Getting started
First run
Four steps, in this order. App Lock enforces the order rather than trusting you to guess it.
1. Create a PIN
4 to 6 digits, entered twice. Until there is a PIN, App Lock will not lock anything - a locked app with no way to unlock it would shut you out of your own phone.
2. Recovery question
Strongly recommended, and skippable. Without it a forgotten PIN means uninstalling the app. There is no reset code, no email, no support back door - see
how the PIN works for why there cannot be one.
3. Grant two permissions
Usage access and Display over other apps, both in Android's own Settings. App Lock deep-links you straight to each screen, with a fallback if your phone does not have it.
4. Pick your apps
Flip a switch per app. Protection starts by itself once the grants are in place; there is no "start" button to forget.
i
App Lock's own screens sit behind the PIN too. Protection can be switched off and apps un-locked from here, so leaving it open would defeat the point.
Permissions, and why each one
Android
Two are required, the rest are situational. Every one of them is revocable from Android's Settings, and App Lock tells you what breaks if you do.
!
Not asked for, ever: the full list of installed packages, device-administrator rights, full-screen intent, and above all no accessibility service. Each of those is blocked by a check that fails the build if it ever reappears.
How the PIN works
Under the hood
Worth one read, because it explains why there is no "reset my PIN" link anywhere in the app.
No stored PIN
Your PIN is not saved, and not saved as a hash either. A random key is wrapped by a key derived from your PIN with Argon2id - a deliberately slow, memory-hard function - and that bundle is wrapped again by a key held in the phone's hardware Keystore, which cannot be exported.
"Correct" means it decrypts
A PIN is right when unwrapping succeeds and the authentication tag verifies. There is nothing to compare against, so there is nothing to steal, leak or reset.
Off-device guessing
Copying the phone's storage is not enough: the outer wrap needs the hardware key, which never leaves the phone. Argon2id then makes each on-device guess expensive.
The recovery question
Built the same way: a third wrapped copy of the same key, under Argon2id of your normalised answer. "Answered correctly" is the identical operation as "PIN correct" - so recovery adds convenience without adding a weaker second door.
Fingerprint
A second way to release the same key, bound to a Keystore key that Android invalidates if fingerprints are re-enrolled. The PIN always keeps working; biometrics can never be the only way in.
Failed attempts & the intruder photo
Opt-in
Off until you turn it on, and camera access is requested at that moment and not before.
The log
Every wrong PIN is recorded with the digits that were typed and when. Each entry can be deleted, or the whole log cleared.
The photo
With the toggle on, the front camera takes a single silent photograph on the second consecutive wrong PIN. Nothing appears on screen, no shutter sound is played by the app, and nothing leaves the phone.
Sealed while locked
Entries are written with a public key and can only be read with the private half, which the app holds only after a correct unlock. So a failed attempt can be recorded while locked and read only by you. Open the log before unlocking and it says so rather than showing you nothing.
Best-effort
The capture gives up after five seconds. A phone with no front camera, or with camera access refused, logs the attempt without a photo rather than failing.
Staying switched on
The hard part
An app-locker that quietly dies in the background is worse than none, because you believe you are protected. Three things keep it alive, and one of them tells you when it failed.
After a reboot
Protection comes back on boot without the app being opened - verified on a physical phone. Android staggers the boot broadcast, so allow up to a minute after the phone starts.
When the platform refuses
Recent Android versions can refuse to start a background service at boot. App Lock checks whether the start actually worked and raises a notification saying it is not protecting your apps, rather than assuming success.
Against task-killers
A self-rearming alarm re-checks every fifteen minutes and restarts protection if a power manager killed it. Swiping App Lock out of Recents also restarts it.
Battery optimisation
A card offers to open the battery settings - and only appears once you have seen a lock actually work, so it is not a nag on day one. It is dismissible.
The status notification
Deliberately carries no "stop protection" button. A notification anyone can swipe into switching your security off is not security.
!
Some manufacturers - the aggressive power managers are the usual suspects - add restrictions on top of Android. App Lock detects those phones and points you at the autostart setting, but the phone's own settings have the final word.
What it will not do
By design
These are refusals, not gaps. Each one is a decision on record, and the build fails if the code ever creeps back.
What App Lock does
- Reads the name of the app in front, four times a second, screen-on only
- Paints a PIN screen over apps you chose
- Keeps your PIN, your app list and your log on this phone
- Tells you when it has stopped being able to protect you
What it refuses to do
- No accessibility service, not even as an optional "fast mode" - it can read every screen on your phone
- No device-administrator rights, so it cannot and does not block uninstall
- No full package list, no full-screen intent
- No ads, no analytics, no crash reporting, no account
i
Many app lockers take the accessibility route because it closes the ~250 ms gap. App Lock accepts the gap instead. Granting an app the right to read every screen on your phone is a much larger thing to hand over than a quarter of a second.
Free trial & the full version
Unlock
Three days of everything, then a single payment. No subscription, and nothing held back during the trial.
3-day trial
The whole app. The three days start the first time you open it, not when you install it, and the app shows how many are left.
When it ends
App Lock stops guarding your apps, and that is all. Your PIN, recovery question, chosen apps and attempt log are exactly as you left them. It says so on the screen, in those words, because "your trial has ended" usually means "we deleted your things".
One-time purchase
A single payment of ₹101 through Google Play unlocks it for good. Protection resumes straight away.
Restore purchase
Signed in to Google Play with the same account? Tap Restore purchase. The entitlement is also cached on the phone, so someone who has paid is never blocked by a bad connection.
Clock changes
Winding the clock back never extends the trial. Winding it forward only ends it early, for whoever did it.
Frequently asked
Expectations
Does App Lock use an accessibility service?
No, and it never will - including as an optional "fast mode". An accessibility service can read the content of every screen on the phone. App Lock reads only the name of the app in front. The build fails if an accessibility service ever appears in the app.
Can App Lock stop someone uninstalling it?
No. Blocking uninstall needs device-administrator powers this app deliberately does not ask for. You can choose to lock the Settings app, which makes uninstalling less convenient - but that is not a guarantee, and App Lock never presents it as one.
What happens if I forget my PIN?
Answer your recovery question and choose a new one. If you skipped the question there is no back door - see how the PIN works - and uninstalling App Lock is the only way to stop it locking your apps. Nothing of yours lives inside App Lock, so nothing of yours is lost.
Is there a moment where the locked app is visible?
Yes, briefly. App Lock notices the app has opened and then paints over it - a median of 257 ms and a worst case of 420 ms on a Galaxy S24. It is the honest cost of not using an accessibility service, and we would rather tell you than pretend the gap is not there.
What happens when the free trial ends?
App Lock stops guarding your apps, and nothing else happens. Your PIN, recovery question, chosen apps and attempt history stay exactly as they were, and unlocking the full version brings protection straight back.
Does it work after a reboot?
Yes - verified on a physical phone. Protection restarts without the app being opened. Android staggers the boot broadcast, so allow up to a minute after the phone starts. If the platform refuses the start, App Lock tells you rather than sitting there looking fine.
Does it drain the battery?
The check runs four times a second while the screen is on and stops completely while it is off, holds no wakelock, and reuses a single object rather than allocating on every poll. Long-run battery behaviour on real phones has not been measured yet, and this page will say so until it has.
Does it need the internet?
No. Everything - detection, the PIN, the log - happens on the phone. The only network use is Google Play handling the purchase.
