iPhone app locks, private browsing and PWA Lock compared

If the app you want to protect is a native app from the App Store, Apple's own lock is the right answer: touch and hold the icon, choose Require Face ID, and you are done, at no cost. Safari's Private Browsing solves a different problem, keeping tabs out of your history. A website's own login protects your account, not the door on your phone. The passcode protects the whole phone with one credential. PWA Lock is for the narrower case: a web app that needs a password of its own, separate from the phone's, with a cover in front and a relock whenever you put the phone down.

One thing first: we make PWA Lock, so this is a comparison by people selling one of the options, not an independent review. We describe iOS only as Apple documents it and say so where its guides are silent.

Which option fits which need?

Start from your situation; the next table has details.

How the five options compare

Apple's features as its user guides describe them, PWA Lock as it works today. Where Apple's documentation is silent, the cell says so: check on your device.

When Apple's features are enough

More often than not, they are.

A native app you want behind Face ID. Apple's lock was built for this. Its guide says a locked app requires Face ID, Touch ID or your passcode to open, and that the lock applies to that iPhone only and does not sync through iCloud. Nothing to install, nothing to pay, nobody new to trust. If the app should also disappear, hiding moves it to a Hidden folder in App Library that requires authentication to open, with two documented limits: apps that come installed cannot be hidden, and Settings keeps a list of hidden apps.

A web app whose site asks for its password every time. The site's own login already is the lock.

Browsing you do not want in History. Private Browsing is the tool. Apple documents that private tabs lock when not in use if the phone has a passcode, with the switch under Settings, Apps, Safari, and adds that Private Browsing may not lock immediately.

A phone that only you ever unlock. Apple says a passcode turns on data protection for the phone's data, and Face ID cannot be set up without one. If nobody else knows the passcode, it already does most of what the others add.

When a separate web-app password helps

Apple's features share one credential: the phone's. Face ID, Touch ID and the passcode open the phone, the locked app, the Hidden folder and the locked private tabs alike. That is exactly right when the risk is a stranger. It stops being enough when the people around you know the passcode, when a child borrows the phone, or when what you want to lock is a website rather than an app.

PWA Lock puts a lock page at an address of its own, your-app.pwalock.com, in front of the web app. The lock password is yours alone: 8 to 128 characters, different for each app, unrelated to the phone and to your PWA Lock account password. The page can be a plain password field or a cover, a working calculator, clock, weather or game app that reveals the field only after a short sequence you choose; Cover apps: what a calculator on your home screen can hide explains what a cover can and cannot do. Added to the home screen, it installs with the cover's icon and name, opens at the lock page every time, and keeps storage of its own, separate from Safari (WebKit's Safari 17.2 notes describe this), so its first launch may ask for your PWA Lock login. Switch apps, lock the phone or return to the home screen and the app relocks within a moment; an unlock also expires after 15 minutes.

Three cases where this earns its price:

• Several web apps that need different locks; plans cover 2 to 15 apps, and Starter, Personal or Pro: which plan fits you? matches them to real workflows.
• A web app on a phone whose passcode other people know: the lock password is the one thing they do not have.
• A home-screen website for which your device does not offer Apple's lock. Check first: touch and hold the icon and look for Require Face ID; if it is there, use it.

Set up PWA Lock on your iPhone walks through the setup in about ten minutes, and Can you password-protect a website on your iPhone? covers the wider question of what locking a website can mean.

The limits of each option, including ours

Apple's lock or hide. Documented for apps; whether it is offered for a home-screen website is not covered by Apple's documentation. And it opens with the same passcode as the phone.

Private Browsing. About History and tab lists, not access: a site you are logged in to stays logged in, and locked private tabs open with the phone's credentials.

The website's own login. It protects the account, which none of the others do, but most sites keep you logged in, so on the phone it is a door that stands open unless you log out every time.

The passcode. One credential for everything; forgotten, Apple's remedy is to erase the phone and restore a backup.

PWA Lock. The original website stays reachable at its own address for anyone who knows it and has its login; we add a gate at the locked address, nothing more. Your traffic passes through our servers, run on Cloudflare, so you are trusting us as well as the site; we process it in memory and do not intentionally store it, and we do not encrypt anything. Some sites misbehave through a proxy: those that hand you to a third-party login, redirect to another domain, or check the address they are served from. A cover is a convenience, not a security factor, and the icon stays on your home screen. Apps cannot be edited from the dashboard yet, so a forgotten lock password means a new app or an email to us. What PWA Lock protects, and what it does not draws these lines in detail.

Put simply: for a native app, use Apple's lock. For your history, use Private Browsing. For a web app that needs a password the phone does not share, that is what we built.