How to tell if someone used your Mac while you were away
· 7 min read
Your Mac keeps more of a record than it shows. The power log notes every time the display was turned on, Finder and the Apple menu remember what was opened recently, Safari keeps history by day and time, and Screen Time, if it was on, shows which apps were used in each hour. None of it proves who was at the keyboard, but together it tells you whether anything happened while you were away.
Start with the power log
If the Mac was asleep when you left, anyone using it had to wake it, and macOS writes that down. Open Terminal (in Applications, Utilities) and run:
pmset -g log | grep "Display is turned on" | tail -20
Each line starts with a date and time. Compare them with when you were out. A display that came on at 1:10 in the afternoon while you were at lunch is worth a closer look.
For more detail about why the Mac woke, run:
pmset -g log | grep " Wake " | tail -20
The end of each line gives a reason. On a laptop you will often see lid when the lid was opened and HID Activity when a keyboard, trackpad or mouse was used. The Mac also wakes briefly on its own for maintenance, but those wakes do not usually turn the display on, which is why the first command is the more useful one.
Two limits apply. The log goes back days rather than months, so check soon. And it only records waking: if you walked away with the Mac awake and unlocked, there was nothing to wake and nothing to record.
You may also come across last, which lists logins. On a Mac it mostly shows Terminal sessions and logins at the login window. Unlocking the screen is not a login, so it does not appear there.
Look at what was opened
Next, look for files and apps that were opened during the gap.
- Apple menu, Recent Items. Lists recent apps, documents and servers. It is short, but it is the quickest place to glance.
- Finder Recents. Click Recents in the sidebar, choose View, as List, and sort by Date Last Opened. If that column is missing, Control-click any column header and add it.
- A Finder search by date. In a Finder window press Command-F, change the first pop-up to Last opened date, and set it to is today. That catches files Recents leaves out.
- Open Recent in each app. Mail, Preview, Pages and most document apps keep their own list under File, Open Recent.
Terminal can run the same date search across your home folder:
mdfind -onlyin ~ 'kMDItemLastUsedDate >= $time.today'
That lists every file Spotlight recorded as opened today. Change $time.today to $time.today(-1) to include yesterday. Keep the single quotes; without them the shell rewrites $time before Spotlight sees it.
Browser history, messages and Screen Time
Safari. Choose History, Show All History. Entries are grouped by day with a time for each, so a burst of pages at an hour you were out is easy to spot. A Private window leaves no history, so an empty stretch proves less than it seems. Other browsers have their own history pages.
Messages and Mail. Check the Sent mailbox and your recent conversations for anything you did not send.
Screen Time. If Screen Time was already on, System Settings, Screen Time, App & Website Activity shows the day as a chart split into hours. Selecting a bar narrows the list to the apps used in that hour. It is the clearest record of the lot, and worth switching on now if it was off, because it only records from the moment it is enabled.
What these records cannot tell you
Be careful about what the evidence actually shows.
- Who it was. Everything above records your account, not a person. If two people know the password, the log cannot tell them apart.
- Reading without touching. Someone who reads what is already on screen leaves no trace.
- A careful visitor. Recent Items can be cleared, a Private window leaves no history, and a file previewed with Quick Look does not usually count as opened.
If what you found points to something other than a curious housemate, such as settings you did not change, apps you did not install, or a login you cannot explain, What to do the hour after you think your Mac was compromised is the better guide.
Make it harder next time
The best fix is a Mac that locks itself the moment you step away.
- Lock the screen when you get up. Control-Command-Q locks it instantly. It is also in the Apple menu as Lock Screen.
- Require the password immediately. In System Settings, Lock Screen, set Require password after screen saver begins or display is turned off to Immediately. Require a password immediately after a Mac sleeps covers the details.
- Shorten the timers. In the same pane, a shorter screen saver and display-off time means a Mac you forgot to lock locks itself sooner.
- Give regular borrowers their own account. A separate standard account keeps your mail, messages and browser out of reach. Standard, admin and guest accounts explains which to use.
For the files that matter most, a second lock helps, because a screen lock only works if you remember it or the timer runs out first. Hushbox locks a chosen file or folder where it sits, from the Finder right-click menu, turning it into an AES-256 encrypted disk image. It locks again by itself when the screen locks, when the Mac sleeps, or after 5, 15, 30 or 60 minutes idle, and it opens with Touch ID or your Hushbox password. While an item is locked, what is inside stays out of Spotlight, Finder Recents and Quick Look previews, so the checks above would find nothing to see. The item’s name still shows in Finder, so give private folders names that do not announce what is inside. Hushbox is $9 once for 2 Macs after a free 24-hour trial, and unlocking always stays free.
Questions
Can I see failed password attempts on a Mac? Not in any simple place. They are written to the system log, but macOS has no screen that lists them, so the wake times above are the practical evidence.
Does a Mac take a photo of someone who types the wrong password? No. macOS has no built-in feature that does this.
Would Find My show that someone used the Mac? No. Find My shows where a Mac is, not what was done on it. Find My on a Mac covers what it can do.