How it works
Found an unlocked computer?Action!
Nice catch. You just won pastries,
Fake screens in the shop window
ChocoLOCK is a free website that puts a fake lock screen in the browser of the unlocked computer: a Windows blue screen, an update in progress, a Cloudflare error… Nothing gets installed on the machine. It’s a web page, and it closes like any tab.
Windows blue screenClassic ChocoLOCK
Cloudflare errorTargeted ChocoLOCK
Red screenFLASH ChocoLOCK
Windows XP spamTargeted ChocoLOCK
Ransom CookiesTargeted ChocoLOCK
More are waiting in the lock screen gallery. For a fake update or a screensaver, try the fake screen simulators.
Which ChocoLOCK will it be?
Free. Only the culprit* pays, in pastries.
- Classictwo clicksThe fake Windows blue screen, full screen, signed with your name or your team’s.
- SUPERone emailThe pastry-promise email goes out from the culprit’s own inbox, written for them.Subject: [CHOCOLOCK] Pastries incoming! 🍪
- Targetedyour phoneScan the QR code on their screen, then fire the lock screen from your phone, signed in to your account.
- FLASHone clickA red system-corruption screen, no name, no settings. The big button up top launches it too, during its first second.
* The culprit is whoever left their session unlocked. The round they buy afterwards is called croissantage, also known as ChocoBLAST. The full rules are in the FAQ.
ChocoLOCK in numbers
ChocoLOCK
Fake screens dropped since launch
- Classic
- 2,159
- SUPER
- 136
- Targeted
- 101
- FLASH
- 380
Total2,776
Paid inpastries
Thanks for locking your session 🍪
Every line of the feed above ends up on this receipt. The full breakdown is in the ChocoLOCK stats.
Where to buy the pastries
The culprit has to bring them, and the bakery map shows where to go, anywhere in France.
For CISOs and IT teams
You wrote session locking into the policy. Your colleagues never read it.
A croissantage teaches the reflex with no meeting and no reprimand. The penalty is a round of pastries, and it comes from colleagues, not from management.
It’s free, the culprit needs no account, and there’s nothing to deploy on workstations. Screen locking falls under ISO 27001 control A.7.7 (clear desk and clear screen).
Planning an awareness campaign? Write to us at contact@chocolock.fr.
P.S. For your next internal memo: