The difference is described here in Orin Kerrs reversal of his opinion earlier today:
https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...
Basically, having to provide something in your mind, the passcode, is testimony, a finger print, much like a key, is not testimony.