A biometric identity authentication method, comprising: enrolling a user biometric of a user, the enrolling comprising: receiving first factor credentials via a user interface of a mobile device; capturing a first user biometric with a biometric sensor associated with the mobile device; securely saving the first user biometric to a memory of the mobile device; calculating, with a processor of the mobile device, a first cryptographic hash of the first user biometric; and transmitting the first cryptographic hash via a communication interface of the mobile device to a relying party server of a relying party; and registering the user biometric, the registering comprising: capturing a second user biometric with the biometric sensor associated with the mobile device; comparing, with the processor of the mobile device, the second user biometric to the first user biometric; and when a match between the second user biometric and the first user biometric is confirmed: generating, with the processor of the mobile device, a cryptographic key pair comprising a private key and a public key; securely saving the private key to the memory; preparing, with the processor of the mobile device, a registration package comprising the public key and a second cryptographic hash of the second user biometric; and transmitting the registration package via the communication interface from the mobile device to the relying party server of the relying party; and authenticating the user, the authenticating comprising: comparing, by the relying party server, the received second cryptographic hash with the first cryptographic hash, and granting, by the relying party server and if the first and second cryptographic hashes are identical, the user access to the relying party and/or resources of the relying party. enrolling a user biometric of a user, the enrolling comprising: receiving first factor credentials via a user interface of a mobile device; capturing a first user biometric with a biometric sensor associated with the mobile device; securely saving the first user biometric to a memory of the mobile device; calculating, with a processor of the mobile device, a first cryptographic hash of the first user biometric; and transmitting the first cryptographic hash via a communication interface of the mobile device to a relying party server of a relying party; and receiving first factor credentials via a user interface of a mobile device; capturing a first user biometric with a biometric sensor associated with the mobile device; securely saving the first user biometric to a memory of the mobile device; calculating, with a processor of the mobile device, a first cryptographic hash of the first user biometric; and transmitting the first cryptographic hash via a communication interface of the mobile device to a relying party server of a relying party; and registering the user biometric, the registering comprising: capturing a second user biometric with the biometric sensor associated with the mobile device; comparing, with the processor of the mobile device, the second user biometric to the first user biometric; and when a match between the second user biometric and the first user biometric is confirmed: generating, with the processor of the mobile device, a cryptographic key pair comprising a private key and a public key; securely saving the private key to the memory; preparing, with the processor of the mobile device, a registration package comprising the public key and a second cryptographic hash of the second user biometric; and transmitting the registration package via the communication interface from the mobile device to the relying party server of the relying party; and capturing a second user biometric with the biometric sensor associated with the mobile device; comparing, with the processor of the mobile device, the second user biometric to the first user biometric; and when a match between the second user biometric and the first user biometric is confirmed: generating, with the processor of the mobile device, a cryptographic key pair comprising a private key and a public key; securely saving the private key to the memory; preparing, with the processor of the mobile device, a registration package comprising the public key and a second cryptographic hash of the second user biometric; and transmitting the registration package via the communication interface from the mobile device to the relying party server of the relying party; and generating, with the processor of the mobile device, a cryptographic key pair comprising a private key and a public key; securely saving the private key to the memory; preparing, with the processor of the mobile device, a registration package comprising the public key and a second cryptographic hash of the second user biometric; and transmitting the registration package via the communication interface from the mobile device to the relying party server of the relying party; and authenticating the user, the authenticating comprising: comparing, by the relying party server, the received second cryptographic hash with the first cryptographic hash, and granting, by the relying party server and if the first and second cryptographic hashes are identical, the user access to the relying party and/or resources of the relying party. comparing, by the relying party server, the received second cryptographic hash with the first cryptographic hash, and granting, by the relying party server and if the first and second cryptographic hashes are identical, the user access to the relying party and/or resources of the relying party.