iPhone app plus a free Mac companion
Your Mac asked for a password and you are not at the desk. Nodlock pushes the prompt to your phone. You pass Face ID, see the dialog, type the password, and the Mac types it in. Ten seconds, from the sofa or from another country.
No account. No sign-up. No server run by us.
Nodlock
1Password wants to unlock
Prompt on your Mac
1Password
Enter your account password
Paired with studio-mini
Features
Remote builds, long-running agents, a headless Mac mini, a desktop that keeps asking for a password while you are away. Nodlock turns a blocked job into a tap on your phone.
The Mac companion watches for 1Password unlocks, SecurityAgent password boxes and keychain prompts. The second one shows up, your phone buzzes. No polling, no checking in.
Open the notification, pass Face ID, and look at a live screenshot of the dialog. You know exactly what you are approving before you type a character.
Point $BROWSER at the push-url shim and every device-code, OAuth or SSO link an agent opens lands on your phone as a tappable link, instead of a browser window nobody is sitting in front of.
There is no Nodlock account and no Nodlock server. Your phone talks to your Mac over a channel you set up, and the developer never sees any of it.
How it works
A built-in demo mode walks you through the whole flow before you install anything on the Mac. Tap "Try a demo" on the pairing screen.
The Mac half is a free, open-source menu-bar app for macOS 14 or later. Grant it Screen Recording and Accessibility, open Setup, and scan the pairing QR with your phone. Host and token land in the iOS Keychain.
The companion spots the dialog, takes a ScreenCaptureKit screenshot, and sends a push through APNs. The payload is a title and the name of the app that owns the prompt. The screenshot stays on your Mac.
Open the notification, pass Face ID, read the screenshot, type the password, tap Unlock. The Mac types it into the dialog with CGEvent. The job that was blocked keeps running.
Security model
Nodlock types passwords into your Mac, so the design starts from what an attacker would need. Every decision below is in the source, and you can read it.
No system is perfect. If you find a security issue, open an issue on GitHub or write to support@nodlock.app.
The Mac companion listens on 127.0.0.1:8377 and nothing else. It never opens a port on a routable interface. Remote access is a tunnel's job, and the tunnel is yours.
APNs carries a title and the prompt's owner, so Apple never sees a screenshot or a password. The screenshot and the keystrokes travel over the panel connection, which terminates on loopback on your Mac.
16 random bytes from SecRandomCopyBytes, stored at mode 0600. Every request carries it, and the Mac compares it in constant time. The pairing QR is the only place it is ever displayed.
Loading the panel with a valid token sets an HttpOnly, SameSite=Strict cookie, so a forged cross-origin POST cannot ride along.
Put a Cloudflare Access policy on the tunnel hostname and the panel sits behind your IdP, not just a bearer token. The pairing QR carries the service token, so the phone sends the Access headers for you.
A password goes phone to panel to CGEvent keystrokes in the dialog. It is not written to disk, not logged, not cached, on either device.
The unlock screen sits behind LocalAuthentication and re-locks the moment the app goes to the background. Pairing credentials live in the iOS Keychain, not in UserDefaults or a file.
Screen Recording and Accessibility are granted to the companion once. They stick across restarts because a signed bundle holds them, not a scripting runtime.
Nodlock is free and open source. The Mac companion is Swift 6 with no third-party dependencies, so the code that screenshots your dialogs and types your passwords is a short read, not a black box.
macOS 14 or later on the Mac side. iOS 17 or later on the phone.