How to Lock Apps on a Shared Mac So Your Kids Can't Get In

If your kids use the same Mac as you, macOS gives you almost no way to lock individual apps. Screen Time can block categories or set time limits, but it can't put a Touch ID gate in front of your banking app, 1Password, or Messages while leaving everything else open. The closest thing that actually works is a third-party app lock — here's how to set one up, and what the built-in options can and can't do.

Why Screen Time doesn't solve this

Screen Time is built for a different problem: limiting how long children use their own accounts. If your kids are logged into a separate macOS user account, Screen Time works reasonably well for time limits and content restrictions. But most family Macs don't work that way — everyone ends up on the same account because switching users is friction nobody wants.

On a single shared account, Screen Time can block specific apps entirely (the app just won't launch), but that's a binary choice. You can't say "allow the app, but require authentication to open it." There's also no way to protect your data inside an app your kids legitimately use — they can open Safari just fine, but you don't want them browsing your saved passwords.

MacOS has no built-in concept of per-app locking with biometric authentication. That's a genuine gap in the OS.

What actually works: per-app Touch ID locking

Lockish adds a lock overlay to any app you choose. When a locked app comes to the front, the screen goes blank and Touch ID (or your passcode) is required before the app becomes visible or usable. Your kids see a lock screen; you scan your finger and you're in.

The setup takes about two minutes:

1. Download Lockish and grant it Accessibility permission (System Settings → Privacy & Security → Accessibility)
2. Open Lockish from the menu bar and click Add App
3. Select the apps you want to protect — your banking app, password manager, email, whatever
4. Set a per-app idle timeout if you want it to re-lock automatically after you step away (anywhere from 10 seconds to 60 minutes)

Once an app is protected, opening it triggers the lock overlay immediately. Only someone with an enrolled Touch ID fingerprint — or the Mac passcode — can get past it.

One thing worth knowing: removing a protected app from Lockish also requires Touch ID. A curious kid can't just open Lockish's settings and undo your configuration.

Which apps are worth locking on a family Mac

Not every app needs protection. The ones that matter most on a shared Mac:

Password managers (1Password, Bitwarden, Keychain via Safari) — if a child gets into these, they have access to everything. This is the highest-priority lock.

Banking and finance apps — obvious. Even a well-meaning kid tapping around in a banking app is a risk.

Email and Messages — private conversations you don't want read, and also a social engineering risk if a child can send messages as you.

Health apps — any app storing personal medical data.

Work apps — if your Mac is also a work machine, locking Slack or your project management tool keeps work data away from accidental access.

Apps your kids actually use (games, YouTube in a browser, etc.) don't need to be locked — you're protecting your stuff, not blocking theirs.

What about automatic locking when you step away?

This is where the idle timeout feature earns its place. You can set each app to lock itself after a period of inactivity — so if you open your banking app, do your thing, then get distracted and walk away, the app locks itself behind you.

Lockish also locks all protected apps automatically when the screen locks or the Mac goes to sleep. So your normal habit of closing the lid when you leave the room handles it without any extra steps.

If you want to lock everything instantly — say, a child walks into the room unexpectedly — the global Lock All Now shortcut (⌘L) locks every protected app at once.

Is this actually secure, or just a speed bump?

Honest answer: it's strong convenience protection, not a security fortress. Someone with admin access to the Mac and enough motivation could work around it. Lockish is not a replacement for FileVault (which encrypts your disk) or separate user accounts (which provide genuine OS-level separation).

For the actual threat model on a family Mac — a child who's curious, impulsive, or testing limits — it's more than sufficient. The lock overlay hides app content completely, Touch ID can't be bypassed by guessing, and the timeout means you don't have to remember to lock apps manually every time.

Real customers who've bought Lockish for this exact reason (from purchase survey replies) describe it as solving the "I can't be watching them every second" problem — not the "I have a sophisticated adversary" problem. That framing is exactly right.

The Screen Time + Lockish combination

These two tools aren't mutually exclusive. Screen Time handles time limits and content categories well. Lockish handles protecting specific sensitive apps that your kids might otherwise be able to reach. Running both gives you:

• Time limits on overall Mac usage (Screen Time)
• Content filtering for Safari (Screen Time)
• A Touch ID gate on your banking app, password manager, and email (Lockish)

That's a more complete solution than either one alone.

Setting up a separate user account instead

If your situation allows it, the cleanest solution is still separate macOS user accounts. Create a Standard (non-admin) account for your kids under System Settings → Users & Groups. They get their own home folder, their own app settings, and no access to your files or apps at all.

The reason most families don't do this: switching accounts requires logging out or using Fast User Switching, which is clunky. Kids end up on the main account because it's easier. If you can get the habit to stick, though, separate accounts with Screen Time applied to the child's account is the most thorough setup.

Lockish is the right answer when separate accounts aren't practical — which, in reality, is most households.

---

Common questions

Can I lock apps on Mac without Touch ID hardware?

Lockish supports Touch ID, Face ID (on supported Macs), and your Mac passcode as fallback. If your Mac doesn't have a Touch ID sensor, the passcode option still works — it just requires typing your password instead of scanning your finger.

Will Lockish work if my child knows my Mac password?

If a child knows your Mac login password, they can bypass the lock using that passcode. The solution is to use a password your kids don't know — which is good security hygiene regardless. Touch ID is the stronger option here because it can't be watched and typed in.

Does this work if we share the same macOS user account?

Yes — Lockish is designed for exactly this scenario. It runs on a single account and protects specific apps regardless of who's sitting at the keyboard, making it the practical choice when separate accounts aren't being used.