📖 All guides
Lock the tablet to the kiosk (manager passcode to exit)
Stop employees from swiping out of the kiosk: use the tablet's built-in lock mode with a passcode only managers know.
The kiosk is a web app, and a web page can never block the tablet's home button or app switcher — no kiosk product can. The lock comes from the tablet itself: iPad, Android and Fire tablets each have a built-in single-app mode with a tablet passcode to leave it. Set it up once and give that passcode to managers only. It is NOT your SafeShift Manager PIN — pick different digits (managers type the Manager PIN at the kiosk in front of employees, so reusing it would hand staff the exit code).
- 1
iPad — turn on Guided Access (one time)
Open Settings → Accessibility, scroll to the bottom and tap Guided Access. Turn it on, tap Passcode Settings → Set Guided Access Passcode and enter a 6-digit code twice — this is the tablet passcode: managers only, and NOT the same digits as anyone's SafeShift Manager PIN. On the same Passcode Settings screen also turn on Face ID or Touch ID — it lets a manager end the session with their face or finger, and it is your way out if the passcode is ever forgotten. Turn on Accessibility Shortcut so the triple-click works. Then go to Settings → Display & Brightness → Auto-Lock → Never so the screen stays awake at the door.
- 2
iPad — lock the kiosk
Open the SafeShift Kiosk icon so the punch screen is showing. Click the physical button three times, fast — all three clicks within about a second, like a quick knock. On iPads without a round home button that's the top button (the power button on the top edge); on iPads with a round home button it's the home button. The Guided Access screen appears — tap Start at the top right (enter the passcode if asked). The iPad is now locked: swiping up, the app switcher and the home button do nothing.
- 3
iPad — exit (managers only)
Triple-click the same button, fast, enter the Guided Access passcode, then tap End at the top left. If the screen simply turns off instead, the clicks were too slow — the iPad read them as one press of the power button. Press it once (or tap the screen) to wake the kiosk, then try again faster. To give yourself more time between clicks: Settings → Accessibility → Top Button (or Side Button) → Click Speed → Slow.
- 4
Android tablet — 1. Give the tablet a lock-screen PIN first
This is the step that trips people up: Android can only ask for a PIN when someone unpins if the tablet itself has a lock-screen PIN. A tablet that unlocks with a swipe (or nothing) will let anyone unpin with the on-screen hint. Go to Settings → Security (Samsung: Security and privacy → Lock screen) → Screen lock type → PIN and set one that staff don't know — and NOT the same digits as a SafeShift Manager PIN. Managers type the Manager PIN at the kiosk in front of employees; a matching tablet PIN would be watched and learned.
- 5
Android tablet — 2. Turn on App pinning and the unpin PIN
Open Settings → Security (Samsung: Security and privacy → More security settings → Pin app; older versions call it Pin windows or Screen pinning) and turn it on. On the same screen turn on Ask for PIN before unpinning (Samsung: Use screen lock type to unpin). That second toggle often only appears AFTER step 1 — if you don't see it, go back and set the lock-screen PIN.
- 6
Android tablet — 3. Find the recent-apps view
Open the SafeShift Kiosk icon so it's the most recent app. Now open Recents — how depends on the tablet's navigation style. Three buttons at the bottom (◁ back · ○ home · ▯ or ☰): tap the square or three-lines button. No buttons, just a thin bar: that's gesture navigation — from the bottom edge, swipe up slowly, hold your finger still for a second, then let go. The recent-apps cards appear. (Prefer buttons? Samsung: Settings → Display → Navigation bar → Buttons; other Android tablets: Settings → System → Gestures → System navigation → 3-button navigation. That makes the Recents button permanent.)
- 7
Android tablet — 4. Pin the kiosk
In Recents, each app card has a small icon at the top of the card. Tap that icon — not the card itself — and choose Pin this app (Samsung: Pin or Lock this app), then Got it. Swiping, the home button and notifications are now blocked. If Pin isn't in that menu, step 2 isn't on yet. If you changed the toggles after pinning, unpin and pin once more — the settings apply to new pins.
- 8
Android tablet — exit (managers only)
With buttons: press and hold Back and Recents together. With gestures: swipe up from the bottom and hold. The tablet then shows its lock screen and asks for the device PIN from step 1 — that's the lock. Android always shows employees the "press and hold to unpin" hint when they try; that hint can't be hidden, and it's fine: without the PIN they're stuck on the lock screen until a manager comes over. Also set Settings → Display → Screen timeout to the longest option, or install a keep-awake app, so the screen doesn't go dark between punches.
- 9
Amazon Fire tablet — Fully Kiosk Browser
Fire tablets should already be running the kiosk inside Fully Kiosk Browser (see *Set up the entrance tablet*). In Fully's settings open Kiosk Mode, turn it on and set the Kiosk Exit PIN — the tablet passcode (again: not a SafeShift Manager PIN). This is the strongest lock of the three: no home gesture, no status bar, no notifications, and the PIN is the only way out. Also turn on Keep Screen On and Launch on Boot. The paid PLUS licence re-enters kiosk mode by itself after a reboot.
- 10
Fire tablet — exit (managers only)
Tap the screen five times quickly (Fully's default gesture, changeable in its settings), then enter the Kiosk Exit PIN.
Good to know
- The tablet passcode and the SafeShift Manager PIN are two different things — and they must be different digits. Managers key the Manager PIN at the kiosk in front of employees (early clock-in approvals, short-meal overrides), so a matching tablet passcode would be watched and learned. Keep one tablet passcode per store, share it with managers only, and write it down somewhere safe.
- Test the exit once right after you set it up, while you still remember the code. A forgotten iPad Guided Access passcode is serious: the iPad's normal passcode does NOT end the session. If Face ID / Touch ID was enabled for Guided Access, a manager's face or finger ends it; otherwise the only way out is to restore the iPad from a computer, which erases it. A forgotten Fully Kiosk exit PIN can be reset from Fully's remote admin if you enabled it.
- A locked tablet keeps taking punches through a Wi-Fi outage when Keep punching when Wi-Fi drops is on for the location (see *Set up the entrance tablet*) — the punches are saved on the tablet and sent when the connection returns. Keep the tablet paired and powered during the outage; a wired connection or a cellular hotspot is still the better fix for a store with chronically bad Wi-Fi.
- Chains with many tablets can go one step further with a mobile-device-management tool (for example Hexnode or Scalefusion): it locks every tablet to the kiosk, survives reboots, and lets you exit remotely.
If something goes wrong
Android: I pinned the kiosk, but unpinning just works — it never asks for a PIN.
Almost always the tablet has no lock-screen PIN, so there is nothing for Android to ask for. Set one under Settings → Security → Screen lock type → PIN (Samsung: Security and privacy → Lock screen), then go back to the App pinning page and turn on Ask for PIN before unpinning / Use screen lock type to unpin — that toggle is often hidden until a lock exists. Unpin and pin the kiosk once more so the new rule applies. The on-screen "press and hold to unpin" hint still shows (Android never hides it), but the gesture now lands on the lock screen. If you want no hint at all and a hard lockdown, Fully Kiosk Browser with an exit PIN is the stronger option.
Android: I can't find the Recents button.
The tablet is on gesture navigation, which hides it. Swipe up slowly from the bottom edge and hold your finger still for a second — the recent-apps cards appear. Or switch to buttons permanently — Samsung: Settings → Display → Navigation bar → Buttons; other Android tablets: Settings → System → Gestures → System navigation → 3-button navigation. The Recents button is the square (or three-lines) one.
I triple-clicked to exit and the screen went black — now it won't come back.
The three clicks were too slow, so the iPad treated them as a single press of the power button and turned the screen off. Press the button once, or tap the screen, and the kiosk comes back — still locked. Then try again with three fast clicks. If the tablet is completely unresponsive, force a restart: press and release volume up, press and release volume down, then hold the top button until the Apple logo appears. After the restart it returns to Guided Access and asks for the passcode.
Does the lock survive a reboot?
It depends on the tablet. iPad: yes — a Guided Access session resumes after a restart or power-cycle and asks for the Guided Access passcode before anything else works, so keep that passcode where the opening manager can find it. Android: no — app pinning ends when the tablet fully powers off; a manager pins the kiosk again after it starts. Fire: Fully Kiosk Browser PLUS relaunches into kiosk mode by itself; the free version needs a manager to reopen it. An MDM tool re-locks any platform automatically.
Can SafeShift itself require the manager PIN to leave the kiosk?
No — browsers deliberately don't let a web page trap the user. The tablet's lock mode is the right tool, and it's what every kiosk product relies on, including ones with a native app.
Employees can still see notifications / the clock / the status bar.
On iPad, Guided Access blocks notifications while it's running. On Android, app pinning hides notifications; on Fire tablets turn on Fully Kiosk's Hide status bar option.