How to Protect Sensitive Apps on Mac with Touch ID (Without Locking Your Whole Computer)

macOS has no built-in mechanism to lock individual apps - the only native option is locking your entire Mac with a screensaver or sleep, which is all-or-nothing. If you want to protect specific sensitive apps (a banking app, your email, a password manager) while leaving everything else accessible, you need a third-party solution. Here's exactly how to do it, and what your options actually are.

Why macOS doesn't protect individual apps by default

Apple's security model is built around protecting the system and your data at rest - FileVault encrypts your disk, Gatekeeper controls what runs, and sandboxing limits what apps can do. But none of that stops someone who sits down at your unlocked Mac from opening 1Password, reading your emails, or checking your bank balance.

The assumption baked into macOS is that if you're at an unlocked Mac, you're an authorised user. That's fine for a single-person setup, but it falls apart the moment someone else can physically reach your keyboard - a family member, a coworker in a shared office, or anyone who walks past your desk while you're making coffee.

Screen Lock (the built-in option via System Settings → Lock Screen, or pressing ⌃⌘Q) locks everything at once. That's often overkill: you might want your kids to use the Mac freely but not be able to open your tax documents. You can't get that granularity from anything Apple ships.

What macOS Screen Time gets wrong for this use case

Screen Time (System Settings → Screen Time) lets you block apps entirely for managed users - but it's designed for parental controls with a separate managed account, not for protecting your own apps on your own account. It also uses a passcode rather than Touch ID, and it's clunky to configure for ad-hoc protection of individual apps.

More importantly: if you're on a single shared user account (which most families and coworking setups are), Screen Time's per-app limits don't give you the "require authentication to open" behaviour you're after. It can block apps by category or set time limits, but it won't prompt for Touch ID before someone opens your email.

The practical options for protecting individual apps

Option 1: Use separate macOS user accounts

The cleanest built-in solution is giving family members their own user account (System Settings → Users & Groups → Add Account). Each account has completely separate apps, files, and settings. Anyone without your login password cannot access your account.

This works well when people use the Mac at different times. It doesn't work well when you're already logged in and step away - your apps are all accessible to anyone who walks over. And switching accounts takes 15-30 seconds, which makes it impractical as a quick safeguard.

Option 2: Use a password manager's own lock feature

If it's specifically your password manager you're trying to protect, most of them (1Password, Bitwarden, Dashlane) have a built-in auto-lock setting that requires Touch ID or a master password after a timeout. Enable this in the app's own preferences before relying on anything else.

This is free and built-in - use it. The limitation is it only covers that one app, and the timeout means there's a window after you last used it where it's still unlocked.

Option 3: Lock individual apps with Touch ID using Lockish

For protecting any combination of apps - not just a password manager - Lockish adds a Touch ID lock layer to individual apps you choose. When someone tries to open a protected app, they see an overlay that hides the content completely and requires Touch ID or your Mac's login password before it disappears.

The setup takes about two minutes:

1. Download Lockish and turn it on in System Settings › Privacy & Security › Device Control and Data Access (Accessibility before macOS 27) (required: it's how Lockish follows a locked app's windows)
2. Open the Lockish menu bar icon and click Add App
3. Select any app you want to protect - your email client, banking app, notes, whatever
4. Set an idle timeout per app (anywhere from 10 seconds to 60 minutes). Once you've switched away from the app for that long, it auto-locks itself

Once an app is protected, Lockish locks it again automatically when your Mac or its display goes to sleep, the screen locks, the screen saver starts, or another user switches in, so you don't have to remember to lock it manually. If you're stepping away in a hurry, Lock All in the menu bar locks every protected app at once.

A few things worth knowing: Lockish is convenience protection, not a cryptographic lock. It's designed to protect against casual access: a family member or coworker who borrows your Mac or glances at your screen. It isn't a barrier against someone determined at the keyboard, since anyone using your Mac while you're logged in can end Lockish with Force Quit. So as well as clicking Lock All, lock your Mac (Control-Command-Q) when you leave it logged in somewhere public. Don't use it as a substitute for FileVault (which you should have enabled regardless).

Lockish has a 7-day free trial so you can test it with your actual apps before buying. It's a one-time purchase - no subscription.

What about an encrypted disk image?

Some guides suggest moving an app into an encrypted disk image made in Disk Utility, with an alias left in Applications. It's clunky: it breaks app updates, Spotlight and the Dock, and anyone who knows where to look can get round it. Fine for files you rarely open, not for apps you use every day.

What app locking can and can't do

Good for:

• Keeping family members or coworkers out of particular apps when they use your Mac
• Covering sensitive apps when you step away or hand over your screen
• A quick safeguard without locking the whole Mac

Not built for:

• Stopping someone determined at your keyboard (Force Quit can end an app locker)
• Enterprise-level security requirements
• Protecting an app's data files: only its windows are covered

Locked apps also keep running behind their covers: they can still play sound, finish downloads and show notifications.

Which apps are worth protecting?

Good candidates:

• Banking and finance apps - any app where someone could initiate a transfer or see account numbers
• Email clients - Mail, Spark, Mimestream - your inbox is a goldmine of sensitive information
• Password managers - even if the app has its own lock, a second layer doesn't hurt
• Notes apps - Apple Notes, Obsidian, Notion - people store surprisingly personal things here
• Messages and communication - iMessage, WhatsApp, Telegram

You don't need to lock everything. Lock the two or three apps where real damage could happen if someone opened them. Start with timeouts that suit how you work: too short and you'll be unlocking all day, too long and the lock stops protecting much.

For particular cases, see how to lock apps on a shared Mac, how to lock apps so your kids can't get in and how to lock the Messages app on Mac.

What about apps that don't support Touch ID natively?

Some apps - mostly communication and finance apps - have started adding their own Touch ID prompts. If an app already prompts for Touch ID on open, you may not need Lockish for it. Check the app's own security settings first.

For apps with no built-in lock (which is most of them), Lockish is the only option that adds Touch ID authentication without replacing the app itself.

Common questions

Does macOS have a built-in way to require Touch ID before opening an app?

No. macOS Touch ID is used for unlocking your Mac, approving sudo commands in Terminal, and authenticating in-app purchases. There's no native setting to require Touch ID before opening a specific app - that requires a third-party tool.

Will locking an app hide its contents from other apps like Mission Control or notifications?

Lockish hides the app's content behind a full lock overlay, so the window contents aren't visible on screen. Mission Control and Stage Manager's strip can still show a locked app's windows with their content. Notifications from a locked app can still appear as banners depending on your notification settings. If that's a concern, set the app's notifications to "Alerts" style or turn off notification previews in System Settings → Notifications.

Does this work on a Mac without Touch ID (like an older Intel Mac with a separate keyboard)?

Lockish falls back to your macOS login password if Touch ID isn't available or fails. macOS 14 or later is required, and any Mac that runs it works: Touch ID where the Mac or its keyboard has it, an Apple Watch, or the login password. Touch ID is on MacBooks with the sensor, and on Apple silicon Macs with a Magic Keyboard with Touch ID.

What if Touch ID doesn't work when I unlock an app?

Clean the sensor and your finger, and if it keeps failing, add the fingerprint again in System Settings → Touch ID & Password. Whenever Touch ID can't be used (no sensor, no fingerprint set up, or the lid closed), Lockish asks for your login password instead, so you're never locked out of your own app.