Can you password-protect a website on your iPhone?

Yes, in three different ways. The first is the website's own login, which most sites already have. The second is Apple's built-in protection: locking an app behind Face ID, hiding it, or locking Safari's Private Browsing tabs. The third is a separate lock in front of the website, with its own password and its own icon, which is what PWA Lock does. Which one fits depends on what you want to protect against: a stranger holding your unlocked phone, someone who knows your phone passcode, or an icon that announces the site to anyone glancing at your screen. PWA Lock's makers wrote this article; weigh the third option with that in mind, since the first two are often enough.

What does "locking a website" mean on an iPhone?

People who ask this usually have one site in mind: a notes app, a journal, a forum, a dating site or a messaging service that opens from the home screen. "Locking it" can mean keeping other people out of your account on that site, stopping the icon on this iPhone from opening without you, or adding a separate password step, with a different-looking icon, every time the site is opened from the home screen. Each has a different fix; the table compares the four tools people choose between.

Two things stand out. Apple's locks accept the phone passcode, so they protect against someone who has your phone but not your passcode; a separate lock password protects the locked copy from anyone who does not know it. And nothing in the table protects the original address except the site's own login.

Check Apple's built-in options first

Before paying for anything, look at what the phone already does. Everything here comes from Apple's own guides, linked at the end.

Lock or hide an app

Apple's guide says to go to the Home Screen, touch and hold the app until the Quick Actions menu opens, and tap Require Face ID (or Touch ID or Passcode). A locked app then needs Face ID, Touch ID or your passcode to open and relocks after you quit it. Hide and Require Face ID moves the app to a Hidden folder at the bottom of App Library, which also needs authentication to open. Apple adds that only apps downloaded from the App Store can be hidden, and that the status applies only to that iPhone.

Apple's guide describes apps. It does not say whether the same menu appears for a website you have added to the home screen, so check on your own device: touch and hold the icon and look for Require Face ID. If it is offered, try it and see whether it behaves as Apple describes. If it is not, the remaining choices are the site's own login and a separate lock.

Private Browsing

Apple describes Private Browsing as private tabs that don't appear in History or in the tab list on your other devices. If your iPhone has a passcode, Private Browsing locks when it is not in use, though Apple notes it may not lock immediately, and under Settings, Apps, Safari you can require Face ID, Touch ID or the passcode to unlock it. That fits if you open the site in Safari each time, but it is not an icon on the home screen, which is what most people asking this question want.

The passcode underneath

Both of Apple's locks accept the phone passcode, and Apple's guide to setting one explains that Face ID and Touch ID come into use once a passcode exists. The passcode is the foundation. Apple names Custom Alphanumeric Code and Custom Numeric Code as the most secure options; a longer passcode that nobody else knows does more for you than any lock built on top of it. If the person you have in mind knows your passcode, no Apple lock keeps them out of the icon; that is the case for a separate password.

How does PWA Lock lock a website?

PWA Lock gives the website you name a locked copy at its own address, for example my-notes.pwalock.com. Opening that address shows a lock page rather than the site: a plain password field, or a cover app, a small working Calculator, 2048, Weather, Clock, Timer, Tic-tac-toe or Piano that reveals the password field only after a short sequence, such as typing 2048= on the calculator. Cover apps: what a calculator on your home screen can hide describes each one.

Entering the lock password opens the site. You choose the password when you create the app, 8 to 128 characters, separate from your PWA Lock account password and from the site's own login. There is no Face ID here; you type it.

Add the locked address to your home screen and the icon and name are the cover's; the installed app starts at the lock page every time. The lock closes again whenever the app is hidden (you switch apps, lock the phone or return to the home screen) and in any case after 15 minutes. The site's own login still applies inside: if it asks you to sign in, it still will. Set up PWA Lock on your iPhone: the complete guide has the steps, and Apple's guide to turning a website into an app has the current menu labels.

What does a separate lock not do?

A separate lock is a gate at one address. Knowing where the gate is not matters as much as knowing where it is.

• The original address stays reachable. Locking my-notes.pwalock.com does nothing to the original site, which anyone who knows the address and has its login can still open. A session you already have in Safari stays until you log out there.
• The site's own login is unchanged. PWA Lock adds a step in front of it and does not replace or weaken it. Keep using the site's password and any second step it offers.
• Nothing is encrypted or backed up. PWA Lock does not encrypt anything, and it does not hide or remove photos, files or cloud copies that already exist.
• The cover is not a security factor. The cover passcode hides the password field from a glance; the lock password does the protecting.
• Your pages travel through PWA Lock's servers. They pass through in memory and are not intentionally stored, but you are trusting PWA Lock with that traffic. Some sites also resist being shown from another address, particularly those that sign you in through a third party; Why a website login may fail inside a web-app wrapper explains which ones.

What PWA Lock protects, and what it does not sets out each boundary in more detail.

Who benefits from a separate lock, and who should stick with Apple?

Stick with Apple's features if:

• The thing you want to protect is an App Store app. Apple's lock is made for it, uses Face ID and costs nothing.
• Your worry is a stranger with your unlocked phone, and nobody else knows your passcode.
• You would resent typing a password every time you open the site; a lock that closes whenever you switch apps only suits a site you genuinely want shut.

A separate lock is the better fit if:

• The site is a website rather than an app, and Require Face ID does not appear for its icon on your device.
• You want a password independent of the phone passcode, so that unlocking the phone does not unlock the site.
• You would rather the icon did not name the site. A cover app gives it a different name and icon.
• You have several sites to protect and want each behind its own password. Set up separate locks for several iPhone web apps shows how; Starter covers 2 apps and Personal 6, and Starter, Personal or Pro: which plan fits you? compares them.

Still weighing the two? iPhone app locks, private browsing and PWA Lock compared goes deeper into the same options, with the same disclosure about who wrote it.