Fingerprint Reader Enrolls But Never Unlocks on Fedora 40? Fix It

Few things are more frustrating than a fingerprint reader that almost works. You place your finger during setup on Fedora 40, the system happily enrolls it, and everything looks perfect. Then you lock the screen, touch the sensor and nothing happens. You try again, a little harder and a little slower, and still nothing. After three failed tries you give up and type your password anyway, wondering why you bothered setting it up at all.

The good news is that this is almost never a broken sensor. If enrollment worked, the hardware, the driver, and the fingerprint service are all talking to each other. The failure usually happens one step later, in the part of the system that actually checks your finger at the login screen, the lock screen, or when you use sudo. This guide walks through each likely cause so you can fix the unlock step without reinstalling anything.

Quick Answer

When a fingerprint enrolls but never unlocks on Fedora 40, the usual cause is that fingerprint authentication is not enabled for the login and lock screens, even though enrollment succeeded. Run sudo authselect enable-feature with-fingerprint and then sudo authselect apply-changes, restart the computer, and enroll your finger one more time. Also clear old enrollments with fprintd-delete first, because a poor-quality first scan is the second most common reason unlocks fail.

How Fingerprint Login Actually Works on Fedora

Enrollment and unlocking are handled by two different parts of the system. Enrollment is done by a background service called fprintd. When you open Settings and add a finger, Fedora asks this service to save a scan of your fingerprint. That part often works straight out of the box on supported laptops from Lenovo, Dell, HP, and Framework.

Unlocking is different. When you sit at the login screen, a system called PAM decides which login methods are allowed. PAM is the gatekeeper for your password, and it must be told that fingerprint checks are allowed too. If PAM was never told, the login screen will never even ask the sensor to check your finger. Enrollment can be perfect, but the unlock prompt simply never uses it. Fedora 40 usually enables this automatically, but the step can be skipped after upgrades, after switching desktops, or when a USB reader is added later.

Step 1: Confirm Your Reader Is Detected

Before changing settings, confirm Fedora can see your reader right now. A reader that worked last month may have disappeared after a kernel update or a BIOS change.

1. Open a terminal from the Activities overview.
2. Run lsusb and look for a line mentioning fingerprint, Synaptics, Goodix, or ELAN.
3. Run fprintd-list $USER to see your device and any enrolled fingers.
4. If no devices are available, run sudo systemctl status fprintd and check for repeated errors.

If it does not appear, check it is not disabled in BIOS settings, and try a full shutdown instead of a restart.

Step 2: Delete Old Enrollments and Enroll Again Properly

A weak first scan is a silent troublemaker. Many people lift their finger too quickly, use only the very tip, or enroll with dry or damp hands. The system accepts the scan, but the saved template is too poor to match reliably later. Start clean:

1. Run fprintd-delete $USER to remove all saved fingerprints for your account.
2. Run fprintd-enroll to start a fresh enrollment for your right index finger.
3. Place the flat pad of your finger, not just the tip, firmly in the center of the sensor.
4. Between scans, lift your finger fully and place it down at a slightly different angle.
5. When enrollment completes, test it right away with fprintd-verify.

If fprintd-verify matches your finger three times in a row, your scan is good and the problem is in the login settings, not the hardware. If it fails even in the terminal, try a different finger, clean the sensor gently with a dry microfiber cloth, and wash and fully dry your hands before enrolling again. Enrolling the same finger twice in two slots also improves match rates for many people.

Step 3: Enable Fingerprint Authentication With Authselect

This step fixes the problem for most Fedora 40 users. Fedora uses authselect to manage PAM settings safely, and you should always use it instead of editing PAM files by hand.

1. Run authselect current to see your current profile and enabled features.
2. If with-fingerprint is missing from the list, that is your problem.
3. Run sudo authselect enable-feature with-fingerprint.
4. Run sudo authselect apply-changes to write the new setting.
5. Restart your computer fully so the login manager reloads the new rules.

After the restart, lock the screen with Super plus L, wait two seconds, and touch the sensor once with a clean, steady press of about one second. Many screens give no obvious prompt; the check is simply waiting in the background. Tapping quickly like a phone sensor often fails, because laptop readers need slightly longer contact. The official Fedora fingerprint authentication guide covers the same authselect workflow if you want more detail.

