Various pioneering approaches have been proposed for Wi-Fi-based sensing, which usually employ learning-based techniques to seek appropriate statistical features, yet do not support precise tracking without prior training. Thus to advance passive sensing, the ability to track fine-grained human mobility information acts as a key enabler. In this paper, we propose Widar, a Wi-Fi-based tracking system that simultaneously estimates a human's moving velocity (both speed and direction) and location at a decimeter level. Instead of applying statistical learning techniques, Widar builds a theoretical model that geometrically quantifies the relationships between CSI dynamics and the user's location and velocity. On this basis, we propose novel techniques to identify frequency components related to human motion from noisy CSI readings and then derive a user's location in addition to velocity. We implement Widar on commercial Wi-Fi devices and validate its performance in real environments. Our results show that Widar achieves decimeter-level accuracy, with a median location error of 25 cm given initial positions and 38 cm without them and a median relative velocity error of 13%.