Ward

Ward logs you into login, sudo and system prompts with your face — using your laptop's infrared + colour cameras, backed by real liveness checks, on native Wayland. It's built on your distro's own Python (no pip), and it always falls back to your password. Free and open source.

Install · Usage · How it works · Security · Roadmap

Howdy brought Windows-Hello-style face login to Linux, but out of the box it's unreliable — and the reasons have nothing to do with face recognition. It opens the wrong camera, never switches on the infrared emitter, treats one enrolled pose as one working head angle, and ships defaults from a 2018 webcam. The result is "works sometimes," which for authentication is the worst outcome.

Ward ships its own engine (on the same proven pieces — dlib, OpenCV, V4L2) and fixes the setup instead of the algorithm: it finds and lights the IR emitter, enrolls many poses in one guided sweep, measures the match threshold from your face, adds liveness, and tells you exactly what it's doing. And it never locks you out — every failure falls through to the password.

Howdy is pleasant when it works and is widely packaged; its weak spots are setup and security, which it's honest about. Ward targets exactly those. Each cell is factual; see Migrating from Howdy to move across without losing your password fallback.

• 🌙 Works in the dark. Uses the infrared camera and turns on its emitter, so it sees you at midnight the same as at noon.
• 🛡️ Real liveness, honest about it. A phone or monitor emits no infrared, so a replayed face is absent from the IR frame and rejected; an anti-spoof CNN and a motion check back that up. It's strong convenience — not Face ID, and it says so.
• 🎯 Thresholds measured, not guessed. One guided enrollment captures several poses and sets the recognition gate from held-out frames of your own face.
• 🖥️ A real app, or a real CLI. A native GTK 4 / libadwaita window for setup, people and reliability — or do everything from the terminal, including headless over SSH.
• ⚡ Fast. A sandboxed resident engine keeps the models loaded, so an unlock starts ~1 s sooner.
• 🔓 Unlocks your keyring, logs every attempt, supports several people per login, and adapts to glasses / headset / night.
• 🐧 Distro Python, zero pip deps. Tested on Debian, Ubuntu, Fedora, Arch and openSUSE.

Install from your distro (pulls in its own dependencies):

# Ubuntu 24.04 & derivatives
sudo add-apt-repository ppa:0ctave/ward && sudo apt update && sudo apt install ward

# Fedora
sudo dnf copr enable 0ctave/ward && sudo dnf install ward

(The PPA targets Ubuntu 24.04+; Arch is coming to the AUR — for now use source.) Or grab the .deb from Releases, or install from source on any distro:

sudo apt install python3-opencv python3-gi python3-gi-cairo gir1.2-adw-1 gcc libc6-dev  # Debian/Ubuntu deps
git clone https://github.com/0ctave/ward && cd ward && sudo ./install.sh

Then set it up — open "Ward" from your apps (or run ward) and follow the guided wizard:

ward

That's it: the app walks you through cameras → infrared → registering your face → turning it on, all in one window. Prefer the terminal (or on a server)? sudo ward setup does the same thing, and it works headless. Full details, per-distro dependencies, the dlib-vs-ArcFace choice and troubleshooting are in the Install guide.

Ward is a 2D face system — no depth sensor. It defeats phone-screen photos and darkness; it does not claim to defeat a high-quality printed infrared photograph, and identical twins defeat any 2D system. Treat it as strong convenience with a password fallback — the class of Windows Hello on the same hardware, not Face ID. No false-accept rate is certified yet. See How it works → Honest limits and SECURITY.md.

Issues and PRs welcome — especially camera quirks from other laptops (attach your ward doctor output) and portability fixes. Start with CONTRIBUTING.md and the Code of Conduct.

MIT © 2026 octave. The bundled YuNet and MiniFASNetV2 models are Apache-2.0 (see ward/models/).