Shoulder surfing on a laptop: what people see and how to stop it

Shoulder surfing is reading someone’s screen, or watching their hands, from beside or behind them. On a laptop a watcher picks up three things: what you type, passwords above all; what appears on its own, such as notification previews and sign-in codes; and whatever is open in the windows you are not looking at. On a Mac, Touch ID and AutoFill cut down the typing, notification settings deal with the pop-ups, and a fast way to blur or cover the screen deals with the rest.

It helps to know what someone can actually see from where they are, because the fixes are different for each.

What someone nearby can actually see

From the next seat, nearly everything at a normal text size: the sentence you are writing, the subject lines in Mail, the name at the top of a chat. They do not need to read it all at once either. Sitting beside you for an hour, they see a lot in passing.

From a few steps behind, less text, but more than people expect. Headings and large numbers, like a balance in bold on a banking page, can be read from further away than body text. Photos and video are recognizable from further still. And a familiar layout gives a lot away on its own: the colors and shape of a well-known site tell someone what you are doing even when they cannot read a word.

Walking past, a second or two of attention. What catches the eye in that time is anything that moves or changes: a banner sliding in, a video playing, a screen lighting up as you wake it.

Your hands. On a laptop the keyboard is in full view. A password field shows dots, but anyone watching your fingers can follow a short password, especially one you type slowly or several times a day. This is the original meaning of shoulder surfing, and the part a screen-only fix misses.

Type your password less often

The best protection for a password in public is not typing it where people can see.

1. Unlock with Touch ID. In System Settings, open Touch ID & Password and turn on Touch ID for unlocking your Mac, if your Mac or keyboard has a sensor. Waking your laptop in a cafe or on a train then takes a finger, not a password typed in view.
2. Let your Mac fill in passwords. The same pane has a switch for using Touch ID to fill in passwords. With saved passwords and AutoFill in Safari, a sign-in page needs a touch instead of a sequence of keys.
3. Use your Apple Watch if you wear one. The Touch ID & Password pane also has a section for letting the watch unlock the Mac when you are close.
4. When you have to type, shield it. Tilt the lid toward you and cover the keys with your other hand, as you would at a cash machine. It looks fussy and works.

macOS still asks for the password itself once after a restart, so try to restart at home rather than on the train.

Stop the screen announcing things

Notification banners are the most common way private text ends up on a screen without you choosing to show it, and sign-in codes are the worst case. When a site texts you a code, the banner can show the whole code to whoever is looking.

In System Settings, open Notifications and look at Show previews. The choices are Always, When Unlocked and Never. When Unlocked is often suggested, but it is the wrong choice for public places: you are using the Mac, so it is unlocked, so the preview shows. If you work in public a lot, choose Never. Banners still tell you that something arrived, and you open the app to read it.

For a focused session, turn on Do Not Disturb from Control Center, and nothing slides in at all until you turn it off.

Cover the screen the moment you notice

The built-in tools all work, with one catch: you have to notice the person first, and then act faster than they read.

• Command-H hides the app in front. Its windows vanish until you click its Dock icon.
• Control-Command-Q locks the Mac. The displays go dark soon after, and you unlock to come back.
• A hot corner. In System Settings, under Desktop & Dock, click Hot Corners and set one corner to Lock Screen. A flick of the pointer then locks the Mac without touching the keyboard.

Shoji adds two things to that list. The first is a quick blur of everything with no password: someone leans in, you blur, and esc brings the screen straight back when they have gone. You can put it on a hot corner or use it from the menu bar. The second is less to see in the first place. With Focus Blur, only the window you are using stays sharp and everything else softens, following you as you switch. A separate mode keeps Messages, Slack and Mail blurred unless you are the one using them, which covers the chat in the corner that people tend to read first.

The moment you come back

There is one moment in public that shoulder surfers wait for: you return to a locked laptop and type your password to get back in. Whoever is next to you gets to watch the whole thing, every time.

Touch ID solves most of it. Shoji’s lock, on Command-L, opens with Touch ID, or with your Mac password checked by macOS if there is no sensor. While it is shut, the keyboard belongs to the lock, so nobody can type into your apps while you are away. Each wrong password makes the next try wait longer, and you see every failed try when you come back, so you know whether someone had a go.

Shoji’s away timers help with the moments you forget. You can have the screen blur after a minute with no input and lock after five, or any timing that suits you, and it waits while a video or call keeps the display awake. After an away time you choose, the real macOS lock comes on too.

What these steps do not stop

• The window you are working in. If it is sharp for you, it is sharp for the person beside you. Software cannot change the angle a screen can be read from; only a physical privacy filter does that, and Shoji is not one.
• Cameras. A phone held up for a photo captures whatever is visible at that moment. A blur only helps if it is already on.
• Other apps and the network. Screen recording by other software, malware and network snooping are separate problems. A privacy screen covers what people nearby can see, nothing more.

One reassurance on the software side: the blur is drawn by macOS itself, so the app never captures the screen or reads your windows, and it asks for no Screen Recording, Accessibility or Full Disk Access permission. It is $14 once, free for 24 hours, and runs on macOS 14 or later, on Apple silicon and Intel.

Questions

Can someone really learn a password by watching me type? If they can see your hands and the password is short, yes. Long passwords typed quickly are harder to follow, and passwords you never type in public are safest of all. Touch ID and AutoFill get you most of the way there.

Is a laptop worse for shoulder surfing than a phone? The screen is bigger and the keyboard is in plain view, so there is more to see from further away. A phone is easier to tilt away. On a laptop, where you sit matters more.

Should I set notification previews to Never everywhere? If you often work in public, it is the simplest rule. If you mostly work at home, you can set Never only for the apps that carry codes and private messages, from each app’s own entry in Notifications settings.