Modern smartphones hold massive amounts of private and potentially sensitive user data (e.g., identity and messages). User authentication is the key measure to protect such sensitive data from adversaries. In this article, we explore a novel authentication mechanism, LipAuth, leveraging the unique spatial-temporal features (i.e., both static physiological and dynamic behavioral characteristics) of human lips biometrics for secure and convenient user authentication, without requiring any special sensors on smartphones. The key principle behind LipAuth is that the geometric structure of lips is unique across different users while consistent and stable for the same user, which is dependent on three types of static features, i.e., lip width, thicknesses, and the joint characteristic of the former two, and the dynamic features in smiling process, i.e., the bending processes of the boundary lines between the upper and lower lips. On that basis, LipAuth can accurately identify legal users by actively extracting the spatial-temporal features on the lips’ profile changes, while also remaining fast and easy to use. We have implemented the prototype of LipAuth on Android platforms and comprehensively evaluated its performance by recruiting 50 volunteers. The experimental results show that LipAuth can achieve an overall 99.24% accuracy for user authentication and can resist potential intrusion from video replaying and mimic attacks.