Windows Hello convenience PIN turns out to be less secure than I thought?

pseymour · Apr 4, 2026

What @itsme1 and @Marcus Vinicus said about Windows Hello using the TPM is correct. Here's the Microsoft page, which says that "a Windows Hello PIN is backed by a Trusted Platform Module (TPM) chip..."

Windows Hello for Security | Microsoft Windows

Explore Windows 11 security with Windows Hello. Get instant access to your Windows devices using a PIN, facial recognition, or fingerprint with Windows Hello.

www.microsoft.com

Convenience PINs are from the era before Windows Hello, so they're not even relevant, unless you're running some super old build of Windows 10, in which case you have more important issues.

echo2446 · Apr 4, 2026

Marcus Vinicus said:
I've assembled table after doing some research.

Comparing Windows Hello vs. Windows Hello for Business | TechTarget

Organizations should learn the differences between Windows Hello and Windows Hello for Business to make sure they deploy the right one.

www.techtarget.com

Although I am not taking the OP's position (about local account login not being protected by TPM on consumers' computers), the article above does contain information that supports the OP's concern:

Authentication with Windows Hello

When enabling Windows Hello, users must first authenticate to their Microsoft accounts or to an identity provider that supports Fast Identity Online (FIDO) 2 authentication. Users can also authenticate to a local account, but this approach doesn't offer the same level of security because it's not backed by an asymmetric key.

The quoted information pretty much says that unless the authentication mechanism supports asymmetric keys (like FIDO2 with an online Microsoft account), local account authentication—presumably not supporting FIDO2—may not have the same kind of protection.

The question is: does Microsoft local account authentication on consumer devices currently support asymmetric keys, which would invalidate the TechTarget (May 2025) article above?

pseymour · Apr 4, 2026

echo2446 said:
The quoted information pretty much says that unless the authentication mechanism supports asymmetric keys (like FIDO2 with an online Microsoft account), local account authentication—presumably not supporting FIDO2—may not have the same kind of protection.

The question is: does Microsoft local account authentication on consumer devices currently support asymmetric keys, which would invalidate the TechTarget (May 2025) article above?

That's what I said in post 7. Local accounts, using passwords, are not using asymmetric keys. That has nothing to do with whether Windows Hello PINs use the TPM and asymmetric keys, which is what was claimed in post 1 and repeated afterward.

BruceR · Apr 4, 2026

Marcus Vinicus said:
With the Personal vs Business variant's, one major difference is Business uses MFA.

I don't think there's a difference there. Personal includes MFA.

Marcus Vinicus · Apr 5, 2026

BruceR said:
I don't think there's a difference there. Personal includes MFA.

Windows Hello Personal currently doesn’t use MFA for the Windows desktop sign‑in.
Business/Entra ID enforces MFA as part of the identity system.

With a Microsoft Account (Personal), Windows Hello is a single‑step sign‑in. There’s no second factor prompt — it’s just one action.
With Business/Entra ID, MFA is part of the cloud identity flow: password → second factor → token → SSO.

Cloudflare defines MFA as follows.

"Multi-factor authentication checks multiple aspects of a person's identity before allowing them access to an application or database, instead of just checking one. It is much more secure than single-factor authentication."

What is multi-factor authentication (MFA)?

Multi-factor authentication checks multiple aspects of a user's identity, instead of just a password. Learn about MFA types, such as two-factor authentication.

www.cloudflare.com

NormanF · Jun 19, 2026

You can remove the password, hide the password button on the lock screen and sign in with your PIN. Windows is passwordless with an added layer of security.

xiojin · Jun 19, 2026

Window 8 and 10 could use pin without TPM but used it if present, as windows 11 wont run without a TPM it is not an question anymore. I don't believe tpm is reserved to hello for business, nothing indicate that. Not sure what about is the asymetrical thing but anyways pc is protected by bitlocker with tpm+pin at boot so not sure what would be the benefit for physical attack protection but maybe if you run a malicious app trying to brute-force admin pin?

glasskuter · Jun 19, 2026

xiojin said:
windows 11 wont run without a TPM

That is incorrect. A lot of folks who do not have tpm have installed Windows 11 using non-compliant hardware work-around. The ONLY Windows 11 requirement for which there is NO work-around is if a cpu does not provide the sse4.2 instruction set.

HeavyHemi · Jun 19, 2026

glasskuter said:
That is incorrect. A lot of folks who do not have tpm have installed Windows 11 using non-compliant hardware work-around. The ONLY Windows 11 requirement for which there is NO work-around is if a cpu does not provide the sse4.2 instruction set.

Yup... I have no form of TPM at all and I use a PIN.

xiojin · Jun 19, 2026

glasskuter said:
That is incorrect. A lot of folks who do not have tpm have installed Windows 11 using non-compliant hardware work-around. The ONLY Windows 11 requirement for which there is NO work-around is if a cpu does not provide the sse4.2 instruction set.

Right i just mean they are not supposed to do so, so any unsupported things they do should not matter for the discussion?

gunrunnerjohn · Jun 20, 2026

xiojin said:
Window 8 and 10 could use pin without TPM but used it if present, as windows 11 wont run without a TPM it is not an question anymore. I don't believe tpm is reserved to hello for business, nothing indicate that. Not sure what about is the asymetrical thing but anyways pc is protected by bitlocker with tpm+pin at boot so not sure what would be the benefit for physical attack protection but maybe if you run a malicious app trying to brute-force admin pin?

Really? I have Windows 11 Pro installed on a 14 year old computer and I use a PIN.

xiojin said:
Right i just mean they are not supposed to do so, so any unsupported things they do should not matter for the discussion?

Just because it's "not supported by MSC" doesn't mean it doesn't work! The statement was "windows 11 wont run without a TPM" That statement is demonstrably incorrect.

Windows Hello convenience PIN turns out to be less secure than I thought?

Well-known member

My Computer My Computer

At a glance

Well-known member

Authentication with Windows Hello​

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Semper paratus

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

Authentication with Windows Hello

My Computer

My Computer

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer

My Computers