How to Auto-Lock a Mac App After Inactivity (Without Locking the Whole Mac)

macOS can only auto-lock the whole Mac (System Settings → Lock Screen), not a single app. To lock one app after a few idle minutes, you need either that app's own timeout (most password managers have one) or an app locker such as Lockish, which gives each protected app its own timeout from 10 seconds to 60 minutes and asks for Touch ID to get back in. The rest of this post covers the native options first, then the per-app route.

Does macOS lock a single app after inactivity?

No. macOS has no per-app lock, so it has no per-app idle timer either. The only timer is the system one, which locks everything: your apps, your files, your whole session.

That is fine at a desk where you are the only person. It is a poor fit if you share the Mac with family, work in a coworking space, or just want your banking app or password manager to close up after two minutes while the rest of the Mac stays usable.

How do I make the whole Mac lock sooner?

This is the free baseline, and it is worth setting even if you add per-app locking later.

1. Open System Settings → Lock Screen.
2. Set Start Screen Saver when inactive to a short time, such as 2 or 5 minutes.
3. Set Turn display off on battery/power adapter when inactive to a similar value.
4. Set Require password after screen saver begins or display is turned off to Immediately.

Two faster ways to lock on demand:

• Press ⌃⌘Q to lock the screen straight away.
• In System Settings → Desktop & Dock → Hot Corners, assign a corner to Lock Screen, then flick your pointer there when you stand up.

The catch is that this protects the Mac, not individual apps. When you are sitting at the machine, nothing is locked.

Which apps already have their own idle timer?

A few categories do, and you should use these before adding anything:

• Password managers (1Password, Bitwarden and similar) have an auto-lock or vault-timeout setting in their own preferences. Set it to a few minutes. The details are in my guide to locking a password manager with Touch ID.
• Banking and brokerage sites usually sign you out after a few minutes of inactivity, but that happens on the website's side. The window stays on screen until it does.
• Browsers with separate profiles let you keep sensitive logins apart, but they do not lock the profile when you walk away.

Most other apps (Mail, Messages, Notes, Slack, your editor) have no idle lock at all. Whatever you left on screen stays readable until the Mac itself locks.

How do I lock one app after it has been idle?

This is the gap Lockish fills. It is a menu bar app that puts a lock overlay over any app you choose. You set a timeout per app, and when that time passes the app is covered and needs Touch ID again.

The setup:

1. Install Lockish and grant the one permission it asks for, Device Control and Data Access. This is called Accessibility before macOS 27. If you want to lock Finder, macOS also asks for Automation. Lockish never asks for Screen Recording.
2. Add the apps you want protected.
3. Choose each app's idle timeout. The range is 10 seconds to 60 minutes, and each app gets its own value.
4. Leave it running in the menu bar.

After that, a locked app is covered on every display, and every window is covered as it appears. Keystrokes and shortcuts cannot reach a locked app. To get back in you use Touch ID. On a Mac without a sensor, Lockish asks for your login password instead. Lockish also locks protected apps when the screen locks or the Mac sleeps, and ⌘L (Lock All Now) locks everything at once.

Lockish is $9.99 once, with a 7-day free trial and no card needed. It runs on macOS 14.0 (Sonoma) or later, on Apple Silicon and Intel.

What timeout should I pick for each app?

There is no official answer, so here is how I would think about it: the more damage a glance could do, the shorter the timeout.

• Password manager: 30 seconds to 2 minutes. It is the most sensitive app and the one you reopen most often, so Touch ID keeps this painless.
• Banking or finance: 2 to 5 minutes.
• Messages, Mail: 5 to 15 minutes, or longer if you are the only one near the screen most of the day.
• Notes, documents with private content: 10 to 30 minutes.

If a timeout feels annoying, lengthen it. A lock you disable because it nags is worse than a slightly longer one you keep.

One thing I hear from customers is that they use Lockish for shared family Macs, coworking spaces, and locking a password manager or banking app without locking the entire Mac. All three suit short timeouts: you are physically nearby but not looking at the screen.

What are the limits of per-app idle locking?

Be realistic about what this does:

• It is convenience protection, not enterprise security. It stops a coworker, a child or a curious visitor from reading an open window. A determined attacker with admin access to your Mac could work around it.
• It does not replace FileVault. If someone steals the Mac, disk encryption is what protects your data, so keep FileVault on (System Settings → Privacy & Security → FileVault).
• Lockish has to be running to protect anything. Touch ID is also required to quit Lockish or to remove a protected app, so someone cannot simply switch the lock off.

For the shared-Mac case, see how to lock individual apps on a shared Mac. For working in public spaces, see Mac coworking privacy apps. If you want the latest changes, they are in Lockish 1.6.0.

Common questions

Can you lock apps on a Mac?

Not natively. macOS locks the whole session but has no per-app lock. A third-party locker like Lockish adds one, with Touch ID to unlock.

Can I lock a Mac app without Touch ID?

Yes. On a Mac without a Touch ID sensor, Lockish falls back to your Mac's login password. The timeouts and overlay work the same way.

Does an app lock when my Mac sleeps?

With Lockish, yes. Protected apps lock when the screen locks or the Mac goes to sleep, regardless of their individual idle timeouts.