Do you get notified when someone logs into your Mac?

MacUpdated 14 October 2026

You want to know whether you'd hear about it if someone got into your Mac. There are two different things here. Apple documents notifications when your Apple Account is used to sign in on a new device. It doesn't document any notification when someone unlocks or logs in to the Mac itself with its password.

Quick answer

If two-factor authentication is on, Apple says a sign-in to your Apple Account on a new device sends a notification to your other trusted devices, with a map of roughly where it is. Someone unlocking your Mac with its password isn't that. Apple doesn't document a notification for it. One way to get one is an app that sends it.

Will I get notified if someone logs into my Apple Account?

Yes, for a sign-in on a new device, if two-factor authentication is on. Apple says that when a sign-in attempt occurs on a new device, you get a notification on your other trusted devices, which can be any trusted iPhone, iPad or Mac. The notification includes a map showing the new device's location. Apple says that location is approximate, based on the IP address or network the device is using.

If you don't recognise the sign-in:

Select Don't Allow on the notification to block the attempt.
Apple suggests you may want to take a screenshot of the notification before dismissing it.
Check the devices signed in to your Apple Account (steps below), and remove any you don't recognise.

Apple also says that when you sign in on a new device or the web for the first time, you need your password and a six-digit verification code, displayed automatically on your trusted devices or sent to your trusted phone number. Because the code shows on your trusted devices, someone using one of them, such as your Mac, can see it there.

What other Apple Account alerts should I look out for?

Apple lists these among the signs that your Apple Account may have been compromised:

Apple notifies you, by notification or email, about account activity you don't recognise, such as a sign-in on a device you don't recognise or a password change you didn't make.
You receive a two-factor authentication code, on a trusted device or by text message, that you didn't request.
You see messages you didn't send, items you didn't delete, or account details you didn't change.

If any of these happen, Apple's advice starts with changing your Apple Account password to a strong one, then reviewing your account details and removing devices you don't recognise.

To see the devices signed in with your Apple Account on a Mac:

Choose Apple menu > System Settings.
Click your name, then scroll down to the list of devices.
Click a device you don't recognise, then click Remove from Account.

Apple says a device still signed in may appear again the next time it connects to the internet, unless it's signed out on that device.

Do I get notified when someone unlocks my Mac?

Not in any way Apple documents. The notifications above are about your Apple Account signing in on a new device. Unlocking your Mac with its login password isn't described by Apple as an Apple Account sign-in, and Apple's Mac User Guide describes no setting that alerts you when the Mac is unlocked or logged in to.

That matters most for the people you share space with. Apple doesn't describe any notification for someone who knows your Mac password, or who finds your Mac awake and not yet asking for one. So the first steps are about the lock itself:

Choose Apple menu > System Settings, then click Lock Screen in the sidebar.
Set "Require password after screen saver begins or display is turned off" to a short time.
In System Settings > Users & Groups, set "Automatically log in as" to Off. Apple warns that automatic login allows anyone to access your Mac simply by restarting it.

To look for signs the Mac has already been used, see who unlocked my Mac.

How can I get an alert when someone unlocks my Mac?

Apple doesn't document a built-in way, so one option is an app. Failshot is one, out now for Mac as a download from failshot.app, for macOS 14 or later. Its alerts are email alerts, and they come with conditions worth knowing before you buy:

Email alerts are optional, and off until you turn them on, and you need to be signed in to a Failshot account.
With them on, an alert with the photo, the time and, when it's ready in time, the video follows shortly after an unlock you don't confirm as yours, as long as Failshot is still running. Unlocks you confirm as yours don't send one. With alerts on, Failshot also emails you about a wrong Failshot PIN or answer, or its camera access being switched off while it's on. If Failshot is force-quit before the alert goes, the alert waits until Failshot next opens.
Failshot has to be on and running. It doesn't photograph the first login after a restart or a log out. Logging out, restarting or shutting down closes Failshot without asking for Touch ID or your Failshot PIN, and unless you've set it to start at login, it stays off until you open it again.
It watches only the Mac user account it runs in, so a login to another account on the Mac, or to Guest, isn't photographed.
It doesn't photograph a wrong password at the macOS login or lock screen, so there's no alert for one.
Location is off until you turn it on in Settings and allow it. Then an alert can say roughly where your Mac was when it was unlocked.

Where Failshot fits

Apple's notifications cover your Apple Account. Failshot covers your account on the Mac in front of you.

With Failshot on, it photographs whoever unlocks your Mac, then records a 5-second video. Video is on by default and can be switched off. Sound is off unless you turn it on, and the app warns you that recording someone's voice without their permission is against the law in some places.
Whoever unlocks sees Failshot's window saying the unlock was photographed, and when a video is recording. With the Mac's built-in camera, the green light comes on.
In Unlocks, "That was me" deletes an unlock's photos from your Mac, and from your web vault if you use it. In the encrypted web vault, you can also mark each unlock "This was me", "Not me" or "Not sure".
Photos are kept on your Mac. They leave it only in email alerts and the encrypted web vault, if you turn those on, and, if you join your organisation with its invite code, encrypted for its security team too.
Switching Failshot off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password. A wrong Failshot PIN or answer takes another photo. Like any Mac app, it can still be force-quit.

Failshot is free to download, but turning it on needs Failshot Pro, a paid subscription, and there's no free trial. Failshot Pro is £3.99 a month or £23.99 a year, VAT included, for as long as you stay subscribed, if you subscribe by 31 October 2026. From 1 November 2026 new subscriptions are £5.99 a month or £35.99 a year.

It can't find a lost Mac on demand: location, if you turn it on, is noted only at an unlock. It has no remote lock or wipe. For those, use Apple's Find My. Failshot is for your own Mac, or a Mac your organisation has authorised you to manage with it. iPhone, Android and Windows versions are coming soon.

Questions people also ask

Do you get a notification when someone logs into your MacBook?

Apple doesn't document one. Apple's sign-in notifications are for your Apple Account being used on a new device, and unlocking the Mac with its password isn't described as that. An app such as Failshot, with its email alerts turned on, can email you about unlocks of your account while it's running, though not the first login after a restart or log out.

Will I get notified if someone logs into my Apple ID?

Apple says Apple ID is now Apple Account, with the same sign-in details. With two-factor authentication on, Apple says a sign-in attempt on a new device sends a notification to your other trusted devices, with a map of the approximate location. Select Don't Allow if you don't recognise it.

What does it mean if I get a verification code I didn't ask for?

Apple lists a two-factor authentication code you didn't request among the signs your Apple Account may have been compromised. Apple's advice starts with changing your Apple Account password and removing devices you don't recognise.

Is the location in an Apple sign-in notification exact?

No. Apple says the location of the sign-in attempt is approximate, based on the IP address or network the device is using, rather than the device's exact location.

Does Failshot alert me if someone types the wrong Mac password?

No. Failshot doesn't photograph a wrong password at the macOS login or lock screen. It photographs whoever unlocks the Mac while it's on, and with email alerts on, which are optional, it emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.