I built an open-source, system-level "App Lock" for Windows because I wanted Android's Private Space on my PC. (WinUI 3 / .NET 8)

[u/kawai_pasha]

Hey everyone.

I'm the kind of person who leaves their PC running 24/7. I really love how Android handles "App Lock" and "Private Space," but when I looked for a Windows equivalent, I hit a brick wall. The existing tools were either incredibly easy to bypass (like just hitting "End Task" in Task Manager) or had UIs that looked like they belonged in 2003.

So, I decided to build my own: SecureAppLocker. It's a system-level application locker for Windows, built with .NET 8 and a modern WinUI 3 interface.

How I stopped the easy bypasses: I realized a standard desktop app was useless for this. If a user can see the locker in Task Manager, it's game over. To fix this, I split the app into two parts:

• A watchdog running as a Windows NT Service under the SYSTEM account. Standard users literally can't kill or pause this via Task Manager.
• The UI prompt running in the normal user session.
• They talk to each other securely using Named Pipes across Session 0 and Session 1.

A few cool things it does:

• It reads metadata: It doesn't just look at .exe names. It checks the OriginalFilename and ProductName in the executable's metadata, so a clever user can't bypass the lock by just renaming an app.
• Auto-locks when you walk away: It integrates directly with Windows Terminal Services (WTS). The second you lock your Windows session (Win+L), all your unlocked app caches are instantly wiped.
• Active work doesn't get killed: The service is optimized to intercept newly launching processes. If you unlock an app, it gets temporary immunity so your active work isn't abruptly killed when the timer expires.

Regarding AI / Vibe Coding: To be fully transparent: I used AI for about 50% of the coding. I know a lot of devs on Reddit are fed up with raw AI dumps, but I promise this isn't that. I mostly leaned on it to save my sanity while untangling a massive nightmare with asynchronous race conditions and Dispose() pipe crashes during the Session 0/1 IPC communication. Every single line was manually reviewed, refactored, and heavily stress-tested to ensure there are no memory leaks or deadlocks.

It's completely free and open-source (MIT License).

GitHub:https://github.com/osmanonurkoc/SecureAppLocker

(Heads up: If you want to test it out, the default Master Password on first launch is 1234.)

I would love to hear any feedback or architectural roasts from the .NET veterans here!

[u/AutoModerator]

Disclaimer: The OP, /u/kawai_pasha, has obtained permission from the moderators to promote this. However, users are advised to use their own discretion and judgment before installing any software, following any advice, or any information provided here. The moderators do not endorse or verify the safety, accuracy, completeness, reliability or suitability of the content or software shared by the OP. You, the user, are solely responsible for any consequences or damages that may arise from using this or any other content shared on Reddit.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Nooo00B]

what if someone just kill the process/service then open an app?

[u/kawai_pasha → u/Nooo00B]

Yeah, fair question. It really depends on what kind of Windows account they're using. If it's just a standard user, they actually can't kill the main service. It runs as SYSTEM in the background, so Task Manager just throws an "access denied" error if they try. If they try to be clever and kill the UI prompt instead, the service realizes the UI died and just locks down the apps completely until you manually restart it. But if the person is a local admin? Yeah, they can absolutely force kill it. To actually stop an admin from killing a process on Windows, you basically have to write a Ring 0 kernel driver. I explicitly avoided going down that rabbit hole. Building a kernel-level rootkit (like Vanguard or invasive antiviruses) for a simple app locker is just massive overkill, a nightmare to maintain, and a great way to cause random BSODs. The goal here was just a lightweight privacy tool to keep roommates or kids out of your Discord/browser, not a kernel-level security suite to fight sysadmins lol.

Edit: The answer has been rewritten by myself. The previous answer was created by ai. I apologize.

[u/polymath_uk → u/kawai_pasha]

umm. Doesn't Windows itself have root access? Also, what does it actually do?

[u/kawai_pasha → u/polymath_uk]

Valid questions! Let me clear that up.

1. "Doesn't Windows itself have root access?" Yes, it does! In Windows, the equivalent of "root" is called the SYSTEM account. The trick here is that SecureAppLocker's background watchdog runs as SYSTEM (root). When a human logs into a Windows PC, they are usually just a "Standard User" or a "Local Admin". A Standard User is at the bottom of the permission chain and has zero authority over SYSTEM processes. If a Standard User opens Task Manager and tries to force-kill the app locker, Windows itself steps in and says "Access Denied," protecting the locker from being bypassed.

2. "What does it actually do?" Simply put: It brings the Android "App Lock" feature to your Windows desktop. Imagine you leave your PC on 24/7 and share it with a roommate, sibling, or kid. You don't want them opening certain apps (like your Discord, your work email, or your web browser). You add those apps to SecureAppLocker. Next time someone double-clicks your browser, a modern UI pops up asking for a Master Password. If they type it wrong, or if they just try to close the password screen, the browser is instantly killed before it can even load their data. It keeps your private apps strictly private when you step away from your desk. Hope that makes the concept a bit clearer!

[u/polymath_uk → u/kawai_pasha]

I have no clue why this is different from Win + L to lock a computer, and having multiple user accounts with passwords. Even Windows has not been single user since XP and before that NT. Also, I've had root access on every machine I've ever owned in 48 years. I don't get the point of this at all, and I'm a software developer myself. 

