Security

WaitToUnlock asks you to trust it with something sensitive: your Screen Time passcode. I take that seriously. Here, plainly, is how your passcode is kept safe.

• Encrypted at rest, never stored as plain text
• Decrypted only on the server, only at the moment you reveal it
• Never logged, printed, or shown to any third party
• Only you can reach your own data, checked on every request
• Served over HTTPS with a locked-down session and security headers

Details on each of these are below.

Your passcode is encrypted at rest

Your passcode is never stored in plain text. It's encrypted with Fernet (AES-128 in CBC mode, with an HMAC-SHA256 signature to detect tampering) before it's saved. The encryption key is derived from a secret using PBKDF2-HMAC-SHA256 with 480,000 iterations, which meets current OWASP guidance.

It's only decrypted at the moment you reveal it

The passcode stays encrypted the whole time it sits in the database. It is decrypted only on the server, for a single response, at the exact moment you choose to reveal it after the countdown ends. It is never decrypted ahead of time or "just in case."

Burner account passwords are protected the same way

If you use Complete Lockout, the generated password for your burner Apple Account is stored and handled exactly like your passcode: encrypted at rest with the same scheme, decrypted only on the server at the moments the flow shows it to you, and never logged.

You create the burner account yourself, directly with Apple. WaitToUnlock never asks for its email address, so I do not know which account the password belongs to. Even in a full database breach, the password alone points to nothing.

Passcodes and keys are never logged

Plaintext passcodes, encryption keys, and secrets are never written to logs, printed, or shown in error messages. No analytics tool and no third party ever sees your passcode.

I collect as little about you as possible

WaitToUnlock holds only the bare minimum needed to run the service: your email address, the date your account was created, whether you have lifetime access, and your encrypted passcode. There is no tracking profile and no selling of data, and you can delete your account and everything tied to it at any time.

You're the only one who can reach your data

All database access happens on the server. Your browser never talks to the database directly. Every request is authenticated with a Firebase ID token verified on the server, and every action is checked so you can only ever read or change your own passcode, never anyone else's.

The connection and your session are locked down

Traffic is served over HTTPS with HSTS enforced, so the connection between your browser and the server stays encrypted. The app sets a strict Content Security Policy and standard protective headers (X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a strict referrer policy). Your session is stored on the server, and the session cookie is HttpOnly with SameSite protection to reduce the risk of theft or cross-site attacks.

Abuse protection

WaitToUnlock has rate limits and other protections in place to detect and slow down automated abuse. Sign-in is Google-only by design, so I never have to store a password of yours at all.

Durability

Your encrypted passcode is stored in Google Firestore, which automatically replicates your data across multiple data centers. A single server, disk, or data center failing does not lose it. The app itself runs on managed, serverless infrastructure, so there's no single machine that can crash and take the service down with it.

An honest note on trust

Encryption protects your passcode from anyone who shouldn't have it, including in a database breach. One honest limit: the service has to decrypt your passcode to show it back to you, which means I can technically access it by decrypting it.

What I can promise is that I never look at it, never log it, and built the system to decrypt it only when revealing it to you.

And remember what this code is: a Screen Time passcode is a local setting on your own phone, not a password to your accounts. Even if someone saw it, all it does is change Screen Time settings on your phone, which they don't have physical access to.

If that still doesn't sit right, the refund promise always applies.

Found a security issue?

If you believe you've found a vulnerability, please email me directly at hello@waittounlock.com before disclosing it publicly. I read every message and will work with you to fix it quickly.