The guest account on a Mac: lending the machine, not your setup

Someone needs the Mac for ten minutes. To print a boarding pass, to check a flight, to sign a document. The instinct is to hand it over already unlocked, which is fast and gives away far more than intended: open documents, browser tabs, a mail window, and a menu bar that names every service the machine is signed in to.

The guest account exists for exactly this. It is not a second user in the ordinary sense, and treating it like one is where the confusion starts. It is a session that throws itself away.

What the guest account actually is

Apple's own description of the feature is short and worth taking literally. The guest account lets other people use the Mac temporarily without being added as individual users. A guest logs in without entering a password. Guests cannot change user or computer settings. And the important one: files created by a guest are stored in a temporary folder, and that folder and its contents are deleted when the guest logs out.

That last sentence sets the shape of the whole feature. A guest session is disposable by design, not by convention. The downloads, the browser history, the signed-in accounts, the document saved to the desktop: all of it goes when the session ends. There is no setting to keep any of it, and no recovery afterwards.

Which makes the guest account excellent for one job and useless for another. Lending the machine for twenty minutes: excellent. Giving a family member a place to keep their own files: useless, because those files will not survive the first logout.

It is also worth knowing what a guest cannot do even during the session. Settings that affect other users or the Mac itself are closed. And remote access is governed separately: guest users cannot log in remotely when remote login is turned off in Sharing settings, so turning the guest account on does not quietly open a door across the network.

Turning it on, and the three switches

The guest account ships switched off. Enabling it takes a minute, and administrator rights.

1. Open the Apple menu and choose System Settings.
2. Click Users & Groups in the sidebar. You may need to scroll down.
3. Click the button next to Guest User.
4. Turn on Allow guests to log in to this computer.

One quirk catches people mid-task: if a guest is currently logged in, Guest User cannot be selected at all. Log the guest session out first, then change the settings.

Three options sit in that panel, and each one answers a different question.

Allow guests to log in to this computer is the feature itself. With it on, Guest User appears in the login window and needs no password.

Limit adult websites automatically limits access to many adult websites during guest sessions. Apple's wording is "many", not "all", which is the honest way to describe any filter of this kind. For a Mac that gets handed to visiting children it is worth turning on, while understanding what it is.

Allow guest users to connect to shared folders is the one that is easy to misread. It has nothing to do with somebody sitting at the Mac. It lets a guest reach shared folders from another computer on the network. That is a separate decision from lending the keyboard, and on a home network it is usually left off. The per-folder counterpart lives in Sharing settings, where File Sharing has an Advanced Options entry called "Allow guest users" for each shared folder.

FileVault changes what a guest session is

This is the single biggest source of confusion about the guest account, and it is not a bug.

With FileVault turned on, Apple states that guest users can access Safari but cannot access your encrypted disk or create files. In practice the guest session is a browser and nothing else. No Finder, no other apps, no saved files, because there is nowhere to save them until the disk is unlocked by a real account.

For lending the machine to check a website, that is arguably the ideal version of the feature: the smallest possible surface. For anything else, it is a dead end, and no amount of poking at Users & Groups will change it while the disk is encrypted.

So the honest answer to the question of why a guest gets nothing but Safari is that full disk encryption is on, working as intended. The choice is between an encrypted disk with a browser-only guest mode, and a fuller guest session on an unencrypted disk. On a laptop that leaves the house, encryption wins that argument every time.

One related setting is worth checking in the same breath. The guest account is also excluded from "Allow user to reset password using Apple Account", the per-user option that lets someone recover their own login at the login window. That makes sense, since the guest account has no password to recover, but it is a reminder that the guest account is not simply a user with fewer privileges. macOS treats it as a different kind of object, which is why options that apply to every other account are sometimes missing from it entirely.

Guest, a standard account, or just handing over your own session

Three ways to let somebody else use the Mac, with genuinely different trade-offs.

