Cover apps: what a calculator on your home screen can hide

A cover app is a small, genuinely working app that PWA Lock shows on an app's lock page instead of a password field: a calculator, a game of 2048, a weather app, a clock, a timer, tic-tac-toe or a piano. Perform a short passcode on it, such as typing 2048= on the calculator, and the password field appears. Installed on your iPhone home screen, the app carries the cover's icon, so a glance shows a calculator rather than a padlock. That is the idea, and also its limit: a cover is a courtesy against a glance, not a security feature. The lock password does the protecting. We make PWA Lock; this is the makers' own account of how the covers work, what each one really does, and where they stop.

How does a cover work?

Every app you add to PWA Lock gets its own address on pwalock.com and a lock page there. With the plain lock, that page is a password field. With a cover, the page is the cover, and the password field is not on it at all until the passcode has been performed; then the page switches to the password view, you enter the lock password, and the web app loads.

PWA Lock relocks the app whenever it is hidden and after 15 minutes, so you repeat that sequence on every reopen. The setup guide covers creating the app; this article is about choosing the cover.

What do the seven covers actually do?

Two covers make sound: the Piano when you play it, and the Timer when it finishes, though only while the page is open after you tapped Start; there is no system alarm once the app is closed. Weather asks for your location only when you tap Use my location; searching for a city never does.

How does the passcode work, and how do you choose one?

A cover passcode is a sequence of taps on the cover's keys, cells, chips, hour marks or presets (or typed characters on a computer keyboard). Pause for longer than about two and a half seconds, or make a wrong step, and the sequence starts over. When the last step matches, the cover gives way to the password field.

Each cover has a default, listed in the table, which applies if you leave the passcode empty. To set your own, open Cover & vault sequences on the Add an app form and choose Record passcode: a live copy of the cover opens, you perform the steps, and Use sequence saves them. Manual edit lets you type a comma-separated list such as 7,7,3,9 instead. Up to 120 characters are allowed, but three to six steps your thumb can do without thinking is about right.

Two practical points. The Calculator keeps whatever is on its display, so after 2048= the next open shows 2048 until you clear it; a sequence ending in C leaves it at 0. And do not reuse a PIN or anything you would mind being known: the passcode is not a secret in any strong sense, as the next section explains.

What can a cover not do?

It helps to be blunt here, because a cover looks more protective than it is.

• Anyone who recognizes PWA Lock can skip it. On a device where your account is logged in, the locked address followed by /__lock/login?unlock=1 shows the password field directly. It is also how you get in if you forget your own passcode.
• The passcode is visible to the browser. The lock page carries it so the cover can recognize it, and anyone who views the page source can read it; our privacy policy says patterns are stored as settings, not encrypted secrets.
• Only the lock password protects the app. It is checked on PWA Lock's servers, must be 8 to 128 characters, and repeated wrong attempts are made to wait. Make it long and different from your account password.
• It does not hide the name or the address. The name you chose is the label under the icon and the page title, and the address ends in pwalock.com.
• It does not hide that the app exists, and it does nothing at the original website, which stays reachable at its own address for anyone with its login.

Protection against someone holding your unlocked phone is a job for the phone's own locks, not for a cover. iPhone app locks, private browsing and PWA Lock compared sets the options side by side, and What PWA Lock protects, and what it does not draws the full boundary.

Do covers work offline, and where do they keep their state?

Yes. The lock page registers a service worker, the browser mechanism that lets a web app answer requests without a network (MDN describes it in the sources below). It caches the cover code and remembers which cover the app uses, so when the address cannot be reached the icon still opens the same cover with its saved state. It never caches the password form, unlock tokens, the vault or any page of the app itself, so unlocking always needs a connection.

A cover's memory lives in the browser's local storage for that app's address, on that device, and is not synced between devices. Three consequences:

• Each app has its own cover state; two apps with a Calculator cover have two separate histories.
• A home-screen web app has its own storage, separate from Safari (see WebKit's Safari 17.2 notes below), so the 2048 board you built in Safari is not the one in the installed app. Home-screen web app vs Safari tab explains the split.
• Clearing website data resets every cover, and browsers may evict storage they consider unused. If storage is blocked, the cover shows Changes cannot be saved in this browser and works without memory.

Weather is the one cover that talks to a server. Forecasts come from MET Norway through PWA Lock's own server, which rounds the coordinates to two decimal places and makes the request itself, so the forecast provider sees PWA Lock's connection rather than your phone's; city search uses a place database on the same server. Offline, the cover shows the saved forecast, labeled as saved.

Which cover fits your home screen?

There is no best cover, only one that suits how you use the phone.

• Pick something you would plausibly keep. You will perform the passcode on every reopen, so a cover you might actually use, a timer or a calculator, wears better than one you never touch.
• Name the app for the label, not the site. The name appears under the icon and becomes the address, so it must be unique across PWA Lock; plain names like Calculator may be taken, and a variation works as well.
• Know what the icon looks like. The icons are PWA Lock's own, adapted from open-source icon sets, not copies of Apple's; a Calculator cover next to the built-in Calculator looks like a second calculator, not a duplicate. The plain lock gets a padlock.
• You can mix. Each app has its own cover, so several locked apps can look like several different utilities. Set up separate locks for several iPhone web apps covers the multi-app setup.

Decide with some care: the cover and the passcode cannot be changed from the dashboard yet, only by creating a new app or writing to contact@pwalock.com.