Turn Any Computer Into a Secure Browser Workstation
For companies, public services, retail, libraries, schools and anyone who puts shared computers in front of people: manage every screen remotely, lock them in one click, allow only the sites you approve, and wipe every session clean. Runs on any PC or thin client, with zero SSD wear.
Built for Everyone Who Runs Shared Computers
From the IT team and the people at the screens to leadership, educators and hardware partners.
Run Every Workstation From One Place
Looking after dozens of shared computers across a floor, a branch or a campus used to mean walking from desk to desk. With Lab Kiosk you manage all of them from a laptop, tablet or phone, with nothing to install.
- One-Click Screen Lock: Cover every selected screen with a message, for a briefing, a maintenance window or the end of a shift.
- Live Screen Thumbnails: Previews refresh every 3 seconds, so you can see at a glance what every workstation is showing.
- Remote Assist: Take over the keyboard and mouse of any workstation to help someone without leaving your desk.
- Broadcast Pages: Open the same approved page on every selected workstation at once.
A Fast, Focused Browser Station
People get a smooth, full-screen browser with only the sites they need: no malware, no pop-ups, no leftover sign-ins from the person before them.
- Visual App Launcher: One-click cards for the approved apps and sites your organization chooses.
- Zero-Lag Native Browsing: Full-screen high-performance Chromium rendering without restrictive or laggy iframes.
- Clean Sessions: No browsing history, cookies, sign-ins or files are kept. Clear Session wipes them on demand; a restart wipes everything.
- Auto-Hiding Navigation Bar: The top bar glides off-screen, leaving the whole display to the page.
User Portal Launcher
Computer Labs and Secure Assessments
Run school computer labs, coding practicals and invigilated assessments on the same locked-down image, across one room or hundreds of campus workstations. Free for accredited educational institutions up to 45 computers.
- Examination Lockdown Browser: Enforce strict whitelists for midterms, coding practicals, and aptitude assessments.
- Web IDE & Jupyter Ready: Supports WebAssembly compilers, JupyterLite, and VS Code Web with zero client install.
- Global Edge Scalability: Powered by Cloudflare Workers and D1, easily handling simultaneous lab traffic across multiple campus buildings.
- Hardware Independence: Run the exact same secure image on legacy Intel Core 2 Duos, modern i7 desktops, or thin clients.
Campus Examination Mode
Status: Strict Examination Lockdown Active
DevTools & Extensions: Disabled
Domain Allowlist: assessments.university.edu only
External USB / TTY: Blocked
Lower Running Costs & Zero SSD Wear
Leadership and finance teams can retire per-seat desktop OS and antivirus licenses on shared machines and keep existing hardware in service for years longer.
-
Zero SSD Wear: Thin client flash drives (16GB-32GB) degrade rapidly under Windows. Lab Kiosk diverts 100% of writes to volatile RAM (
tmpfs), preserving hardware for 10+ years. - Hardware Resurrection: Transform 12-year-old discarded desktop PCs (Core 2 Duo, 2GB RAM) into snappy, modern terminals.
- No Desktop OS Licenses: A Debian-based, source-available stack replaces Windows and antivirus licenses on every shared seat.
- Allowlist-Only Browsing: Every site is blocked unless you approve its domain, enforced by the browser's managed policy.
Per-Site Cost Comparison
| OS & Antivirus Licenses | $2,400/yr |
| SSD Replacements | $800/yr |
| Lab Kiosk | Free for education ≤ 45 PCs; commercial license otherwise |
Turn Corporate E-Waste into Community Workstations
Companies and donors can partner with Lab Kiosk to refurbish off-lease computers into turnkey, secure workstations for schools, libraries and community centers in underserved areas.
- Circular Economy & ESG: Divert functional e-waste from landfill and put it to work in high-need communities.
- Turnkey Flash-and-Go: Write the Lab Kiosk ISO onto a batch of USB keys. Each computer boots into an enrollment screen in seconds.
- Ready-Made Launchers: Pre-configure the approved platforms each site needs directly into the user launcher.
- Verifiable Impact: Real-time telemetry lets donors see workstation usage and uptime transparently.
CSR Sponsorship & Partnerships
Whether your enterprise has 50 or 5,000 PCs to donate, we provide the operating system, cloud control plane, and training materials.
Contact CSR & Partner TeamExperience the Platform Live
Try the user portal, the admin console, and the screen lock.
Select an Approved Resource
Click any approved application below to open it.
Engineered for Shared Workstations
Zero maintenance, central control, and tamper-proof by design.
