Who unlocked my Mac? What macOS records, and how to get a photo

MacUpdated 14 October 2026

You came back to your desk and something was different: a window you didn't leave open, or the Mac awake when you left it asleep. macOS doesn't show you who unlocked it. Apple's Mac User Guide doesn't describe a list of unlocks for home users, but it does document a few records that show the Mac was used, and settings that make the next unlock harder.

Quick answer

macOS doesn't show you who unlocked your Mac. Screen Time can count how many times the Mac was woken, Apple menu > Recent Items lists apps and documents opened recently, and your Apple Account lists signed-in devices. None of these shows a person. A photo taken when the Mac is unlocked can show who it was.

Does my Mac keep a list of who unlocked it?

Not one that Apple documents for you to read. Apple's Mac User Guide covers Lock Screen settings, login options and Screen Time, but describes no screen that lists each unlock with a time and a name. And anyone who knows your password signs in as you, so even a record would only show your own account.

What Apple does document are records that show activity:

Screen Time, which counts how often the Mac was woken.
Recent Items, which lists recently opened apps, documents and servers.
The devices list in your Apple Account, which shows each device signed in with it.

What can Screen Time tell me?

Screen Time on a Mac shows how much time was spent in apps, how many notifications arrived, and pickups, which Apple describes as the number of times you wake your device. A pickup count higher than you'd expect on a day you were away is a sign of use. Apple describes it as a number, and doesn't say Screen Time shows the time of each unlock or who did it.

Open System Settings, then click Screen Time in the sidebar. You may need to scroll down.
Click Daily Average.
Use the Device pop-up menu to choose this Mac, then choose Day or Week above the chart.
Select Pickups to see how often the Mac was woken, or Apps & Websites to see which apps were used.

Apple says you can't see the reports until you turn on Screen Time, so if it was off on the day you're checking, there's nothing to see.

What else on the Mac shows recent use?

Recent Items shows apps and documents opened lately. If something there wasn't you, someone else may have opened it.

Choose Apple menu > Recent Items.
Look through the Applications and Documents sections.
Check the Servers section too, for connections you don't recognise.
If the Dock shows recent apps, look at that section as well. If it doesn't, Apple says you can switch on suggested and recent apps in Desktop & Dock settings.

Then check your Apple Account. Apple says a device is added to this list when you sign in with your Apple Account on it, including Android devices, Windows PCs and streaming devices you use for Apple Music or Apple TV.

Choose Apple menu > System Settings.
Click your name, then scroll down to the list of devices.
Click any device you don't recognise, then Remove from Account.

How can I get a photo of whoever unlocks my Mac?

Apple doesn't document a built-in way to take one. One way is an app that uses your Mac's camera when the Mac is unlocked. A Mac without a built-in camera needs one connected. On a Mac's built-in camera, a green light glows whenever the camera is on, so the person in front of it can see the camera is on. Use one only on your own Mac.

Failshot is one such app, and it is out now for Mac, downloadable from failshot.app, on macOS 14 or later. With Failshot on, it photographs whoever unlocks your Mac. With email alerts on, which are optional, it emails you about an unlock you don't confirm as yours (with the photo and the time), a wrong Failshot PIN or answer, or its camera access being switched off while it's on. Details are in the section below.

How do I stop someone unlocking my Mac next time?

Close the easy routes in. Apple warns that automatic login allows anyone to access your Mac simply by restarting it. In Lock Screen settings you can also have the Mac ask for your password soon after the screen saver begins or the display turns off.

Choose Apple menu > System Settings > Users & Groups. Set "Automatically log in as" to Off.
In System Settings > Lock Screen, set "Require password after screen saver begins or display is turned off" to a short time.
In System Settings > Lock Screen, you can also switch on "Show message when locked" to put contact details on the login window.

If your worry is about a partner or someone you live with, please don't go through their devices. In the UK, the National Domestic Abuse Helpline, run by Refuge, is on 0808 2000 247, and you can contact your local police. In an emergency, call 999.

Where Failshot fits

Screen Time tells you the Mac was woken. Recent Items tells you what was opened. Failshot adds a photo of whoever unlocked it.

With Failshot on, it photographs whoever unlocks your Mac, then records a 5-second video. Video is on by default and can be switched off. Sound is off unless you turn it on, and the app warns you that recording someone's voice without their permission is against the law in some places.
With the Mac's built-in camera, the green light comes on whenever Failshot uses it. Failshot's window then tells whoever unlocked the Mac that the unlock was photographed, and says when a video is recording.
Optional email alerts send you the photo and the time of any unlock you don't confirm as yours, with the video attached when it's ready in time. With alerts on, Failshot also emails you about a wrong Failshot PIN or answer, or its camera access being switched off while it's on. If you turn on location and allow it, an alert can also say roughly where your Mac was.
Photos are kept on your Mac. They leave it only if you turn on email alerts, the encrypted web vault (which lets you see them from any browser) or sharing with a company's security team.
Switching Failshot off, or quitting it from its menu, needs Touch ID or your own Failshot PIN plus your answer, never your Mac password. So knowing your Mac password isn't enough to switch it off in Failshot, and a wrong Failshot PIN or answer takes another photo. Like any Mac app, it can still be force-quit.
If you confirm it was you, or switch Failshot off, before the alert email goes, and no wrong PIN or answer was entered, the photo of your own unlock is deleted. You can delete an unlock's photos later from Unlocks. An email already sent stays in your inbox.

Failshot is free to download, but turning it on needs Failshot Pro, and there's no free trial. Failshot Pro is £3.99 a month or £23.99 a year, VAT included, for as long as you stay subscribed, if you subscribe by 31 October 2026. From 1 November 2026 new subscriptions are £5.99 a month or £35.99 a year.

What it doesn't do: it doesn't photograph a wrong password at the macOS login or lock screen. It doesn't photograph the first login after a restart or a log out, and unless you've set it to start at login, it stays off until you open it again. Like any Mac app, it can be force-quit, and it closes when the Mac logs out, restarts or shuts down, without asking for Touch ID or your Failshot PIN. Until it's open again, unlocks aren't photographed. It watches only the Mac user account it runs in, so a sign-in to another account or Guest isn't photographed. It can't find a lost Mac on demand: location, if you turn it on, is noted only at an unlock. It has no remote lock or wipe. For those, use Apple's Find My. Failshot is for your own Mac only. iPhone, Android and Windows versions are coming soon.

Questions people also ask

Can I see a history of logins on my Mac?

Apple's Mac User Guide doesn't describe a login or unlock history screen for home users. Screen Time shows pickups, the number of times the Mac was woken, and Recent Items lists recently opened apps and documents. Neither shows who was at the Mac.

Does a Mac take a photo when someone enters the wrong password?

Apple doesn't document any built-in feature that does this. Failshot doesn't either: it photographs whoever unlocks the Mac while it's on, not a wrong password typed at the macOS login or lock screen.

What does pickups mean in Screen Time on a Mac?

Apple describes pickups as the number of times you wake your device. Apple doesn't say Screen Time shows who woke it.

How do I know if someone used my MacBook while I was out?

Compare the day you were out with your normal use. Check pickups in Screen Time, look at Apple menu > Recent Items, and check the devices list in your Apple Account for anything you don't recognise.

Can someone get into my Mac just by restarting it?

Yes, if automatic login is on. Apple warns that automatic login allows anyone to access your Mac simply by restarting it. Turn it off in System Settings > Users & Groups by setting "Automatically log in as" to Off.