About Pawl

The key is the whole trick

Most blockers fail at 1am because you can switch them off with one tap. Pawl moves that decision to a small object you have already put out of reach.

Three drawings. One: a small security key plugged into the bottom of a phone. Two: the same key left inside a house that is not yours. Three: a moon over a long road between a phone and the house.

Plug it in once

When you set Pawl up, you plug a USB-C security key into your phone and tap it. Pawl remembers that key and only that key.

Leave it somewhere else

Give it to a friend, put it in your car, or lock it in a drawer at work. The further away it is, the longer the urge has to fade.

The 1am version of you has to go get it

Even when you do get the key, tapping it starts a 15 minute wait. Then the block lifts for a short window (30 minutes by default) and comes back on by itself.

A drawing of a small green security key with a USB-C plug and a keyring loop

Which key to buy: any FIDO2 security key with a USB-C plug. Several makers sell them, and they need no app or account. Pawl does not sell keys and does not take a cut.

Open source

You should not have to take a blocker's word for it. All of Pawl's code is public, so you or anyone you trust can read exactly what it does.

github.com/jasonepage/Pawl

Licensed under the Mozilla Public License 2.0. Read it, build it yourself, report a problem, or send a fix.

View the code

What it does not promise

Pawl makes the 1am version of you slow. It does not make anything impossible. The details, in plain words:

iOS lets the phone's owner turn Screen Time off. No app can stop that. Pawl notices the next time it runs. For a real lock, someone you trust can set the Screen Time passcode in person and keep it. iOS enforces that passcode, not Pawl.
The key check runs on your phone. Pawl verifies the key's signature, the fresh challenge and the touch flag itself. It does not check that the key is genuine hardware from a known maker, and a key paired before 2.1 is not signature-checked until you pair it again.
The clock lock is not yet proven. Pawl asks Screen Time to require automatic date and time while it is protecting you, so moving the clock forward should not shorten the wait. Whether iOS enforces that for an app like Pawl has not been confirmed on a device yet.
No blocklist is complete. The optional gambling list has 167 domains and the adult filter is Apple's. New sites appear every week. Sites you type in are blocked exactly as typed.
A determined person can get around any blocker on a phone they own, with another phone, a laptop, or a friend's device.
The core logic has automated tests, including the unlock loop, the timing rules and the blocking rules. The screens are tested by hand on real phones.
You cannot prove the App Store build came from this exact source. There are no reproducible builds.

The full list, including notes for reviewers, is in the README.

Private by design

Screen Time hands Pawl only anonymous tokens. Pawl never learns which apps or sites you picked.

Your streak lives on your phone and in your own iCloud, so it survives deleting the app. No advertising, no tracking, no account and no Pawl server.

Read the privacy policy