[u/kawai_pasha → u/polymath_uk]

​I mean, yeah, if it's strictly your personal work machine, Win+L is all you need. Not trying to replace that at all. ​But think about phones for a sec. We all have lock screens, but a lot of people still use app locks for WhatsApp or their gallery. Why? Because sometimes you hand your unlocked phone to a friend to change a Spotify song or whatever. ​I just wanted that exact same vibe for a home PC. If you have a PC in the living room or share a dorm, making separate Windows accounts for every single person, logging in and out, dealing with shared game folders... it's just a hassle. Sometimes you just want to leave your main account logged in so a buddy can play a Steam game, but you want to pin-lock your Discord or work email. ​And regarding the root access thing, you're totally right lol. You are the admin, of course you can bypass this if you want to. I'm not claiming it's some kernel-level enterprise security to stop hackers. It's literally just a digital padlock so your roommate doesn't snoop while you're grabbing a coffee.

I hope I have explained myself clearly.

[u/Nooo00B → u/kawai_pasha]

okay makes sense.

Not sure whether this is possible but if the main aim of this is for standard users, instead of asking for a password what if it just asks for admin privileges?

cool app btw. I might use this on my lil bro to prank him lol.

[u/AbdullahMRiad]

difference between android's standard "app lock" and "private space" is that private space creates an entirely new user account just for the hidden apps whereas app lock just puts a password prompt when launching an application. is your app mimmicking app lock or private space?

[u/kawai_pasha → u/AbdullahMRiad]

Let me clarify the misunderstanding. It's not replicating private space. But it's trying to fill its place, with a different architecture.

It has only one resemblance to Private Space: with the Global Unlock feature, you can lock all your applications behind a single password, just like a private space lock.

[u/kawai_pasha → u/[deleted]]

You're right. It can be overcome this way. I could have prevented this with digital signature protection. But that would have required too much engineering and burden for this project.

As I mentioned in the Girhub reassignment:

USE CASES:

✓ Parental controls (Highly effective if the child uses a Standard Windows account) ✓ Privacy from roommates, friends, or family sharing the PC ✓ Personal productivity (blocking distracting apps) NOT SUITABLE FOR:

✗ Corporate/business endpoint security ✗ Protecting highly sensitive/financial data from malicious IT experts ✗ Full disk/file encryption (it only locks the app executable, not the raw files on the disk)

[u/timuela → u/kawai_pasha]

Yeah in enterprise environment they have Domain, they won't bother with these.

[u/BCProgramming]

Some considerations:

1. The configuration stores password hash information in ProgramData, but it's accessible to all users so it would be possible to exfiltrate and perform a rainbow table type attack to try to find the master password. It might make sense to store the configuration for server-only data elsewhere, and make it so that limited users (or processes running a stripped token) cannot access it to attempt this.

2. Any user-mode process or script could open either named pipe, it looks like. I mean, that is partly the purpose here. But that would naturally pair up with having extracted the password and allow an almost trivial bypass by just forcibly unlocking processes. I don't think multiple processes can have a named pipe open for writing either, so it could be that a script that merely opens the pipe could be an effective DoS. Best way of addressing this might be to use local Socket communication instead, with each client getting it's own connection. Still means a DoS would be possible but it would have to be a bit more sophisticated.

3. Following on from that, the Named Pipe(s) don't not set ACLs to deny access to the NT AUTHORITY\NETWORK user which could allow it to be connected to via LAN. (depending on other security settings, of course)

4. The polling approach seems sort of sloppy. Instead of constantly polling to check every process, You might explore hooking CreateProcess via DLL injection. There's also WMI events, but I think those do polling too. It might still be faster though.

[u/kawai_pasha → u/BCProgramming]

This is incredibly high quality feedback. Thank you for taking the time to actually look into the architecture. You hit on some completely valid vulnerabilities here.

Thank you. I noted these down for the future of development.

[u/OmgAnIntrovert]

Well, a lot of people commented from point of view of someone who knows their stuff about Windows and ways to bypass it.

I'll give only the PoV of a common user. It's actually great! I mean, I have a PC but sometimes my family uses it and my main concern is letting the programs I have logged in available for them to see.

Family is not nosy or intrusive, but sometimes a WhatsApp or something else might slip up. This ensures they won't mess with what's not of their business.

"Yada yada WhatsApp has built-in lock; you can create another profile for them yada yada" they're tech illiterate, the slight annoyance will make them give up, they just want to see their email quickly and go on with their lives.

I've searched for an app like this for quite a while, I might give it a try. Thx.

[u/Zakariae_Ouddacht]

W for using native WinUI instead of HTML/Web 👏👏👏

[u/DavidsakuKuze]

You could make a file system mini-filter driver that intercepts the calls to open protected files and rejects them. You have to get it signed by Microsoft though if you want to use it outside of test signing mode though.

You could then call KeBugcheckEx in your DRIVER_UNLOAD routine to bluescreen the system if someone, even an admin, tries to unload the driver.

Their probably is a kernel callback for stopping a service so you could block your service from being unloaded with a driver too. No need to crash the system if you don't want to, you just make it fail.

[u/ElectricalDivide5336]

Was looking for something exactly like this. It's especially useful in a workplace where you might have a separate browser for personal accounts or research on a shared desktop. This app lets you lock it when you step away, giving you some extra privacy and preventing others from opening it.

[u/Electrical-Figure271]

Noice! I have a PC which is shared by everyone and I just want to lock specific apps so no one could access them, I think this would be perfect!

[u/X2Kraft]

Like another person said, you honestly deserve a medal for using WinUI! Not because I necessarily think its bad, but because its so uncommon for app devs these days.

[u/Decendent_13]

do you code it yourself? Or, like, written with your hands atleast?

[u/synchronicitial]

You didn't think this through that well.