Can a smart lock be hacked? The risks that are actually real

The question usually arrives second hand. You mention that you are putting a keypad on the front door, and someone tells you about a man who walks down a street with a laptop opening houses as he goes. It is worth taking seriously for about the length of this article, and then filing in roughly the right place, which is some way below the window next to the door.

What follows is drawn from manufacturer documentation and from the vulnerability reports researchers have published over the years, not from any testing of our own. The useful thing those reports show is not that smart locks are fragile. It is that the failures worth planning for are almost never the ones people are frightened of.

Three different fears wearing one word

Ask ten people whether smart locks are safe and you get three separate questions bundled together. Can somebody open my door from another country. Can somebody standing on my step do something clever with a radio. And can the thing simply fail and leave me on the wrong side of it.

They have very different answers. The first needs a specific disclosed flaw in a specific product and version. The second is real, demonstrated, and bound by physical proximity. The third has no attacker in it at all, and it is the one that happens to people.

Remote attacks, and what a disclosed one looks like

Start with the shape of the system, because it settles most of this. A Wi-Fi or bridged smart lock does not sit on the internet waiting for connections. It holds an outbound link to the manufacturer’s cloud, and your phone talks to that same cloud from the other side. There is no port on your router pointing at your front door, and there is nothing for someone scanning addresses to find. That design moves the interesting target away from the lock and onto the vendor’s servers and your account on them.

Published vulnerability reports in this category have followed a few recurring shapes. An authorization check missing from a cloud API, so one account could address a device belonging to another. Access tokens that stayed valid after a user was removed from a household. Firmware images accepted without a signature check. Companion apps leaking credentials into logs or over an unprotected connection. Researchers disclose the finding, the vendor ships a firmware or app update, and that particular window closes.

What has been rare is a durable general technique for opening any lock of a given brand at will. What has been common is a specific defect in a specific version, found, fixed, and gone. Two practical consequences follow. Updates are the fix, so a lock that has not seen a firmware update since 2021 because the app was deleted off an old phone is in a worse position than the vulnerability itself ever put it. And a Bluetooth-only lock with no bridge has no internet path at all, which removes this whole category and removes remote access along with it. That trade belongs with the choice between Bluetooth, Wi-Fi and a hub rather than with security theater.

Radio attacks happen at your door, not from a bedroom in another country

The attacks that get demonstrated at security conferences are mostly local, and they fall into a few families.

• Relay. The target is auto-unlock, the feature that opens the lock because your phone is nearby. One device sits near the lock and another near your phone, and between them they stretch a conversation across a distance neither radio could cover alone. The lock believes you are on the step.
• Replay. If a lock accepts a command it has already seen, a recorded exchange can be played back later. Designs using paired encryption with a changing challenge do not accept that. Older and cheaper implementations sometimes have.
• Capturing the pairing. Setup is the moment keys are exchanged, and any design that does it in the clear hands those keys to whoever is listening. It is why manufacturers tell you to pair standing next to the lock rather than from the kitchen.
• Jamming. Not an opening technique at all. Blocking a radio stops a notification arriving or a hub reporting state, which matters if what you rely on is the alert rather than the bolt.

Every one of these needs an attacker within radio range of your door, in most cases within a few feet, loitering with equipment for a while. That is a real risk and a narrow one, and it competes with the other options available to somebody already standing at your door. Turning auto-unlock off closes the relay case outright, which is the cheapest security decision on this page and costs you a feature many owners switch off anyway for opening the door when they walk past it indoors.

The failures that actually lock people out

The batteries go flat

This is the one that happens, and it rarely happens without warning. Locks chirp and flash for days or weeks first, and the warning gets ignored, or it arrives during a cold snap when a lithium cell drops off its plateau quickly, or a bolt that has been binding all winter draws more current than the motor budget assumed. Know your model’s fallback before you need it: a mechanical key override, exterior contacts that take a 9V battery, or a USB-C port on the underside. Some models have none of the three. The battery types and drain patterns are worth reading once, early.

The cloud goes quiet

Vendor outages happen, and so do internet outages at your house. In most designs the keypad, the key and the thumbturn keep working through both, because those paths are local to the lock. What stops is remote unlocking, live notifications, and issuing or revoking a code while you are away. The exposure is not the lock. It is a household that has quietly made the app its only credential.

