Biometric Performance Simulator

Biometric Performance Simulator: FAR, FRR and EER

Pick a biometric modality, drag the sensitivity threshold, and watch the false accept rate and false reject rate move in opposite directions. The chart plots both curves across the full threshold range, marks the crossover point where they meet, and shows a reference line at whatever setting you have chosen. A second chart compares the crossover error rate of five modalities side by side, and the whole analysis exports to PDF with the settings, the comparison table, and a deployment recommendation.

The point of the tool is to make one idea concrete: in any biometric system there is a single knob, and turning it does not make the system better. It moves error from one category to the other. Everything else — procurement decisions, user complaints, security incidents — follows from where you set that knob and whether you understood the trade you were making.

The Three Numbers That Matter

FAR — False Accept Rate. The proportion of impostor attempts the system wrongly accepts. This is the security failure: someone who should not get in, gets in. In the ISO/IEC 19795 vocabulary the equivalent matching-level measure is FMR, false match rate. A FAR of 0.01% means one impostor attempt in ten thousand succeeds.

FRR — False Reject Rate. The proportion of genuine attempts the system wrongly rejects. This is the usability failure: the right person is turned away and has to try again or find a human. The matching-level equivalent is FNMR, false non-match rate. FRR is what generates helpdesk tickets, queues at the door, and pressure to disable the system.

EER — Equal Error Rate, also called CER, the crossover error rate. The single point at which FAR and FRR are equal. It is the standard headline figure for comparing modalities and algorithms, because it collapses the whole curve into one number that does not depend on how a particular deployment is tuned. A lower EER means a fundamentally better discriminator.

How the Threshold Ties Them Together

A biometric matcher does not answer yes or no. It produces a similarity score between the presented sample and the stored template, and the system compares that score to a threshold. Genuine attempts and impostor attempts each produce a distribution of scores, and those two distributions overlap. That overlap is the entire problem — if they were cleanly separated, any threshold in the gap would give perfect accuracy.

Because they overlap, the threshold slices through both:

• Raise the threshold (demand a closer match) and fewer impostors clear it, so FAR falls. But more genuine users with a slightly imperfect sample — a dry finger, poor lighting, a head cold — also fail to clear it, so FRR rises.
• Lower the threshold and genuine users sail through, so FRR falls, while more impostors also clear it, so FAR rises.

They always move in opposite directions. This is the fundamental relationship, and it is why “how accurate is it?” is not a well-formed question about a biometric system until you say at what operating point.

The simulator models this with a pair of exponential curves anchored on the modality’s crossover rate. Writing e for the crossover error rate, k for a modality-specific steepness constant, and t for the threshold on a 0–100 scale:

FAR(t) = e × exp(−k(t − 50))
FRR(t) = e × exp(+k(t − 50))

At t = 50 the exponents vanish and both rates equal e — that is the crossover, marked on the chart. Move ten points up and, for a modality with k = 0.05, FAR is multiplied by exp(−0.5) ≈ 0.61 while FRR is multiplied by exp(0.5) ≈ 1.65. The product FAR × FRR stays constant, which is a compact way of saying the threshold redistributes error rather than removing it. It also means the two rates are reciprocal about the crossover: whatever factor you divide one by, you multiply the other by.

This is a smooth idealisation. Real systems produce ragged empirical curves measured from actual test corpora, and their DET (detection error trade-off) plots have kinks and plateaus. The shape and the direction of the trade are right; treat the specific figures as illustrative rather than as vendor specifications.

The Five Modalities

A two-hundred-fold spread separates iris from voice at the crossover, but that ordering is not a procurement ranking. Voice is the only one of the five that works over a telephone call. Facial recognition is the only one that works without the subject doing anything. The right question is which modality is accurate enough for the risk, given the channel, the hardware budget, and the population using it.

Choosing an Operating Point

Set the threshold from the cost of each error type, not from a preference for big numbers:

• High threshold (above ~60). Security dominates. Appropriate for data centre cages, vaults, classified areas, and high-value transactions. Expect legitimate users to be rejected regularly, and provide a fallback that does not undermine the control — a second factor or an attended process, not a shared PIN taped to the reader.
• Near the crossover (~50). A balanced default for general workplace access where both errors carry moderate cost.
• Low threshold (below ~40). Convenience dominates. Reasonable for unlocking a personal device that also has a passcode, or for a turnstile that only needs to deter casual entry. Accept that impostor success becomes materially more likely.

Two multipliers matter once you leave the single-attempt case. Systems usually allow retries, so the effective FRR per session is much lower than the per-attempt figure — three independent attempts at 5% each leave roughly 0.0125% of users unable to authenticate. The same arithmetic works against you on the FAR side: an attacker who can make thousands of attempts turns a 0.01% per-attempt rate into a near-certainty, which is why rate limiting and lockout matter at least as much as the threshold.

