Getting started
First run
Four steps, in this order. AppLock enforces the order rather than trusting you to guess it.
1. Create a PIN
4 to 6 digits, entered twice. Until there is a PIN, AppLock will not lock anything - a locked app with no way to unlock it would shut you out of your own phone.
2. Recovery question
Strongly recommended, and skippable. Without it a forgotten PIN means uninstalling the app. There is no reset code, no email, no support back door - see
how the PIN works for why there cannot be one.
3. Grant two permissions
Usage access and Display over other apps, both in Android's own Settings. AppLock deep-links you straight to each screen, with a fallback if your phone does not have it.
4. Pick your apps
Flip a switch per app. Protection starts by itself once the grants are in place; there is no "start" button to forget.
i
AppLock's own screens sit behind the PIN too. Protection can be switched off and apps un-locked from here, so leaving it open would defeat the point.
Permissions, and why each one
Android
Two are required, the rest are situational. Every one of them is revocable from Android's Settings, and AppLock tells you what breaks if you do.
!
Not asked for, ever: the full list of installed packages, device-administrator rights, full-screen intent, and above all no accessibility service. Each of those is blocked by a check that fails the build if it ever reappears.
How the PIN works
Under the hood
Worth one read, because it explains why there is no "reset my PIN" link anywhere in the app.
No stored PIN
Your PIN is not saved, and not saved as a hash either. A random key is wrapped by a key derived from your PIN with Argon2id - a deliberately slow, memory-hard function - and that bundle is wrapped again by a key held in the phone's hardware Keystore, which cannot be exported.
"Correct" means it decrypts
A PIN is right when unwrapping succeeds and the authentication tag verifies. There is nothing to compare against, so there is nothing to steal, leak or reset.
Off-device guessing
Copying the phone's storage is not enough: the outer wrap needs the hardware key, which never leaves the phone. Argon2id then makes each on-device guess expensive.
The recovery question
Built the same way: a third wrapped copy of the same key, under Argon2id of your normalised answer. "Answered correctly" is the identical operation as "PIN correct" - so recovery adds convenience without adding a weaker second door.
Fingerprint
A second way to release the same key, bound to a Keystore key that Android invalidates if fingerprints are re-enrolled. The PIN always keeps working; biometrics can never be the only way in.
Failed attempts & the intruder photo
Opt-in
Off until you turn it on, and camera access is requested at that moment and not before.
The log
Every wrong PIN is recorded with the digits that were typed and when. Each entry can be deleted, or the whole log cleared.
The photo
With the toggle on, the front camera takes a single silent photograph on the second consecutive wrong PIN. Nothing appears on screen, no shutter sound is played by the app, and nothing leaves the phone.
Sealed while locked
Entries are written with a public key and can only be read with the private half, which the app holds only after a correct unlock. So a failed attempt can be recorded while locked and read only by you. Open the log before unlocking and it says so rather than showing you nothing.
Best-effort
The capture gives up after five seconds. A phone with no front camera, or with camera access refused, logs the attempt without a photo rather than failing.
Staying switched on
The hard part
An app-locker that quietly dies in the background is worse than none, because you believe you are protected. Three things keep it alive, and one of them tells you when it failed.
After a reboot
Protection comes back on boot without the app being opened - verified on a physical phone. Android staggers the boot broadcast, so allow up to a minute after the phone starts.
When the platform refuses
Recent Android versions can refuse to start a background service at boot. AppLock checks whether the start actually worked and raises a notification saying it is not protecting your apps, rather than assuming success.
Against task-killers
A self-rearming alarm re-checks every fifteen minutes and restarts protection if a power manager killed it. Swiping AppLock out of Recents also restarts it.
Battery optimisation
A card offers to open the battery settings - and only appears once you have seen a lock actually work, so it is not a nag on day one. It is dismissible.
The status notification
Deliberately carries no "stop protection" button. A notification anyone can swipe into switching your security off is not security.
!
Some manufacturers - the aggressive power managers are the usual suspects - add restrictions on top of Android. AppLock detects those phones and points you at the autostart setting, but the phone's own settings have the final word.
What it will not do
By design
These are refusals, not gaps. Each one is a decision on record, and the build fails if the code ever creeps back.
What AppLock does
- Reads the name of the app in front, four times a second, screen-on only
- Paints a PIN screen over apps you chose
- Keeps your PIN, your app list and your log on this phone
- Tells you when it has stopped being able to protect you
What it refuses to do
- No accessibility service, not even as an optional "fast mode" - it can read every screen on your phone
- No device-administrator rights, so it cannot and does not block uninstall
- No full package list, no full-screen intent
- No ads, no analytics, no crash reporting, no account
i
Many app lockers take the accessibility route because it closes the ~250 ms gap. AppLock accepts the gap instead. Granting an app the right to read every screen on your phone is a much larger thing to hand over than a quarter of a second.
Frequently asked
Expectations
Does AppLock use an accessibility service?
No, and it never will - including as an optional "fast mode". An accessibility service can read the content of every screen on the phone. AppLock reads only the name of the app in front. The build fails if an accessibility service ever appears in the app.
Can AppLock stop someone uninstalling it?
No. Blocking uninstall needs device-administrator powers this app deliberately does not ask for. You can choose to lock the Settings app, which makes uninstalling less convenient - but that is not a guarantee, and AppLock never presents it as one.
What happens if I forget my PIN?
Answer your recovery question and choose a new one. If you skipped the question there is no back door - see how the PIN works - and uninstalling AppLock is the only way to stop it locking your apps. Nothing of yours lives inside AppLock, so nothing of yours is lost.
Is there a moment where the locked app is visible?
Yes, briefly. AppLock notices the app has opened and then paints over it - a median of 257 ms and a worst case of 420 ms on a Galaxy S24. It is the honest cost of not using an accessibility service, and we would rather tell you than pretend the gap is not there.
Is there a free trial?
No. AppLock is a paid app: ₹101 once on Google Play, and everything works from the first launch. There is no countdown, no paywall, and no moment where it stops guarding your apps to ask you for money. If you would rather try before buying, read this page - it is deliberately complete, including what AppLock will not do.
Does it work after a reboot?
Yes - verified on a physical phone. Protection restarts without the app being opened. Android staggers the boot broadcast, so allow up to a minute after the phone starts. If the platform refuses the start, AppLock tells you rather than sitting there looking fine.
Does it drain the battery?
The check runs four times a second while the screen is on and stops completely while it is off, holds no wakelock, and reuses a single object rather than allocating on every poll. Long-run battery behaviour on real phones has not been measured yet, and this page will say so until it has.
Does it need the internet?
No - and it could not use it if it wanted to. AppLock declares no internet permission at all, so Android will not let it open a network connection. Everything - detection, the PIN, the log - happens on the phone. Buying the app is between you and Google Play, and happens before the app is installed.
