Smart Locks: How Connected Locks Work, What the Standards Test, and Where the Risks Are

Two Basic Designs

Retrofit units mount on the inside of the door over an existing deadbolt. August, for example, says its smart locks "simply attach to your existing deadbolt, on the inside of your door," and work with an existing single-cylinder deadbolt. Since the outside of the lock doesn't change, August notes that "your keys will still work." The motor turns the deadbolt's existing tailpiece, which is the job the thumbturn normally does.

Integrated smart deadbolts replace the whole lock. Schlage's Encode, for example, is sold as a "Smart WiFi Deadbolt" with built-in Wi-Fi, an app for remote locking and unlocking, custom access codes for guests, and viewable lock history. Since the integrated unit is itself the deadbolt, its bolt, cylinder, and housing are what resist attack. That is why the mechanical grading discussed below matters.

The choice between the two usually comes down to:

• whether the existing deadbolt is worth keeping
• whether a keypad is wanted on the outside
• how much of the door hardware the owner wants to change

See deadbolts.

What Smart Locks Add

Manufacturer feature lists vary. The most common features across product pages are:

• Remote control. Locking and unlocking from an app, sometimes through a separate bridge or hub.
• Shared access. Phone-based "virtual keys" or unique keypad codes for family, guests, or service workers. August describes letting in "cleaners, petsitters, or loved ones."
• History. A record of when the lock was used and by which credential.
• Door status. Some products add a sensor that reports whether the door is closed as well as locked. August says its DoorSense feature "tells you if your door is securely closed and locked," and that with it installed, Auto-Lock can lock as soon as the door closes.

These features make smart locks useful for managing access as well as for locking. The same features are also what create new kinds of risk (see below).

How They Connect

Smart locks use one or more wireless technologies. In brief:

• Bluetooth LE is designed, in the Bluetooth SIG's words, for "very low power operation." It is commonly used for phone-at-the-door control.
• Wi-Fi lets a lock reach the internet without a separate hub.
• Z-Wave and Zigbee are low-power mesh technologies used by home automation systems. Z-Wave runs in the sub-1 GHz band, and Zigbee is maintained by the Connectivity Standards Alliance (CSA).
• Thread is an IPv6 mesh network on the same IEEE 802.15.4 radio Zigbee uses. It needs a border router to reach the rest of the home network.
• Matter is the CSA's application protocol. It runs over Wi-Fi, Thread, or Ethernet, uses Bluetooth LE for setup, and lists door locks as a supported device type.
• Aliro is a separate CSA specification for using a phone or wearable as the credential at the door. Version 1.0 was released on February 26, 2026.

The full comparison, with sources, is in smart lock protocols.

What the Standards Test

Batteries. ANSI/BHMA A156.33-2024 covers internally powered architectural hardware. BHMA's list of covered product types includes:

• motorized deadbolts
• push-button locks
• self-contained RFID locks
• e-cylinders
• active RF key fobs

The standard "establishes methods for verifying manufacturer's claims for principle battery performance" for commercial and residential products. It uses standardized use cases and measured current draw to calculate expected battery life. BHMA notes the performance is determined in a normal lab environment and "is not intended to be representative of extreme environments." The standard also requires a low battery warning that tells the user battery service is coming due.

The lock itself. A smart deadbolt is still a deadbolt, and BHMA's residential standards apply to its mechanical parts:

• ANSI/BHMA A156.40-2025 (residential deadbolts) covers durability, security, and finish. BHMA's summary says Grade A residential dead latches must pass 400,000 opening-and-closing cycles. It lists seventeen tests, including one that loads the door against the deadbolt with 1,350 pounds of force.
• ANSI/BHMA A156.39-2025 (residential locksets and latches) covers the lever or knob sets often sold to match smart deadbolts. BHMA says Grade A locks must pass 400,000 cycles with a 5-pound axial load. One of its eleven tests requires the latch to withstand 800 pounds of force.

The residential ratings are reported as three letters for security, durability, and finish. Schlage, for example, advertises a BHMA "AAA" rating for Encode. