IBM Patents a Digital Wallet That Shares Encrypted Stand-Ins for Your Biometrics
Instead of transmitting your actual fingerprint or face scan when proving who you are, IBM's new patent describes a system that sends an encrypted stand-in, so your real biometric data never has to leave your device.
What IBM's synthetic biometric credential actually does
Imagine you need to prove your identity online, and the site asks for a fingerprint scan. Today, that scan either gets sent to a server or compared locally, but either way the underlying data exists somewhere it could leak. IBM's patent describes a different approach: turning your biometric into a locked, scrambled token called a synthetic biometric credential, which gets stored in your digital wallet instead of the raw scan.
When you need to verify your identity, your device sends one of these tokens rather than anything that looks like your actual fingerprint or face. The token was created and signed by a trusted issuer (think a bank or government agency), so whoever receives it can confirm it's legitimate without ever seeing your real biometric data.
You can also hold multiple of these tokens and share only the ones relevant to a particular request, which gives you some control over how much you reveal in any given situation.
How the encrypted biometric tokens are issued and shared
The patent describes a system built around what IBM calls synthetic biometric credentials: mathematically transformed versions of a biometric template (your fingerprint pattern, iris scan, or face geometry) that are either encrypted with a private key or run through a one-way hash (a process that scrambles data in a way that can't be reversed).
Here's the flow the patent lays out:
- A trusted issuer device (a government ID system, an employer's HR platform, etc.) creates a set of these synthetic credentials from your biometric data and signs each one with a private key to certify its authenticity.
- Those credentials get stored in a digital wallet on your device, similar to how you might store a credit card or ID card in Apple Wallet today.
- When something asks you to prove your identity, your device selects a subset of the stored credentials that fits the specific request, and transmits only those.
The key technical point is that the synthetic credential can be verified as genuine (because it carries the issuer's cryptographic signature) without revealing the underlying biometric. The verifier checks the math, not the fingerprint itself.
What this means for passwordless identity verification
Biometric data is uniquely dangerous when it leaks: you can change a password, but you can't change your fingerprints. Any system that reduces how often raw biometric data travels across networks is genuinely worth paying attention to. If this approach were widely adopted, a data breach at a verification service would expose scrambled tokens rather than actual face or fingerprint data.
The "subset selection" piece is also interesting from a privacy standpoint. Rather than handing over a single master credential, your wallet can share only the token relevant to the request at hand, limiting what any one party learns about you. Whether this ends up in an IBM product or gets licensed to digital identity platforms remains to be seen, but the core idea fits squarely into the push toward decentralized identity standards that several standards bodies are currently developing.
This is a solid, practical patent addressing a real problem: biometric data is permanent and therefore uniquely risky to expose. IBM isn't reinventing cryptography here, but the combination of selective disclosure, wallet-based storage, and issuer-signed synthetic tokens is a coherent approach that could meaningfully reduce the blast radius of identity-system breaches.
The drawings
6 drawing sheets from US 2026/0220628 A1 · click any drawing to enlarge
Which company should we read for you?
We track 17 companies here. Pro is the same weekly breakdown for any company you choose, delivered privately. Type a name and we'll scope it and send you a quote.
Get one Big Tech patent every Sunday
Plain English, intelligent commentary, no hype. Free.
Editorial commentary on a publicly published patent application. Not legal advice.