Step 4: Check Settings, Accounts, and Login Behavior

Sometimes the terminal enrollment and the Settings app get out of sync. Open Settings, go to Users, click your account, and open Fingerprint Login. If it shows no fingerprints even though the terminal lists them, enroll one finger again from inside Settings. Doing it once through Settings often refreshes the account state the lock screen relies on.

Make sure you are testing with the right account, too. Fingerprints are stored per user, so a finger enrolled under one account will never unlock a different account on the same laptop. Each person who shares the machine must enroll under their own login.

Login Screen Versus Lock Screen

Fedora behaves slightly differently at the first login after boot compared with unlocking a signed-in session. On some setups the fingerprint unlocks the lock screen perfectly but is not offered at the first login after a cold boot. That is partly by design, because your encryption and keyring passwords still need to be typed once. Test both situations separately so you know exactly which one is failing.

Step 5: Update the System and Firmware

Fedora 40 received several fingerprint and power fixes after release, so an out-of-date system can keep an old bug alive.

1. Run sudo dnf update, install all updates, then restart.
2. Run fwupdmgr get-devices to check for a fingerprint reader firmware update.
3. If one is offered, run fwupdmgr update while plugged into power.
4. After updating, delete your fingerprints and enroll once more, because firmware changes can make old templates unreliable.

If you dual boot with Windows, check the reader works there too. If you run into wider sign-in trouble, our guide on fixing a Fedora login loop after an update covers safe recovery steps.

Step 6: Test Sudo and Check the Logs

Test fingerprint use in the terminal with a harmless command such as sudo ls. If your fingerprint works for sudo but not at the lock screen, the sensor and PAM are fine and the issue is limited to the desktop lock screen. If it fails everywhere, PAM or the enrollment is still the problem.

Run journalctl -u fprintd -b after a failed unlock. A repeated no match message confirms a scan quality issue. Avoid forum scripts that rewrite PAM files directly, because one wrong line can lock you out of sudo.

Common Mistakes to Avoid

• Editing PAM files by hand. Always use authselect on Fedora. Manual edits are overwritten by updates and can break login.
• Tapping the sensor too quickly. Most laptop readers need a steady press of about one second, not a fast tap.
• Enrolling only the fingertip. Use the flat pad of your finger and vary the angle slightly.
• Testing only at first boot. Also test the lock screen after signing in, because the two behave differently.
• Enrolling with wet or dirty hands. A poor template will fail forever, no matter how many settings you change.
• Forgetting other accounts. Fingerprints never carry across user accounts.

Conclusion

A fingerprint reader that enrolls but never unlocks on Fedora 40 is rarely faulty hardware. In most cases the scan is fine, and the missing piece is the authentication setting that tells the login and lock screens to use it. Clear old enrollments, enroll one finger carefully, enable the fingerprint feature with authselect, apply the change, and restart. Add system and firmware updates if the problem survives, and use the terminal verify test and logs to confirm where the failure sits. Once it works, you get the fast, password-free unlock you expected, with your password still there as a safe fallback.

Frequently Asked Questions

Why does my fingerprint work for sudo but not to unlock the screen?

This usually means the fingerprint service and PAM are working, but the desktop lock screen is not checking the sensor. Restart after enabling the fingerprint feature with authselect, and test again. A full system update often clears this specific mismatch.

Do I need to type my password sometimes even with fingerprint login?

Yes, and that is normal. Fedora still asks for your password at the first login after a full boot, after several failed fingerprint attempts, and every few days for security. The fingerprint is a convenience for regular unlocking, not a complete replacement for your password.

How many fingers should I enroll on Fedora 40?

Enroll at least two fingers, ideally one from each hand. This gives you a backup if you have a small cut, a bandage, or dry skin on your main finger. Enrolling the same main finger twice can also improve the match rate on some readers.

Will these steps work on other Fedora versions?

The authselect method works on recent Fedora releases in the same way. Menu names may differ slightly, but clearing old scans, enrolling carefully, and enabling the fingerprint feature are the same.

What if my fingerprint reader is not detected at all?

Check that it is enabled in BIOS settings, confirm it appears in lsusb, and install all system and firmware updates. If it never appears, the reader may be an unsupported model, in which case password login remains the reliable option until driver support arrives.