Biometric Bypass Module

Streamlines face unlock by skipping biometric confirmation in System UI (Android 10+)

Overview

This LSPosed module streamlines face unlock by skipping the confirmation step enforced after biometric authentication. It applies the bypass system-wide — so it works across all apps, including banking or security-sensitive ones.

Android introduced the setConfirmationRequired(false) flag in Android 10 to support passive authentication flows (e.g., face unlock without requiring a tap). Since most apps don’t disable confirmation explicitly, Android defaults to requiring a manual tap, turning face unlock into a two-step chore.

This module ensures the confirmation step is skipped across all biometric flows, regardless of app implementation.

How it Works

Android 10 (API 29) added support for passive biometric flows via the setConfirmationRequired(false) flag in the BiometricPrompt API. This allows apps to skip the “tap to confirm” step after face unlock — but only if:

• The app explicitly sets setConfirmationRequired(false)
• The biometric method is classified as Class 3 (strong) (e.g., secure face unlock on Pixel 8+)

Most apps don’t set this flag, and even when they do, some components still enforce the confirmation dialog.

This module hooks System UI directly to eliminate that dialog, simulating the intended behavior system-wide, no matter what the app does.

Visual Comparison

Default Behavior: Face unlock with manual confirmation required.


Module Enabled: Face unlock with automatic confirmation bypass.

Compatibility

• Android Versions: 10 and up (API 29+)
• ROM Support: AOSP-based ROMs, Pixel, and other close-to-stock systems
  OEM ROMs (e.g. MIUI, OneUI) are not tested and probably won’t work due to heavy modifications
• App Support: Works globally, including banking and security-sensitive apps by applying the bypass system-wide

Installation

1. Install LSPosed
2. Download and install the module APK
3. In LSPosed, enable the module and apply it to System UI
4. Restart System UI or reboot the device

Legacy Xposed Support (Archived)

These branches are unmaintained and only exist for migration or historical reference:

• Legacy Xposed - Java
• Legacy Xposed - Kotlin

Risks

Bypassing confirmation reduces friction and security. If someone spoofs your face or waves your phone at you while you’re asleep, they get in. Use responsibly.

Contributing

Pull requests are welcome. Issues too.

License

MIT. Use it, fork it, misconfigure it.
If your cat unlocks your phone and sends crypto to North Korea, that’s on you.