How to Lock Individual Apps on a Shared Mac with Touch ID

macOS doesn't let you lock individual apps — the only built-in option is locking your entire Mac, which is useless when someone else is already sitting at it. If you share a Mac with family, a partner, or coworkers, and you want to protect your password manager, Messages, or banking app without locking everyone out of everything else, you need a third-party solution. Here's exactly how to do it.

Why macOS has no per-app lock (and why Screen Lock doesn't help)

macOS takes an all-or-nothing approach to access control. You can require a password or Touch ID to wake the screen, but once someone is logged into your user account, every app is open to them. That's fine if you're the only person who ever touches the machine. It's not fine if:

• Your kids use your Mac after school and you don't want them opening your bank's app
• You work from a coworking space and step away from your desk
• You share a family iMac where everyone uses the same user account
• You want your password manager to require re-authentication before anyone can read it, even mid-session

Screen Time can restrict app access for child accounts, but it's designed for parental controls, not per-session privacy for adults. And it doesn't use Touch ID — it uses a separate Screen Time passcode that a curious teenager will eventually find.

What Touch ID can and can't do natively

Apple's Touch ID is baked into login, Apple Pay, Safari autofill, and the App Store. What it can't do natively is gate access to a specific running app. Once you've unlocked your Mac, Touch ID has served its purpose as far as macOS is concerned.

Some apps implement their own Touch ID lock internally — 1Password and Bitwarden both do this well, locking their own vault after a timeout. But most apps don't: Messages, Mail, Notes, Chrome, and virtually every banking app leave themselves wide open once your Mac is unlocked.

So if you want Touch ID protection for apps that don't build it in themselves, you need something that sits outside those apps and intercepts access.

The practical options for locking individual apps

Option 1: Use apps that lock themselves

Before reaching for third-party tools, check whether the app you care about has its own lock:

• 1Password: Settings → Security → Lock on Sleep, with Touch ID to unlock. Solid.
• Bitwarden: Has a vault lock timeout with Touch ID support.
• Notes: No built-in lock for the whole app — only individual locked notes (via right-click → Lock Note). You need a password, not Touch ID.
• Messages: No lock at all.
• Banking apps: Most Mac banking apps are either browser-based or lack any app-level lock.

This approach works well for password managers but leaves most apps unprotected.

Option 2: Separate user accounts

The most robust solution for truly separate users is separate macOS accounts — each person gets their own login, their own apps, their own files. Go to System Settings → Users & Groups → Add Account.

The downside: this only works if people genuinely log out between sessions. In practice, most families using a shared Mac stay logged into one account and just expect the other person not to go snooping. Separate accounts are also impractical if you need to step away briefly mid-session without fully logging out.

Option 3: A dedicated app lock tool

This is where tools like Lockish come in. Lockish is a menu bar app that sits on top of any app you choose to protect and requires Touch ID (or Face ID, or your Mac passcode) before letting you in. It works for apps that have no built-in lock — Messages, Mail, Chrome, banking apps, anything.

The way it works: when you try to switch to a protected app, Lockish shows an overlay that hides the app's content completely. You authenticate with Touch ID and the app becomes visible. If you don't authenticate, the overlay stays up — no peeking.

A few things that make it genuinely useful for shared Macs specifically:

• Automatic idle locking: you can set per-app timeouts from 10 seconds to 60 minutes. Step away from your desk, and your banking app locks itself without you having to remember.
• Lock All Now (⌘L): one shortcut locks every protected app simultaneously before you hand your Mac to someone.
• Locks on sleep: when your Mac sleeps or the screen locks, all protected apps auto-lock. You come back, authenticate once to unlock your Mac, then authenticate again per-app — two layers.
• Touch ID required to quit Lockish or remove protected apps: so a clever kid can't just force-quit the app locker to get around it.

Lockish requires macOS 14+ and Accessibility permission (which it needs to detect app switches and show the overlay). There's a 7-day free trial, then a one-time purchase — no subscription.

One honest note: Lockish is convenience protection, not a security vault. Someone with admin access and enough determination could work around it. It's designed for the real-world scenario — curious family members, shoulder-surfers, brief unattended moments — not adversarial attackers with root access.

Setting up Lockish on a shared Mac: step by step

1. Download Lockish from appish.app/lockish and open it.
2. Grant Accessibility permission when prompted (System Settings → Privacy & Security → Accessibility → enable Lockish).
3. Click the Lockish menu bar icon → Add Protected App.
4. Select the apps you want to lock — e.g. Messages, your banking app, 1Password if you want a second layer.
5. For each app, set an idle timeout that matches how you use it. For Messages I'd suggest 1–2 minutes; for a banking app, 10–30 seconds.
6. Test it: open a protected app — you should see the lock overlay immediately. Authenticate with Touch ID to get in.
7. Press ⌘L before handing your Mac to anyone to lock everything at once.

The whole setup takes about three minutes.

Which apps are worth protecting on a shared Mac?

Not every app needs locking — only the ones where unwanted access would actually cause a problem:

For password managers: use the app's own built-in lock as your primary protection. Adding Lockish on top is a reasonable second layer, but the built-in lock is enough for most people.

For everything else on that list — Messages, Mail, banking apps — the built-in option doesn't exist, so Lockish is the practical answer.

Common questions

Does Touch ID app locking work if Touch ID fails?

Yes — if Touch ID isn't available (wet fingers, certain Mac models in clamshell mode, too many failed attempts), Lockish falls back to your Mac login passcode. You won't get locked out of your own apps.

Can I lock apps for one user but not another on a shared Mac?

Lockish is per-user-account — it only runs and applies locks for the account it's installed in. If you're all sharing a single macOS account, everyone will hit the lock. If you want protection only for your sessions, the cleanest solution is separate macOS user accounts combined with Lockish on your account only.

Will Lockish protect against someone opening my Mac and going straight into an app?

Yes, because Lockish auto-locks protected apps when your Mac sleeps or the screen locks. When you (or anyone else) wake the Mac, they'll need your Mac password or Touch ID to get past the login screen — and then Touch ID again to open any Lockish-protected app.

Originally published at appish.app