	Guest account	New standard account	Your own session
Password for them	None	One they set	None, already unlocked
Files kept after use	No, deleted at logout	Yes	Yes, in your folders
Can reach your documents	No	No	Yes, everything
Can change settings	No	Their own only	Yes, if administrator
Sees your browser, mail, menu bar	No	No	Yes
Setup time	About a minute, once	Two minutes per person	None
Right for	Lending the machine briefly	Someone who uses it regularly	Nothing, really

The third column is included because it is what most people actually do, and it is the option with no upside. Handing over an unlocked session exposes documents, mail, saved passwords in the browser and the full contents of the menu bar, and it leaves that person's activity mixed into your own history. Both alternatives take under two minutes and remove the entire category of problem.

Between the first two columns, the deciding question is whether anything needs to survive. If the answer is yes, even once, create a standard account instead. The guest session will delete it.

Two things to check before handing the Mac over

Enabling the account is not quite the whole job, and both of the remaining items take seconds.

Notification previews at the login window. System Settings, then Notifications, has a "Show previews" control with three values: Always, When Unlocked and Never. Apple notes that Always shows previews even in the login window. A guest sitting at the login screen, or at the fast user switching screen, can therefore read the first line of incoming mail and messages while waiting. When Unlocked restricts previews to an account that is actually signed in, and it is the sensible setting on any Mac that gets passed around.

Whether the previous guest is really gone. A guest session that was switched away from rather than logged out is still running, and its temporary folder still exists. Two consequences follow. The Guest User panel in Users & Groups cannot be selected while that session is live, and the next person to pick Guest User lands in the previous guest's session rather than a fresh one. Ending the session properly, with Log Out rather than a switch, is what triggers the deletion that the whole feature rests on.

The reason to leave the guest account on

There is a second, less obvious use, and it depends on the account being enabled before the Mac goes missing.

Apple documents that guest access works with the Find My app to help locate a lost Mac. If someone finds the Mac, logs in as a guest and uses Safari to reach the internet, the Mac can report its position. A stranger who finds a locked laptop with no guest option has no reason to connect it to a network at all, and a Mac that never touches a network never reports anything.

It is not a security feature and it should not be described as one. It is a small probability improvement, at the cost of a session that can do nothing but browse and forgets itself on logout. For a laptop that travels, that trade looks reasonable.

What a guest actually sees at the top of the screen

Here is the part that makes the guest account worth preferring over an unlocked handover, beyond the file access.

Menu bar items come from apps that launch at login, and login items are set per account. A guest session has none of them. The bar carries the clock, Control Center and whatever macOS shows by default, and nothing else. No VPN item naming a corporate network. No cloud storage item. No time tracker, no build monitor, no note-taking icon, no password manager. Nothing with a badge on it inviting a question.

Compare that with the account doing real work, where the same strip has usually filled up with a dozen status items, several of which name a service or a company. That is the information a guest session withholds for free, without a single setting being changed.

The mirror image of this is the account you actually use. Every app that wants a status icon takes width from the same strip, macOS provides no way to fold the overflow away, and the only native remedies are removing an item by holding Command and dragging it out of the bar, or turning individual system controls down to Show When Active in Menu Bar settings. Command-dragging an icon out means going back into that app's own settings to get it back, which is why most people simply live with a crowded bar.

A menu bar manager for macOS closes that gap without throwing anything away: items are sorted into shown, hidden and always hidden, and the hidden ones stay one click behind a divider. Because it installs as a login item, it affects the account it was set up in and leaves the guest session untouched, which is the right way round. The FAQ covers how a licence is counted across Macs and accounts.

What to change first

Turn the guest account on, leave "Allow guest users to connect to shared folders" off unless network access is genuinely wanted, and stop handing over an unlocked session. If anything the other person creates needs to still exist tomorrow, make them a standard account instead, and then tidy the menu bar in the account that does the actual work, with a tool that hides menu bar icons on a Mac once the free settings have run out.