AppLocker sits at the top of the Mac App Store's "app lockers" category with a 4.1★ rating from over 1,000 reviews. On MacUpdate, the same app sits at 2.6★. That gap is what got me curious.
I'd been building Shoo! — a Touch ID lock for macOS apps — and before shipping it, I wanted to understand what was already out there and why the reviews disagreed so much. So I actually tried to get past AppLocker's lock. Here's what I found.
The lock disappears if you delete the app
Locking an app in AppLocker overlays a passcode/Touch ID screen on top of it. But nothing stops you from deleting the locked app from Finder or Launchpad. Do that, reinstall it (or restore from a backup), and the lock is simply gone — no authentication asked, no warning. Whatever was "protected" is now wide open.
Editing the app's Bundle ID removes the lock
Every macOS app has an identifier in its Info.plist (its Bundle ID) that tools like AppLocker use to recognize which app to gate. Change that identifier — which just means opening the app package and editing a text file — and the lock no longer recognizes the app as the one it's supposed to protect. The overlay never appears again.
The backup password is 4 digits
If you forget your unlock code, AppLocker falls back to a secondary passcode. That fallback is a 4-digit PIN — 10,000 possible combinations, no rate limiting mentioned anywhere in the app or its documentation. That's the kind of number you'd expect from an iPhone in 2008, not from something guarding your Mail or Photos in 2026.
It only checks once — at launch
AppLocker verifies you at the moment an app launches. If the app is already running and you just switch back to it (Cmd+Tab, clicking its Dock icon), there's no second check. So the actual window of protection is much narrower than "this app is locked" implies — it's really "this app asks once, at the start of the session."
No password recovery path
If you lock yourself out entirely, there's no account-based recovery, no email reset — you're stuck. For a security tool, having zero recovery path is arguably a bigger liability than the bypasses above, since a lot of the reports on MacUpdate are exactly this: people locked out of their own apps with no way back in.
Why this pattern keeps showing up
None of these are exotic exploits — they're the natural consequence of building a launch-gate, not a real lock. AppLocker draws a screen over the app, or blocks it from opening. It never touches the running process itself. Once the process exists (or the identity check is fooled), the "lock" has nothing left to enforce.
That's the specific problem I built Shoo! to solve differently: instead of gating the launch, it actually terminates the process when you're not authenticated via Touch ID, and re-checks on every relaunch and app-switch — including Apple's own apps (Messages, Photos, Mail), which most Mac lockers can't touch at all.
I'm obviously not a neutral party here — I build a competing app, and I want to be upfront about that. But the findings above are reproducible on your own Mac in a few minutes, so I'd rather people just go verify them than take my word for it. Full write-up with more detail: shooapp.com/vs-applocker
Curious whether other "app locker" style tools for macOS have the same launch-gate-not-a-real-lock problem — if you've poked at one, I'd like to hear what you found.
Top comments (1)
Some comments may only be visible to logged-in visitors. Sign in to view all comments.