Zero SSD Wear (RAM Overlay)
All disk writes are strictly directed to volatile RAM via overlayroot="tmpfs:recurse=0". Protects thin-client SSDs from wearing out and erases user files on every reboot.
Instant Screen Lock
One click covers the selected screens with a fullscreen message. Unlocks instantly when you are ready.
Live Grid & Remote Control
Live screen thumbnails update every 3 seconds on your dashboard. Click any workstation to instantly take interactive keyboard and mouse control via noVNC.
Custom Organization Subdomains
Every organization gets its own custom subdomain (e.g. greenwood.labkiosk.org). Thin clients connect separately and remain 100% isolated to your organization's private dashboard.
Visual User App Launcher
Admins configure cards with custom thumbnails for the websites they approve. Users launch them in one click.
Auto-Hiding Floating Navigation
The 4-button locked navigation bar hides off-screen and smoothly slides down only when moving the mouse to the top edge, ensuring zero webpage overflow.
Runs in Your Language
The workstation interface itself is translatable, with right-to-left layout where a language needs it. New languages reach workstations over the air, without a new ISO.
A Record of Every Change
Subdomain changes, staff accounts, allowlist edits and key rotations are recorded and readable from your console, including anything the platform did to your organization.
Hardware Specs & Compatibility
Bring older desktops back into service or run on modern thin clients, without hardware upgrades.
| Component | Minimum Requirement | Recommended Specification |
|---|---|---|
| Processor (CPU) | 64-bit x86-64 (Intel Core 2 Duo, AMD Athlon 64, or newer) | Intel Core i3/i5/i7 (2nd gen+), Celeron J4105, or modern AMD Ryzen |
| System Memory (RAM) | 4 GB RAM (the full OS and Chromium run from RAM) | 4 GB or 8 GB RAM for ultra-smooth multi-app switching |
| Storage Drive | 2 GB+ USB flash drive (USB 2.0 or 3.0); internal disk not required | Fast USB 3.0/3.1 Thumb Drive or Internal M.2 / SATA SSD |
| Network | 10/100 Mbps Fast Ethernet or 802.11n Wi-Fi | Gigabit Ethernet (1000 Mbps) or 802.11ac Wi-Fi |
| Display Output | VGA / DVI / HDMI supporting 1024x768 resolution | 1080p Full HD (1920x1080) or higher via HDMI/DisplayPort |
| Verified Hardware | Tested on HP Thin Clients (t520/t620/t630), Dell OptiPlex (780/790/3020/7040), Lenovo ThinkCentre (M72e/M93p), Intel NUCs, Acer Veriton, and standard assembled desktop towers. | |
Tamper-Proof Architecture
Engineered defense-in-depth from the Linux kernel up to Cloudflare's serverless edge.
1. Client OS Lockdown
Virtual TTY consoles (TTY1-6) and X11 VT-switching keys are masked. Openbox runs without window border escape keybindings. The root filesystem is mounted strictly read-only.
2. Managed Enterprise Chromium
URLBlocklist: ["*"] denies all internet browsing by default. The local Python agent dynamically reconciles the organization's approved whitelist on every heartbeat.
3. Cloudflare Edge & Web Crypto
Control plane runs across 300+ edge colocations. Passwords are protected using native Web Crypto PBKDF2-HMAC-SHA256 with 100,000 iterations. Workstations communicate via cryptographically hashed device tokens.
Frequently Asked Questions
Common questions from IT administrators, operations managers and education leads.
URLBlocklist: ["*"]). Downloads, print menus, bookmarks, extension installations, and DevTools (F12) are permanently disabled. In addition, USB thumb drive automounting is blocked, preventing users from running unauthorized scripts.
tmpfs). Flash storage is never written to during user sessions, prolonging hardware life by 5 to 10 years.
yourorganization.labkiosk.org) and an enrollment key. Write the ISO to a USB flash drive, boot your lab computers, and complete the 3-step setup wizard on each machine. They immediately link to your private cloud dashboard.
Global Contact & Support
Questions about onboarding, large deployments, education licensing or CSR hardware donations? Get in touch with our team.
General & Sales Inquiries
For organizations evaluating Lab Kiosk, commercial licensing, and general questions.
contact@akbhoi.comTechnical & Deployment Support
Assistance with ISO flashing, thin client hardware compatibility, and network setup.
support@akbhoi.comEducation, CSR & Partners
Education deployments, hardware donation partnerships, and platform allowlisting.
partners@akbhoi.com