Exit kiosk lockdown and recover the PIN

The native kiosk apps (desktop and Android) run locked down: borderless fullscreen, always-on-top, with the usual close and switch shortcuts suppressed (see Lock down the desktop kiosk). A supervising operator can still get out — there is a deliberate, PIN-gated escape hatch. This page is the operator's guide to it: how to open the manager menu, exit the kiosk, and recover a forgotten PIN.

Set the PIN before you deploy

The manager PIN is set during the supervised first run, before the device is handed to the public. Keep it somewhere your team can find it — a forgotten PIN currently needs an administrator to recover (see below).

Open the manager menu

The gesture is identical on every platform: five rapid taps in the top-right corner, each within ~1.5 seconds of the last.

On desktop with a hardware keyboard you can also press F12 five times in quick succession. F12 is absent from tablet software keyboards, so a customer cannot trigger it by accident.

The gesture alone does nothing visible — it only opens the Manager Access PIN prompt. Enter the manager PIN to unlock the menu.

The gesture is safe to document

Publishing the gesture does not weaken the lockdown: opening the prompt is inert without the PIN, and repeated wrong PINs trigger a timed lockout. The PIN — not the secrecy of the gesture — is what protects the device.

In the manager menu

Once the PIN is accepted, the menu opens. The available actions differ slightly between platforms.

Desktop:

• Exit Kiosk — leaves locked fullscreen and returns to the desktop.
• Change PIN — set a new manager PIN (minimum 4 characters).
• Install update — shown on Linux only, when an update is waiting. macOS and Windows surface their own update prompts.

Android:

• Change Printer — re-run printer setup.
• Set as Home App — make the kiosk the device's launcher.
• Exit — leaves kiosk (lock-task) mode and returns to the Android launcher.

Android has no on-device "Change PIN" action — set or reset the Android PIN through your EMM (or by clearing app storage), as described under Recover a forgotten PIN below.

Too many wrong attempts

After several incorrect PINs, entry is locked for about a minute. On desktop the prompt shows a live countdown; on Android the wait time appears the next time you trigger the gesture. Wait for it to clear, then try again. This brute-force lockout is why the gesture being public is not a risk.

Recover a forgotten PIN

There is no self-service "reset PIN" button on the device — that would let anyone who reaches the prompt bypass the gate. Recovery is an administrator action, and the easiest path depends on the platform.

Android — push a new PIN from your EMM (recommended)

If the tablet is enrolled in an EMM, an administrator can reset the PIN from the management console without touching the device:

1. In the EMM, edit the Jonot kiosk app's managed configuration.
2. Set managerPin to a new 4–32 digit PIN and push the policy.
3. The device picks up the new PIN on its next policy sync — no gesture or on-device step required.

This is the non-technical recovery path: it happens entirely in the EMM console the operator already uses. (Setting managerPin back to an empty value returns PIN control to the on-device first-run flow.)

Without an EMM, the only Android fallback is to clear the kiosk app's storage from Android Settings (which resets it to first-run PIN setup) — a technical step best done by whoever set the device up.

Desktop — administrator restores the PIN file

The desktop app stores a salted hash of the PIN in ~/.jonot/kiosk-pin-hash (under the kiosk account's home directory). To recover, an administrator with access to that account deletes the file; the app returns to its supervised first-run PIN setup on the next launch. A corrupt or tampered file is detected and fails closed — the menu refuses to open and asks you to contact an administrator, rather than offering a reset that an attacker could abuse.

An easier desktop recovery is coming

An on-device, offline-capable recovery path (so a non-technical operator does not need shell access to the PIN file) is tracked separately. Until it ships, treat the desktop PIN as administrator-recoverable only, and record it when you provision the device.

Where this is documented

• This public page covers the escape gesture, the manager menu, and PIN recovery — safe to share with operators because the flow is inert without the PIN.
• PIN values themselves live with the operator who provisions the device (or in the EMM's managed configuration), never in these docs.