Cloak vs FaceGate: Which Mac App Locker Should You Use?

FaceGate and Cloak both stop an app from opening on your Mac until you prove it is you. They are built for different people. FaceGate is free, open source, and unlocks with your face. Cloak is paid, and covers apps, folders and files with encryption behind the lock.

What each one protects

FaceGate locks apps. When a locked app launches, FaceGate stops it and asks for your face, Touch ID or a PIN. The app and its data stay on disk as they are.

Cloak locks apps the same way, with Touch ID or a password. It also hides apps, and a hidden app is moved into an encrypted image, so it is gone from the Dock, Launchpad, Spotlight and the Applications folder. And it locks folders and single files, encrypted in place with AES-256, hidden until you unlock them.

Unlocking

FaceGate’s face unlock is the source of most of its support issues: camera not detected, the liveness head turn, the prompt showing up when you did not ask for it.

Cloak does not use the camera to let you in. Touch ID or a password. The camera is only used, if you turn it on, to photograph someone who fails.

The Mac password question

Cloak lets your Mac password work as a fallback by default, because that is what most people expect. If people around you know that password, you turn the fallback off in Settings and set a Cloak password. From then on only your fingerprint or that password opens anything.

Quitting and tampering

Both need authentication to quit. FaceGate ships an emergency hotkey that kills it, which you can turn off. Cloak relaunches itself if it is killed, and because hidden apps and locked folders are encrypted, removing Cloak does not expose them.

Install

FaceGate is not notarized by Apple. You install it with a script or Homebrew and click through a macOS warning. Cloak is signed and notarized and installs from a DMG like any other Mac app.

Side by side

	Cloak	FaceGate
Price	$9.99 once	Free
Touch ID	Yes	Yes
Face unlock	No	Yes
Locks apps	Yes	Yes
Hides apps	Yes	No
Locks folders and files	Yes	No
Encrypts	Yes	No
Intruder photo	Yes	No
Mac password shut out	Your choice	Yes
Auth to quit	Yes	Yes
Notarized install	Yes	No
Lock schedule	Yes	Not stated
Fake crash	Yes	Not stated
Offline, no account	Yes	Yes
Minimum macOS	13	14

Checked 10 September 2026. Cloak 2.0 rows added 22 October 2026.

Switching from FaceGate to Cloak

It takes about five minutes.

In FaceGate, unlock or remove your locked apps, then quit it and uninstall it, so two lockers are not guarding the same app.
Download Cloak, set up Touch ID or a password, and save the recovery key it gives you.
Press + under Locked apps and tick the apps you want behind Touch ID. Put anything nobody should see under Hidden apps.
Add private folders or single files under Locked folders & files, and turn off the Mac password fallback in Settings if other people know it.

The verdict

Cloak covers what FaceGate leaves open: folders and files, encryption behind the lock, an intruder photo, the Mac password switch, and a normal install. If you are leaving FaceGate for a specific reason, FaceGate alternative goes through each one.

Questions people ask

Can someone who knows my Mac password open my locked apps?

Only if you let them. Your Mac password works as a fallback by default. Turn it off in Cloak's Settings, set a Cloak password, and from then on only your fingerprint or that password opens anything.

What happens if someone force quits Cloak?

Cloak relaunches itself. Hidden apps and locked folders are encrypted, so they stay protected even if Cloak is not running or is removed.

Which Macs does Cloak run on?

Cloak runs on Macs with Apple Silicon (M1 or newer) and macOS 13 or later. It is signed and notarized by Apple and installs from a normal download.

Can I get a refund?

Yes. If Cloak is not right for you, you can ask for a full refund within 14 days of buying it.