Before you rely on it
The way out,in full.
On every platform there is a deliberate, conscious act that ends the lock. We would rather you read them here than find one at 2am and conclude the whole thing was oversold.
The design goal is not that escape is impossible. It is that no escape happens by reflex, and the deliberate Escape exit records a failed session.
On Windows, macOS and Linux
Electron kiosk shell
- Alt+F4, Ctrl+W, Ctrl+Q, window close
- prior tests
- Swallowed while locked, and the close event is cancelled regardless. Historical tests covered the cancel, including that it does not fire when nothing is locked — a close guard with no condition would make the app impossible to quit. Nobody has pressed the keys on hardware.
- Minimise, Alt+Tab, Show desktop
- prior tests
- Minimising was tested and did not stick — the window came straight back and the lock held. Alt+Tab and the Windows key were not tried by hand. Kiosk mode keeps the window in front; losing focus pulls it straight back.
- Switch virtual desktop
- untested
- The window is marked visible on all workspaces.
- Use the second monitor
- prior tests
- Opaque covers on every other display, resynced when you plug one in mid-lock. Historical tests covered the decision to re-assert kiosk state and the covers on a display change, rather than only refocusing. No second monitor has been plugged in mid-lock.
- Sleep, wake, or lock the OS session
- prior tests
- Every barrier is re-asserted on resume rather than merely refocused, which was covered by historical tests — kiosk state and the always-on-top level do not reliably survive a display sleep on Windows, so refocusing alone looks right until another window is raised over it. Nobody has slept a machine mid-lock.
- Kill the process from Task Manager
- defeated
- The overlay goes with it. Lock state stays on disk, so opening CodeLock again restores the lock — but that is your choice to make, and until then the machine is yours.
- Reopen CodeLock after killing it
- holds
- Tested. The lock came back from disk with no new timer, so killing the process buys a desktop only until the next launch.
- Open DevTools and call the unlock channel
- holds
- Tested against a live lock: a forged token and an empty one were both rejected as malformed and the overlay stayed. The token is verified in the main process against a key the page cannot read.
- Delete the lock file from AppData
- defeated
- By design. A deliberate two-step act with a file manager is above the bar this sets.
- Reboot the machine
- untested
- The lock file survives, and the installed app registers itself to start at login and re-engage a live lock. A reboot does free the machine in the meantime, and that gap is now recorded: a lock file that outlived its process is counted as an interrupted session rather than passing silently as one that ran to completion. Whether the relaunch survives a real reboot has not been verified.
- Ctrl+Alt+Del, or hold the power button
- defeated
- The Secure Attention Sequence cannot be intercepted by any userland process, ever.
- Hold Escape for ten seconds
- by design
- The documented kill switch. Ends the session as stepped away, which counts as a failure.
“Prior tests” describes historical checks of the shell’s decisions, not hardware verification. Those test suites have since been removed. Most escape routes and reboot recovery remain unverified on hardware; macOS and Linux are unverified throughout.
On Android
Overlay above other apps
- Back button
- untested
- Swallowed by the overlay and by the in-app screen.
- Home button, or open another app
- untested
- The overlay window sits above the launcher and above other apps.
- Swipe the app away from Recents
- untested
- That kills the activity. The overlay belongs to a foreground service.
- Reboot, or update the app
- untested
- A boot receiver restores the lock from storage.
- Pull down the status bar
- defeated
- System UI always draws above application overlays, and Settings is reachable there.
- Settings → Force stop
- defeated
- Documented. Only enterprise Device Owner provisioning prevents it, and that needs a factory reset.
- Safe Mode, uninstall, or clear data
- defeated
- Third-party apps do not run, or the stored lock goes with them.
- An OEM battery manager kills the service
- defeated
- Xiaomi, Huawei, Samsung, OnePlus. The app asks for an exemption; granting it is up to you.
Android has not been verified on a device. Needs two permissions you grant by hand: “Display over other apps”, which Android only offers from a Settings screen, and a battery-optimisation exemption.
On iPhone and iPad
It cannot block anything.
No app can block another through CodeLock. The iOS module reports hard locking as unsupported. Apple’s Family Controls framework uses restricted entitlements and is not implemented here.
Use the desktop shell for the lock mechanism; iOS is not an equivalent lock surface.
In a web browser
A tab can always be closed.
Which is exactly why the browser is not a lock surface. The demo on this site is a demo — it never issues a real unlock, and it says so on screen the whole time.
If a product tells you a web page can lock your computer, close the page.
So it is a commitment device, not a parental control.
If you want something that stops a determined person who owns the hardware, no userland application is that, and the ones that say otherwise are lying. CodeLock is for the case where the determined person is you, later, and you would like the easy path to be doing the work.
Install it anyway