Identification (one-to-many, searching a database of N enrolled subjects) is also far harder than verification (one-to-one, checking a claimed identity). The chance of at least one false match scales roughly with N, so a system that is comfortable verifying 500 employees can produce constant false hits when asked to identify a face against a watchlist of 50,000.

What FAR and FRR Do Not Cover

Both metrics assume a cooperative subject presenting a real biometric. They say nothing about presentation attacks — a printed photograph, a silicone finger, a replayed recording, a deepfake video. Defeating those is the job of presentation attack detection, measured separately under ISO/IEC 30107 as APCER and BPCER. A modality with an excellent EER and no liveness detection can be trivially bypassed, which is the practical reason internal biometrics like palm vein hold up well.

Two other rates are worth asking a vendor about: failure to enrol (the proportion of people whose biometric cannot be captured usably at all — worn fingerprints from manual work are the classic case) and failure to acquire (a capture attempt that yields nothing to match). Both hit real users, appear in no accuracy headline, and need a documented alternative path.

How to Use the Simulator

1. Select a modality to load its crossover rate, curve steepness, strengths, and weaknesses.
2. Drag the sensitivity threshold and read the live FAR and FRR values. The chart shows a reference dot at the crossover and a line at your current setting.
3. Compare modalities on the second chart, which puts all five crossover rates on one axis.
4. Read the Type I / Type II explanation and deployment guidance below the charts, which restates the trade in the language of statistical error types.
5. Export the PDF for a design document or a vendor conversation. It contains your threshold, the resulting FAR and FRR, the crossover rate, the full modality comparison table with accuracy tiers, and a written recommendation matched to your setting.

Related Tools

Access control is one input to a wider risk picture. Score likelihood and impact with the risk matrix calculator, place identity controls in a framework using the NIST CSF 2.0 control mapper, and build the funding argument with the security business case builder. Where biometrics back a password or replace one, the password strength checker covers the factor most systems still fall back to.

Frequently Asked Questions

What is the difference between FAR and FRR?

FAR is the rate at which impostors are wrongly accepted — a security failure. FRR is the rate at which genuine users are wrongly rejected — a usability failure. They move in opposite directions as the matching threshold changes.

What is the equal error rate and why is it used to compare systems?

The EER (or CER) is the point where FAR and FRR are equal. It summarises a whole trade-off curve in one number that is independent of how a specific installation is tuned, which makes it the fairest single figure for comparing modalities or algorithms.

Can I reduce both FAR and FRR at the same time?

Not by moving the threshold — that only redistributes error. Lowering both means shifting the entire curve: a better sensor, a better matching algorithm, better enrolment samples, or combining modalities. That is why multimodal biometrics exist.

What threshold should I use?

It depends on the relative cost of the two errors. High-security environments accept a higher false reject rate to drive false accepts down; convenience-oriented deployments do the reverse. Above roughly 60 on this scale is security-weighted, around 50 is balanced, below 40 is convenience-weighted.

Which biometric modality is most accurate?

Of the five modelled here, iris recognition has the lowest crossover error rate, followed by palm vein, fingerprint, face, and voice. Accuracy is only one criterion — hardware cost, the channel available, spoofing resistance, and user acceptance frequently decide the choice.

Are the numbers in this tool real vendor specifications?

No. They are representative figures used to model the curves and illustrate the trade-off. Real performance depends on the sensor, the algorithm, the enrolment quality, the environment, and the test population. Ask vendors for results measured under ISO/IEC 19795 on a corpus that resembles your users.

Does a low FAR mean the system cannot be spoofed?

No. FAR measures how often a genuine biometric from the wrong person is accepted. It does not measure resistance to a photograph, a mould, or a recording — that is presentation attack detection, reported separately as APCER and BPCER under ISO/IEC 30107.

What are false enrolment and failure to acquire?

Failure to enrol is the proportion of people whose biometric cannot be captured usably at all; failure to acquire is a capture attempt that produces nothing matchable. Neither appears in FAR or FRR, both affect real users, and both need a documented alternative authentication path.

Why is one-to-many identification harder than one-to-one verification?

Because every enrolled record is another chance for a false match. The probability of at least one false hit grows roughly in proportion to the size of the gallery, so a threshold that is fine for verifying a claimed identity can produce frequent false matches when searching a large database.

What does the PDF export include?

The selected modality and its description, your threshold with the resulting FAR, FRR and crossover rate, a comparison table of all five modalities with accuracy tiers, and a deployment recommendation written to match the threshold you chose.