See when your Mac was last used
You got home, or back to your desk, and the question isn't whether the Mac is locked now — it's whether anyone was on it while you were out, and when. macOS does keep some of that, in places designed for debugging rather than for answering this. Here's what's actually in there, and what a lock and unlock history looks like when you can read it from your phone instead.
What macOS records on its own
There's no "last used" field anywhere in macOS. What there is instead is a power-management log, a general-purpose system log, and a list of files you opened. All three can be made to answer the question, and none of them was built for it.
Sleep and wake events in the power log
The most direct thing on the machine is the power-management log. Open Terminal and run
pmset -g log — no sudo needed. Apple describes it as a history of sleeps,
wakes, and other power management events, and that's what you get: a long timestamped list, each
entry with the reason beside it. A lid closing shows up as a clamshell sleep, distinct from an idle
or scheduled one, so you can tell "someone shut it" from "it timed out".
What it won't tell you is whether anyone got in. A wake is a wake whether it ended at the login window or on your desktop.
Console and log show, and what they don't capture
Console.app gets recommended for this constantly and it's the wrong tool. What Console gives you is a live stream: you pick a device, press Start, and watch messages arrive. On a non-admin account it wants an administrator password first. It answers "what is happening now", not "what happened on Tuesday".
The command-line version does read backwards — log show --last 1d and similar. Two
catches. It's a developer tool, so the output is enormous and the lines you want are buried in
machine noise. And Apple publishes no retention period: the store is bounded by size and a
time-to-live rather than a fixed number of days, so how far back you can go depends on how noisy your
Mac has been. Last Tuesday may simply not be there.
Recent Items and last, and why both mislead
The Apple menu's Recent Items list shows documents that were opened. It's the fastest thing to check and the least trustworthy conclusion to draw. An empty list means nobody opened a document, which is not the same as nobody using the Mac — browsing, messaging, and reading through your files leave nothing there. Anyone wanting to hide their tracks can clear it in two clicks.
last is the other command you'll be pointed at, and it answers a different question than
the one you asked. It lists login sessions, so a console entry can be weeks old purely
because nobody has logged out since. Useful for "when was this Mac last restarted", no use at all for
"when was it last unlocked".
The gap in all of these: they only help once you're back at the Mac
This is the real problem with every option above: each one needs you sitting at the machine, typing
into its Terminal or clicking its menus. If you're at work wondering about the iMac at home, none of
them is reachable. By the time you can run pmset -g log, you're already standing in front
of the thing you wanted to ask about.
A lock and unlock history you can read from your iPhone
Every lock, unlock, and sleep as a timeline, grouped by day
A record is a different thing from a snapshot, and this question needs the record. Lock Status keeps one: a free menu-bar helper stamps each lock, unlock, and sleep with the time it happened and files it in your own private iCloud. Because it accumulates, what you get back is a timeline, grouped by day, of when the Mac was locked, when it was unlocked, and when it slept. "Unlocked 08:12, locked 08:44, unlocked 14:47" answers the question you actually asked, in the order things happened.
The iPhone app and its widgets are the reading end of it. The app is coming to the App Store; the helper is available now, and the helper is the part that matters for history, because a Mac that wasn't reporting has nothing to report retroactively.
Active versus away totals
Once the events are a timeline, the arithmetic is free. Totals per day fall out of it: how long the Mac was unlocked and in use, how long it sat locked, how long it slept. That's the difference between "someone unlocked it at 14:47" and "someone unlocked it at 14:47 and worked for two hours" — quite different findings about the same afternoon.
How far back the history goes
The free app keeps recent history. Pro extends it — up to a full year — along with the Home and Lock Screen widgets and the usage insights. Either way it's your data in your iCloud; the subscription changes how far back the app will show you, not who holds it.
Reading the timeline honestly
A gap in the history means we lost contact, not that nothing happened
This is the one thing to get right about any history like this, and it's the exact point where it's tempting to conclude the opposite of the truth.
If there are no events between 15:00 and 19:00, that does not mean the Mac was untouched for four hours. It means no events reached your iCloud from it in that window. The Mac might have been off the network. It might have been shut down, which stops the helper along with everything else. Sync might have been slow. A quiet stretch in the timeline is a stretch we can't account for, and the app presents it as a gap rather than smoothing it into calm.
So the timeline is reliable about what it does contain — an unlock at 14:47 happened at 14:47 — and silent, not reassuring, about what it doesn't. An empty afternoon is never an all-clear.
Why we timestamp instead of summarising
It would read better to say "no activity yesterday". It would also be a claim about the world drawn from an absence of data, which is the one thing this app refuses to do. So you get times and durations, and where nothing arrived you get nothing rather than a soothing summary. The same discipline governs the live status too, where a reading always carries its own age — that's how a reading's timestamp works.
What this is not
Not screen recording, not keystrokes, not app usage
The helper records four kinds of moment: locked, unlocked, asleep, and the time it last checked in. It doesn't capture the screen, doesn't log keystrokes, doesn't track which apps ran, and doesn't touch your files. If someone unlocked your Mac and read your email, the timeline will show you an unlock at a time. It will not show you the email.
Not a security tool
Worth saying plainly, because this query attracts a more frightening version of itself. If you think someone has remote access to your Mac — screen sharing you didn't authorise, software you didn't install — a lock timeline is the wrong instrument. Remote access doesn't have to unlock anything, so it can leave no mark here at all. That's a job for Apple's own guidance on device security and, if there's real reason for concern, a machine you take to someone who can look at it properly.
What this is good for is the ordinary, answerable version: a shared flat, a family iMac, a desk in an open-plan office, a laptop you left in a meeting room. Was it opened, and when.
Common questions
Can I see who unlocked it?
No. The record is that the Mac was unlocked and when — not by whom. An unlock looks the same whether it was you, a flatmate, or someone who knew your password. The timeline can tell you a session opened at 14:47 and nothing about whose hands were on the keyboard.
Does the history sync between my devices?
Yes, through your own private iCloud. The Mac helper writes each event there, and anything signed in to the same Apple Account reads from that one copy — so two Macs each keep their own history and both of them show up on the phone. It syncs on iCloud's schedule rather than on demand, which is why an event you just triggered can take a moment to appear.
Can we see your Mac's history?
No. The history lives in your private iCloud database, which we have no access to. There are no servers holding a copy and no analytics collecting it — that's what we can and can't see, written out in full.
Start the record now, not later
History is the one feature that can't be added retroactively. There's nothing to read back for a week when the helper wasn't running for it, so if you expect to ask this question again, the useful move is to put the free helper on the Mac today and let it accumulate.