Apple Watch Auto Unlock Comes to Windows with Open-Source Tool

Windows can also unlock with Apple Watch

Have you used a Mac? Wearing an Apple Watch and returning to the computer, the Mac unlocks itself – that's Apple's official Auto Unlock. Windows never had this feature, so every time you return to your desk you have to type your password again.

So I built Watch Unlock Windows: walk away with your Apple Watch and the computer locks; walk back and it unlocks automatically.

Project link: Watch Unlock Windows

How it decides you've left or come back

It relies on the Bluetooth signal strength (RSSI) of the watch:

• Leaving: After locking, once the watch's signal drops below the "away threshold", you're considered to have walked away.
• Returning: When the signal comes back to the "near threshold", it triggers an unlock.

In my tests, walking away and returning unlocks in about 0.17 seconds.

Note that only "leave first, then return" triggers an unlock. If you stay near the computer after locking, it won't auto-unlock; you still need to type your password.

graph TD
  L[Locked] --> F{Watch crossed away threshold}
  F -->|No, always nearby| K[Stay locked, enter password to unlock]
  F -->|Yes| B{Back to near threshold}
  B -->|No| K
  B -->|Yes| S{Seamless unlock}
  S -->|On| U[Unlock]
  S -->|Off| I{Keyboard/mouse action while watch is still near}
  I -->|Yes| U
  I -->|Left again| K

So how does it know which watch is yours? The Apple Watch rotates its Bluetooth broadcast address, so it can't be identified by address. During pairing, the program goes through an administrator confirmation and reads the watch's IRK (Identity Resolving Key) that Windows saved when pairing. With the IRK, it can recognize your watch from the ever-changing random addresses.

Unlocking is handled by a Windows login component (Credential Provider): when the background determines you've returned, it hands the saved account password to the system login screen for verification.

Getting started takes four steps

First, download the installer from Releases, approve one administrator confirmation, install via the wizard, then launch Watch Unlock from the Start menu.

Step 1: Pair. In the "Nearby Scan" section, open the pairing window, select this computer in the watch's Settings → Bluetooth, and confirm the Windows pairing request that pops up.

Step 2: Bind. In "Windows paired devices", click "Bind this device", approve an administrator confirmation, keep the watch close, and wait at most 30 seconds.

Step 3: Enter password. In "My Devices", enter your Windows account password. Note it's the account password, not a PIN, because the real password must be handed to Windows for verification during login.

Step 4: Test. Lock, walk away, then walk back – the computer unlocks. Each lock and unlock is recorded in an "Unlock History" so you can check how accurate the detection is.

The distance thresholds can be adjusted in "My Devices". RSSI is greatly affected by obstruction, so it's best to walk around your own desk a few times before finalizing.

Two unlocking modes

Unlock mode can be set per device:

• Seamless unlock (on by default): it unlocks as soon as you approach.
• Seamless unlock off: after returning, you must move the keyboard or mouse to unlock. If the watch stays nearby, it waits for your input; if you walk away again, this return won't count.

A few extra features:

• Startup with Windows (on by default): runs in the background on each login. However, the first login after reboot still requires manual password entry because the background hasn't started yet.
• Unlock notification (optional): sends a Bark notification to your phone after unlock. Notifications don't affect the unlock decision.

Where the password is stored and is it secure

To log in for you, the password must be recoverable; there's no way around that. So I've been conservative in storage:

• The account password, each watch's IRK, and the Bark key are encrypted with Windows' built-in DPAPI under the current account, stored in %LOCALAPPDATA%\WatchUnlockWindows\, a directory accessible only to you and SYSTEM.
• The background only hands the password to the system login screen in the same session (SYSTEM-level LogonUI), and the background itself must run from the Program Files directory that only admins can write to.
• The IRK never appears in command lines, logs, or the UI.

Other accounts can't read these files; if the disk is removed, without your account password they can't be decrypted. But if malicious software is already running under your identity, it can't be defended against.

Limitations, stated clearly

Its security is not comparable to Apple's official Auto Unlock. Be aware before using it:

• It doesn't know if the watch is on your wrist. I tested four states, and the watch's Bluetooth broadcast content is identical in all of them. So even if you're not wearing the watch, or someone else holds it near, it may still unlock.
• It can't defend against broadcast replay or relay attacks. It only checks the watch identity (IRK) and signal strength (RSSI).
• RSSI doesn't equal distance. Walls, body obstruction, and watch orientation all affect the signal, occasionally causing false leave/return detection.
• With seamless unlock off, it can't confirm you are the one operating. When the watch is nearby, someone else moving the keyboard or mouse will also unlock.
• Remote Desktop sessions are not supported; the installer is not code-signed yet.

So I recommend using it at home or in a trusted office environment, not as a high-strength security solution.

Tested: Windows 11 Pro + Apple Watch, one-click binding, walk-away-return unlock, waiting for keyboard/mouse input when seamless unlock is off, staying locked when you remain near. Not tested: binding two watches simultaneously, recovery after sleep or Bluetooth failure, switching users. If you test these, feedback is welcome.

Want to modify it yourself

The project structure is roughly:

apps/desktop/            Tauri UI
backend/crates/domain    Distance strategy (pure logic)
backend/crates/watchd    Background: Bluetooth scan, session detection, secret storage, notifications
backend/crates/provider  Windows Credential Provider
scripts/                 Build, privacy checks, third-party license list

The backend uses Rust, the UI uses Tauri. To integrate other watches or bands, implement the DeviceAdapter in backend/crates/watchd/src/adapters.rs; the distance strategy, credential storage, and login component can be reused directly.

Finally

Source code and installer are on GitHub. If interested, install and try it. If useful, give it a star:

github.com/whyy1/watch-unlock-windows

This project is based on xiaoka520/watch-unlock-windows. Apple Watch, Windows, and other names are used only to describe compatibility; this project is not affiliated with Apple.