Lock, Log Out or Shut Down?

The short answer

For almost every moment you step away during the day, locking is the right choice. It is the fastest, it leaves your apps and documents open exactly where you left them, and it puts your password in front of the screen straight away. Logging out is for when someone else needs to use the Mac, or when you want a clean, empty session at the end of a stretch of work. Shutting down is for travelling, for a long absence, or for the end of the day if you prefer the Mac fully off, and it is the most secure of the three because a powered-off Mac with disk encryption switched on is the hardest to get into. The one weakness of locking, the everyday choice, is that it only protects you if you actually remember to do it.

What locking does

Locking leaves your Mac running and your session untouched. Every app stays open, every document stays where it was, and anything in progress keeps going. All that changes is that the login window slides in front of the screen, so your password, or Touch ID, is needed to get back in. It is instant to trigger and instant to resume, which is exactly why it suits stepping away from your desk for a few minutes.

You can lock in a second with Control + Command + Q, or from the Apple menu by choosing Lock Screen. The full set of ways to do it, including hot corners and the menu bar, is covered in the guide on how to lock your Mac screen. One important detail: locking only secures the screen if you have told macOS to require the password immediately. The setting lives in System Settings under Lock Screen, and the guide on why a Mac is not locking automatically walks through it. Because the Mac stays awake, a lock is also the right move when you want the screen private but need work to carry on, such as a long download or render; that case has its own guide on locking the screen without putting the Mac to sleep.

What logging out does

Logging out is a bigger step. It quits all of your open apps and ends your user session, then returns the Mac to the login window where any account on the machine can sign in. Anything unsaved is lost unless you save it first, so logging out is deliberate in a way that locking is not. In exchange, it leaves nothing of yours running, which is useful on a Mac that other people share or when you want a genuinely clean slate.

You can log out from the Apple menu with the Log Out item, or with Shift + Command + Q, which asks you to confirm first. If you press Option + Shift + Command + Q, you log out immediately without the confirmation prompt. The log-out dialog includes a "Reopen windows when logging back in" option, so you can choose whether your apps and windows come back the next time you sign in. Logging out is slower to recover from than a lock, because you have to sign in again and let your apps reopen, so it is overkill for a quick coffee but sensible at the end of a shared session.

What shutting down does

Shutting down powers the Mac off completely. Every app closes, your session ends, and the machine stops drawing power until you switch it back on. You do it from the Apple menu with Shut Down. It is the slowest of the three to come back from, because the Mac has to boot up and you have to sign in again, but it is also the most secure state your Mac can be in.

The reason is encryption. When the Mac is off and you have FileVault switched on, the data on the disk is encrypted at rest and cannot be read without your login password, even by someone who removes the drive. A locked or logged-out Mac is still powered on with your session, or at least your data, decrypted in memory; a shut-down Mac with FileVault on is not. The difference between protecting a running session and protecting a powered-off disk is explained in the guide on FileVault versus the lock screen. That is why shutting down is the right call when you are travelling, leaving the Mac for a long time, or simply want the strongest protection at the end of the day.

Which one, and when

The three choices map cleanly onto how long you are leaving and who else might touch the Mac.

• Stepping away for minutes (a meeting, lunch, a coffee, a quick chat): lock. It is instant both ways and keeps your work exactly as it is.
• Handing the Mac to someone else, or finishing on a shared machine: log out. It ends your session and clears the way for the next person without exposing your apps.
• Travelling, a long absence, or your preferred end-of-day state: shut down. With FileVault on, a powered-off Mac is the hardest of the three to get into.

Two things that are easy to confuse with these choices are sleep and closing the lid. Putting the Mac to sleep, or closing a MacBook lid, is about power, not security; whether it then asks for a password depends entirely on the same "require password" setting. The difference between sleep, the screen saver, and a real lock is covered in the guide on whether your Mac locks when it sleeps.

The catch with the everyday choice

Locking wins for the common case, the dozens of times a day you step away and come straight back, precisely because it is fast and keeps everything in place. Its single weakness is that it relies on you to do it. Walk off to a meeting without pressing the shortcut and the screen sits open until the native timer eventually kicks in, and that timer is a blunt instrument. macOS locks on an inactivity countdown, not on whether you are actually there. Set it short to feel safer and it locks while you are still reading or on a call; set it long to avoid that and your screen stays open for a while after you leave. There is no fixed interval that is both quick to lock when you go and patient while you stay.

Make the everyday lock automatic

Presence detection removes that weakness by locking on a different question: not "how long has it been idle?" but "is the person still here?". This is the approach Peeku uses to lock the moment you walk away. It combines three local signals to decide you have genuinely left:

• Face presence from the built-in camera, analysed on your Mac with Apple's Vision framework. No image or video leaves the device.
• An optional Apple Watch proximity gate over Bluetooth, so the Mac only locks when both the camera and the Watch agree you are away.
• Keyboard and mouse idle time, so it does not lock during a brief pause at the desk.

When the signals agree you have gone, Peeku locks within a few seconds, and because it waits for genuine absence rather than a fixed timer, it does not lock you out while you sit and think. Detection runs entirely on your Mac, with no account and no cloud face data; the guide on privacy-first, on-device auto-lock explains how that works. Two honest caveats: Peeku still relies on the "Require password: Immediately" setting, so set that first either way, and the full locking app ships free outside the Mac App Store, on Gumroad and as a notarised DMG, because the App Store sandbox blocks the system screen-lock calls. Peeku handles the lock; logging out and shutting down stay the deliberate choices they should be.

Quick reference

• Lock (Control + Command + Q, or Apple menu, Lock Screen): session and apps stay open, instant to resume. Best for stepping away during the day. Secure only with the password requirement set to Immediately.
• Log out (Shift + Command + Q, or Apple menu, Log Out): quits your apps and ends your session, returning to the login window. Best for a shared Mac or a clean finish. Save your work first.
• Shut down (Apple menu, Shut Down): powers the Mac off. Slowest to resume, most secure with FileVault on. Best for travel or a long absence.
• Sleep or closing the lid: a power state, not a security action by itself; it only asks for a password if the requirement is set.
• Make the everyday lock automatic: add presence detection so the Mac locks when you walk away, not after a timer. The two-minute setup is in the guide on setting up walk-away lock.