windowscentral.com
Windows Hello vs. Enhanced Sign‑in Security: Which sign‑in method actually keeps your Windows 11 PC safer, and what’s the difference?
Microsoft’s August 2026 Windows 11 update adds Enhanced Sign‑in Security (ESS) support for external fingerprint readers, extending the company’s most protected Windows Hello experience to PCs lacking built‑in biometric hardware. While Windows Hello already replaces passwords with TPM‑backed cryptographic credentials and stores biometric templates locally, ESS adds a second defensive layer by moving biometric processing into isolated, hardware‑protected environments using Virtualization‑Based Security and TPM 2.0. ESS‑compatible readers contain a secure processor, store templates internally, present a Microsoft‑issued certificate, and communicate with Windows 11 [...]