Limits
Everything we tried, and what got through.
On every platform there is a deliberate, conscious act that ends the lock. We would rather you read them here than find one at 2am and conclude the whole thing was oversold.
The design goal is not that escape is impossible. It is that no escape happens by reflex, and that the cheap ones cost you a recorded failure.
Desktop · Windows, macOS, Linux
Electron kiosk shell
- Alt+F4, Ctrl+W, Ctrl+Q, window close
- holds
- Swallowed while locked, and the close event is cancelled regardless.
- Minimise, Alt+Tab, Show desktop
- holds
- Kiosk mode keeps the window in front; losing focus pulls it straight back.
- Switch virtual desktop
- holds
- The window is marked visible on all workspaces.
- Use the second monitor
- holds
- Opaque covers on every other display, resynced when you plug one in mid-lock.
- Sleep, wake, or lock the OS session
- holds
- Every barrier is re-asserted on resume rather than merely refocused.
- Kill the process from Task Manager
- holds
- Lock state is on disk and the app relaunches itself while a lock is live.
- Open DevTools and call the unlock channel
- holds
- The token is verified in the main process against a key the page cannot read.
- Delete the lock file from AppData
- defeated
- By design. A deliberate two-step act with a file manager is above the bar this sets.
- Reboot the machine
- defeated
- The lock file survives, but nothing launches CodeLock at login yet. A known gap.
- Ctrl+Alt+Del, or hold the power button
- defeated
- The Secure Attention Sequence cannot be intercepted by any userland process, ever.
- Hold Escape for ten seconds
- by design
- The documented kill switch. Resolves the session as abandoned, which counts as a failure.
Reasoned through in full and recorded in the repository; not every row has been exercised on real hardware yet, and macOS and Linux are untested.
Android
Overlay above other apps
- Back button
- holds
- Swallowed by the overlay and by the in-app screen.
- Home button, or open another app
- holds
- The overlay window sits above the launcher and above other apps.
- Swipe the app away from Recents
- holds
- That kills the activity. The overlay belongs to a foreground service.
- Reboot, or update the app
- holds
- A boot receiver restores the lock from storage.
- Pull down the status bar
- defeated
- System UI always draws above application overlays, and Settings is reachable there.
- Settings → Force stop
- defeated
- Documented. Only enterprise Device Owner provisioning prevents it, and that needs a factory reset.
- Safe Mode, uninstall, or clear data
- defeated
- Third-party apps do not run, or the stored lock goes with them.
- An OEM battery manager kills the service
- defeated
- Xiaomi, Huawei, Samsung, OnePlus. The app asks for an exemption; granting it is up to you.
Needs two permissions you grant by hand: “Display over other apps”, which Android only offers from a Settings screen, and a battery-optimisation exemption.
iOS
It cannot block anything.
No public API lets one iOS app prevent you leaving it or draw over another. This is a decision Apple made, not a gap in our work, and no amount of effort here changes it.
CodeLock takes over its own screen and notifies you. That is the ceiling. Any app claiming a true iOS block is either using a request-gated parental-controls entitlement or misrepresenting what it does. Pair it with Screen Time if you want a hard limit.
Browser
A tab can always be closed.
Which is exactly why the browser is not a lock surface. The demo on this site is a demo — it never issues a real unlock, and it says so on screen the whole time.
If a product tells you a web page can lock your computer, close the page.
So it is a commitment device, not a parental control.
If you want something that stops a determined person who owns the hardware, no userland application is that, and the ones that say otherwise are lying. CodeLock is for the case where the determined person is you, later, and you would like the easy path to be doing the work.
Install it anyway