Mac Kiosk Mode Without MDM: Honest Options for a Locked-Down Display

You have one Mac and one job for it: a dashboard on the office wall, a demo at a conference booth, a sign-in page at reception, a slideshow in a shop window. You want it to show one thing and resist anyone who walks up and starts poking at it. You don't have — or don't want — a mobile device management (MDM) server for a single machine.

Here is the honest situation first: macOS has no built-in kiosk mode. iPhone and iPad have Guided Access and Single App Mode; the Mac doesn't. The strongest lockdowns on macOS come from configuration profiles delivered by MDM, and many restriction settings only take effect on MDM-enrolled Macs. Without MDM, you build a "good enough" kiosk out of several free, built-in pieces. Here they are, roughly in the order you'd set them up.

1. Create a dedicated standard user

Never run a kiosk from your own admin account. In System Settings → Users & Groups, add a new Standard user (not Administrator) just for the kiosk. A standard user can't install system software or change most system settings without an admin password, which removes a lot of risk at once. Keep your own files out of this account entirely.

2. Restrict apps with Screen Time

Screen Time (System Settings → Screen Time, while logged in as the kiosk user or managed from an admin account) is the closest thing to an allowlist macOS offers without MDM. Two features help:

• Content & Privacy restrictions — limit web content, block account changes, restrict the store.
• Downtime with Always Allowed apps — schedule Downtime to cover the hours the kiosk runs, and add only the kiosk's app to the Always Allowed list. Other apps are then blocked behind a Screen Time passcode.

Set a Screen Time passcode the kiosk user doesn't know. It isn't bulletproof, but it stops casual exploration well.

3. Launch the kiosk app automatically

Add your app to the kiosk user's Login Items (System Settings → General → Login Items) so it opens on login. If you want the Mac to log straight into the kiosk account after a restart, enable automatic login in Users & Groups. Note that macOS disables automatic login when FileVault is turned on — decide which matters more for this machine.

For a web-based kiosk, Google Chrome has a real kiosk flag that opens a page fullscreen without the address bar or tabs:

open -a "Google Chrome" --args --kiosk https://example.com

Put that in a small shell script or Automator app and add it to Login Items. Safari has no equivalent flag; you can only make it fullscreen.

4. Hide the chrome around it

• Auto-hide the Dock (System Settings → Desktop & Dock).
• Auto-hide the menu bar (System Settings → Control Center → "Automatically hide and show the menu bar" → Always).
• Turn off notifications for the kiosk user, or set a Focus that blocks them, so banners don't pop up over your content.
• Remove hot corners and gestures you don't need.

5. Keep it awake and recovering

• In Battery or Energy settings, stop the display and the Mac from sleeping while on power. Or run caffeinate -d from the kiosk's startup script.
• On desktop Macs, enable "Start up automatically after a power failure" in Energy settings, so a power cut doesn't leave a dark screen.
• Turn off automatic macOS update installs for this machine and update it by hand on a quiet day, so a restart doesn't surprise you mid-event.

More on the sleep side in how to keep a Mac awake while it's locked.

6. Physically limit input

The most effective kiosk measure is often physical. For a display-only kiosk, don't leave a keyboard or mouse out at all — run a Mac mini with the input devices locked in a drawer. For an interactive kiosk, offer only a mouse or a touch-capable display rather than a full keyboard.

Where VibeLock fits — and where it doesn't

Many "kiosk" needs are really "show this, and don't let anyone touch it": a live dashboard during a meeting, a demo looping at a booth while you talk to someone, a long job you want visible on a shared desk. Building a separate locked-down user account for that is overkill. That's the case VibeLock handles:

• the apps you pick stay visible; every other app is hidden and kept hidden;
• all keyboard and mouse input is blocked — including ⌘Tab, Spotlight, Force Quit and ⌘Q;
• the display stays awake while locked;
• you unlock with Touch ID or your Mac login password.

For a lightly interactive setup, you can mark one app as Accessible While Locked: visitors can then type and click in that app while everything else stays locked. ⌘Tab is allowed in this mode so they can switch back to it, while ⌘Q, Spotlight and Force Quit stay blocked. Be careful what you make accessible — a browser can still navigate anywhere, and a terminal means full shell access.

What VibeLock is not: a hardened, unattended public kiosk. It is a lock you start by hand from the menu bar — after a restart, it opens at login but isn't locked until you lock it. It can't block trackpad Space swipes (it covers blocked apps with a shield instead), the power button, or media keys. If the Mac will sit unattended in a public place for days, use the dedicated-user setup above (or real MDM) and treat VibeLock as an extra layer at most. The full list of what it does and doesn't block is on the security model page.

Summary