跪拜 Guibai
← All articles
Windows · Rust · Open Source

Apple Watch Auto Unlock Comes to Windows with Open-Source Tool

By 小熊吃保安 ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Windows users get a practical way to replicate Apple's hands-free lock/unlock experience, but the tool explicitly acknowledges its security is weaker than Auto Unlock: it only checks IRK and RSSI, so it cannot tell if the watch is on your wrist or if the signal is being replayed. It is best suited for trusted home or office environments, not as a high-security barrier.

Summary

Watch Unlock Windows is an open-source utility that gives Windows the same walk-away lock and approach-unlock behavior macOS has with Apple Watch. It tracks the watch's Bluetooth signal strength (RSSI): when you leave, the signal drops below a threshold and the PC locks; when you return and it crosses a higher threshold, it unlocks. The developer tests show about 0.17 seconds between returning and unlocking.

The watch is identified using the IRK from Windows' pairing data, because Bluetooth addresses rotate randomly. Unlock happens through a native Credential Provider that submits the saved account password to LogonUI. Setup involves four steps: pairing, binding with admin confirmation, entering the Windows account password (not PIN), and testing. Users can disable seamless unlock to require a keypress or mouse move, and can get a Bark push notification after each unlock.

Takeaways
— The watch's Bluetooth RSSI is used as a proximity proxy: leaving locks the PC, returning unlocks it; the developer measures about 0.17 seconds for the unlock after returning.
— Identification is based on the IRK (Identity Resolving Key) stored by Windows during pairing, since the watch's Bluetooth address rotates randomly.
— Unlock is handled by a Windows Credential Provider that submits the saved account password to LogonUI.
— Setup involves pairing, binding with admin confirmation, entering the Windows account password (not PIN), and testing; thresholds are adjustable.
— Seamless unlock can be turned off to require keyboard/mouse input after returning; this mode waits for input and ignores a return if you walk away again.
— Credentials (account password, IRK, Bark key) are encrypted with Windows DPAPI in %LOCALAPPDATA%\WatchUnlockWindows, accessible only to the current user and SYSTEM.
— The tool cannot verify the watch is worn, does not protect against replay/relay attacks, and RSSI does not equal distance; it is not recommended as a high-security solution.
— It supports Windows 11 Pro + Apple Watch; untested for dual watches, sleep/Bluetooth failure recovery, and user switching.
— The backend is written in Rust, the UI in Tauri, and a DeviceAdapter interface lets developers add support for other wearables.
Conclusions

Using RSSI as a presence signal is inherently fragile, but the tool is honest about it, which makes it a practical convenience for trusted environments rather than a security guarantee.

The architecture separates distance logic, the watch daemon, and the Credential Provider, so adding support for other wearable brands is straightforward via the DeviceAdapter.

Storing plaintext-recoverable credentials is unavoidable for any auto-login tool; DPAPI protects against other accounts and disk theft, but not against malware running as the current user.

The project forks an earlier incomplete version, showing that a small amount of Rust code plus a native Windows component can bring a polished macOS feature to Windows.

Concepts & terms
RSSI
Received Signal Strength Indication, a measure of signal power from a Bluetooth device. It is used here to estimate how close an Apple Watch is, though obstacles and orientation affect its accuracy.
IRK
Identity Resolving Key, a secret stored during Bluetooth pairing that allows a device to recognize another device even when its Bluetooth address changes randomly.
DPAPI
Data Protection API, a Windows service that encrypts data using keys tied to the current user account, so only that user can decrypt it.
Credential Provider
A Windows component responsible for collecting and validating login credentials; here it is used to automatically submit a saved password to LogonUI.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