Codes nobody ever revoked

The dog walker from two summers ago. The contractor who had the code passed to him in a group chat with four other trades on it. A former housemate. The default programming code printed in the manual and never changed, which is a published number for every unit of that model ever sold. This is the realistic way a smart lock lets someone in, and none of it is technical. It is administration, and it is entirely within your control.

What actually gets doors opened

Locks are seldom the way in, and the lock is only ever as good as what it is bolting into.

The common failure is the jamb. A strike plate held by one inch screws that stop short in the jamb trim will tear out of the frame under a kick, whatever is bolted to the door. Three inch screws driven into the framing behind the jamb, and a reinforced strike, change that more than any grade of lock body does. It is the reason the ANSI and BHMA grading system is useful for comparing bolts and misleading if you read it as a rating for the whole opening.

After that comes glass. A sidelight beside the door, a lite in the door itself, or the sliding patio door at the back of the house all sit outside the argument about lock security entirely. Then there is the credential you leave lying about in public: worn keypad buttons that show which four digits are in use, a code entered in full view of the street, or the same four digits reused on the garage keypad.

And there is the mundane one. A door pulled to but not latched, with the bolt thrown proud of the edge and the auto-lock timer having fired into empty air. No attacker required.

The account hygiene that closes most of the real gap

Nearly all the genuine risk in a smart lock sits in the account attached to it rather than in the hardware on the door. That is good news, because accounts are cheap to secure.

• Give the lock account a password used nowhere else, and turn on two-factor authentication if the vendor offers it. A reused password is the single most likely route into your lock, and it involves no lock skills whatsoever.
• Change the default programming or master code that came in the box, before anything else.
• Read the user list twice a year. Remove people who have moved out, contractors who finished, and any shared logins. Named users beat one code everybody knows.
• Use scheduled or expiring codes for anyone temporary, so revocation happens whether or not you remember.
• Leave automatic firmware updates on, and open the app occasionally on a phone that still has it installed.
• Keep a physical way in that does not depend on power: a key with a neighbor, or a key override on the lock itself, tested once rather than assumed.

When a plain mechanical lock is the better answer

Some doors are worse off with electronics on them, and saying so is not a criticism of the category. A cabin or outbuilding that sits unheated and unvisited for months will eat batteries and give you nothing to look at when they die. A household where nobody will ever open the app is a household where the firmware never updates and the old codes never get cleared. A door where the reason for keyless entry is simply that people keep losing keys can be answered by a mechanical pushbutton lock, which is one of the five things sold as keyless entry and the only one with no battery, no account and nothing to update.

Common questions

Can someone hack my smart lock with an app on their phone?

Not in the way the phrase suggests. There is no general tool that opens locks the way a key opens one, because a working attack has to target a particular product, a particular firmware version and a particular defect, and it stops working when that defect is patched.

The version of that fear that deserves attention is someone signing into your account with a password you also used on a shopping site that was breached. That needs no defect at all.

What happens to a smart lock in a power outage?

The lock itself runs on its own batteries and does not care about the mains. The keypad and the thumbturn go on working. What stops is anything routed through your router and the internet, so remote access and notifications go away until power returns, and a hub-based lock loses its connection to the hub.

Is a keypad code safer than a physical key?

They fail differently. A key can be copied at a hardware store by anyone who holds it for ten minutes, and you never learn that it happened. A code cannot be copied, but it can be watched, guessed from wear on the buttons, or forwarded to somebody you did not intend. The advantage of the code is that you can change it in thirty seconds, which is not true of a key that has been out in the world.

What if the manufacturer shuts down its servers?

It has happened to smart home products in other categories, and it is a fair question to ask before buying. A lock whose local functions are self-contained, meaning keypad, key and thumbturn, keeps opening the door. What it loses is the app, remote access and the integrations. Locks that speak a local standard directly to a hub or a border router are less exposed to one company’s business decisions than those that route everything through a single vendor cloud.

The short version

Remote attacks on smart locks are real but need a specific disclosed defect in a specific version, and they close when the firmware updates. Radio attacks are real and require somebody standing at your door, which auto-unlock makes easier and switching it off makes moot. The things that actually cost people a night outside are flat batteries, an app used as the only credential, and codes issued years ago to people long gone. Give the lock account a unique password, change the default code from the manual, clear the user list twice a year, and put long screws through the strike plate into the framing. That last one has nothing to do with electronics and does more for the door than any of it.