The App Lock — password-protect AppRelay
Put a password in front of AppRelay: cover every window, the menu-bar panel, and your paired phone, lock by hand or on idle/launch/sleep, and get back in with a recovery code or your license if you forget it.
Last updated 2026-07-25
The App Lock puts a password in front of AppRelay. While it's engaged, every window, the menu-bar or tray panel, and any phone paired with the computer show an unlock screen instead of your projects — and nothing can be built, shipped, or configured until you type the password.
It's off until you set one, and every part of when it engages is yours to choose. The App Lock is part of AppRelay Studio.
Turning it on
- Open Settings → App Lock. The gear icon at the top of the sidebar, then App Lock in the list.
- Click “Set a Password…” and choose one — at least 6 characters, with at least 3 different ones.
- Save the recovery code. AppRelay shows a 25-character code once, and never again. Put it in your password manager or write it down — it's how you get back in if you forget the password. (There's a second way out too; see below.)
- Pick when it locks. Every trigger is off by default, so out of the box the lock only engages when you ask it to.
Locking it
By hand, any time:
| Where | How |
|---|---|
| Keyboard | ⌃⌘L on macOS · Ctrl+Alt+L on Windows |
| Menu | macOS: AppRelay → Lock AppRelay |
| Settings | Settings → App Lock → Lock Now |
| Menu bar / tray | The Lock AppRelay quick action in the menu-bar panel (macOS) or the tray menu (Windows) |
The shortcut only fires while an AppRelay window has focus — which is exactly why the menu-bar and tray entries exist. If you've hidden the app to the menu bar or tray, lock it from there.
Or automatically, from any combination of these:
| Trigger | What it means |
|---|---|
| After being idle | Never, or after 1 / 5 / 15 / 30 / 60 minutes with no typing or clicking in AppRelay. Working in another app still counts as idle here, so the lock arms while you're heads-down in your editor. |
| When AppRelay starts | Every launch begins at the lock screen, so nothing is visible until you unlock. |
| When hidden to the menu bar / tray | Sending the window away locks it on the way out. |
| When the computer sleeps or the screen locks | Closing the lid or hitting the system lock takes AppRelay with it. |
What the lock covers
Everything you can see or click in the app:
- Every window — the main console, the Relay Monitor, the Logs window, diffs, and every settings sheet. The content behind the lock screen is blurred, so nothing is readable over your shoulder.
- The menu-bar panel and tray flyout — the server controls, the pairing token, and the connected-device list are all behind the same gate. The Windows tray menu collapses to Unlock AppRelay… and Quit.
- The app menus — About, Check for Updates, Manage License, Relay Monitor, Logs Window, and Hide to Menu Bar all stop responding, as do their keyboard shortcuts. Only the lock shortcut still works.
- Your paired phone — see below.
What keeps running
Locking the app doesn't stop your work:
- A build already in flight
- Keeps going to completion. Locking hides the console; it doesn't cancel anything.
- Triggers
- Schedules, file watches, and webhooks keep firing. A nightly build still runs on a locked machine.
- The
apprelayCLI and the MCP server - Deliberately not gated. They're separate processes with no window, and gating them would break your CI steps, scripts, and agent tooling every time you locked your desk. Anyone who can already run commands on your computer as you has no need of AppRelay's window.
Your phone shows the same lock
When the desktop is locked, AppRelay Mobile covers its whole screen with the same gate — a locked computer can't be driven from a pocket. Type the computer's password on the phone and it unlocks the computer for real: the desktop drops its own lock screen at the same moment, and the phone returns to exactly the screen you were on.
If you'd rather the lock could only ever be lifted by someone physically at the computer, turn off Allow unlocking from a paired phone in Settings → App Lock. The phone still shows the gate — it just explains that the computer has to be unlocked in person, and clears itself the moment that happens.
How the password is stored
- Never in plain text
- Only a salted PBKDF2-HMAC-SHA256 digest is kept (310,000 iterations, a random 16-byte salt) — the same key-stretching AppRelay uses for archive passphrases. There is nothing to read back out: no plaintext, no hint, not even the length.
- On that computer only
- macOS keeps it in the Keychain, marked never to sync to iCloud; Windows keeps it in a DPAPI-encrypted file bound to your user account. It never reaches our servers.
- Never in an archive
- A
.relayexport deliberately doesn't carry it. Importing your projects on another computer doesn't bring the lock with them — set one there if you want one. - Guessing is throttled
- The first four wrong attempts are free, because typos happen. After that each miss doubles the wait, up to five minutes — and the countdown survives quitting the app, so relaunching isn't a way around it. Attempts from a paired phone feed the same counter.
If you forget the password
There are two ways back in, and both of them remove the lock and walk you straight into setting a new password.
1. Your recovery code
On the lock screen, click Forgot your password? and enter the 25-character code you saved when you set the lock up. Case, spacing, and dashes don't matter. It works with no internet connection.
The code is single-use — once spent, it's gone, and the new password you set comes with a fresh one. You can also replace it at any time from Settings → App Lock → Recovery Code…, which immediately invalidates the previous one.
2. Your license
Lost the code as well? On the lock screen choose Lost the code too? Use your license and enter your AppRelay Studio license key and the email you bought it with. Both have to match the activation on this computer, and the key is checked against our licensing service — so this route needs an internet connection, and a key copied out of a config file proves nothing on its own.
If you've mislaid the key itself, look it up or have it re-sent from the Manage license page using your purchase email.
Changing it or turning it off
- Change the password
- Settings → App Lock → Change Password…. You'll need the current one, and you'll be given a new recovery code (the old one stops working).
- Turn the lock off
- Settings → App Lock → Turn Off…. This asks for the current password too — otherwise anyone who found the app unlocked could simply switch the protection off.
- If your license lapses
- A lock you've already set keeps working at any tier: you can always unlock it, change it, or turn it off. Only enabling it needs Studio — so an expired license can never shut you out of your own app, or quietly leave it unprotected.