passive liveness rejects replays and synthetic voices
- No audio uploaded, no template uploaded, no voice data retained — not by us either
- No selfies, ID uploads, or cameras required.
- Open proof format — audit any verification
Cross-account enforcement
One person. One account.
Strict mode
One human, one account
Best for signup: a server-side voiceprint hash stops the same human enrolling twice.
Soft signal
Collision detection
Best for transactions and trust scoring: flags a match against an existing identity and lets you block, review, or just log it.
Device only.
Pure on-device mode
Default everywhere else: binding, liveness, and signed proofs, nothing stored — no new disclosure, but it can't flag a repeat human.
Drop the tag on any page
<script src="https:// cdn.jsdelivr.net/ npm/ @helix-id/ browser@0/ dist/ helix.iife.js"></script> Enroll once at signup
Helix.open({ startUrl: "/helix/ enroll", onSuccess: saveUser }); Verify on any high-risk surface
Helix.open({ startUrl: "/helix/ verify", onSuccess: grant });
Your server signs each start with @helix-id/node.
Bind your users. End takeover.
We'll integrate Biometric Authentication into your highest-risk flow in under a week. No PII touches your servers. No passwords to lose.
The Helix stack
Also available within a single integration.
Three products, one SDK. Add Synthetic Detection and Age Assurance on the same tag you dropped for MFA.
