macOS has no built-in kiosk mode. Canned Web locks a Mac to one website, fullscreen. Spotlight, Cmd-Tab and screenshots blocked, locked to your domain, exit only with a password. Great for product demos, trade-show booths, signage and exhibits. One-time €49, no MDM.
What's great
exactly the kind of app that shouldn't need to exist but does because macOS genuinely has no Guided-Access equivalent. the auto-restart-back-into-the-site after a reboot is the detail that actually makes this usable unattended, a lot of kiosk hacks fall apart the moment someone unplugs the machine. one-time price instead of a subscription for something this narrow in scope is the right call too
What needs improvement
the maker is upfront that the physical power button can't be blocked since macOS won't expose it, which is fair, but it would help to see that documented clearly with exactly what a curious visitor could and couldn't do with it, rather than leaving it as a one-line caveat in the launch post
vs Alternatives
Jamf ProJamf makes sense if you're already managing a fleet of Macs, but setting up an MDM profile for one machine at a trade show booth is a huge amount of overhead for something this temporary. Canned Web is scoped correctly for the actual job
Ratings
Ease of use
Reliability
Value for money
Customization
Report
2 views
Stupid Notes
Dial
@david_pfluegl1 the power button caveat you flagged is the interesting one to me. on Apple Silicon, holding it long enough gets you into recovery mode, which in theory could be a path around the whole lock for someone determined enough at a trade show booth. is that actually possible in practice, or does something like the exit password/FileVault end up blocking that too, just not by design
Stupid Notes
@galdayan Great question, and your intuition is right.
Canned Web's exit password only protects the software session (quitting/unsealing the running app). It can't touch the firmware/boot layer, and no app can. The power-button to recoveryOS path lives below macOS, so a userspace app can't intercept it. Same reason I'm upfront that we can't block the physical button.
What actually stops the recovery route isn't us. It's macOS's own security, which is exactly the "blocks it, but not by design" you're describing:
On Apple Silicon, entering recoveryOS requires authenticating as an admin/volume-owner. If the kiosk runs under a standard, non-admin account and the admin password isn't known to a booth visitor, they hit a wall.
With FileVault on, the disk is encrypted at rest, so reaching recovery doesn't expose data or let anyone tamper with the install without the password.
Also, a plain force-restart just triggers auto-login and auto-start, so the Mac boots straight back into the sealed site. Casual power-cycling only restarts the kiosk.
Bottom line: against a determined person with physical access, the defense is FileVault plus a non-admin kiosk user plus physically securing the machine (a Mac mini with the button around the back, mounted out of reach). That holds for any kiosk on any OS. Once someone has the hardware in hand, physical security is the real perimeter.
Going to add a "hardening for hostile environments" note to the setup guide. Thanks for the sharp question.
Dial
that's a much cleaner answer than I expected honestly - non-admin kiosk account + FileVault means the "vulnerability" is really just standard macOS security doing its job, not something you had to build. good call adding the hardening note, that's the kind of thing an IT person setting this up in a school or museum would want spelled out before they trust it in an unsupervised space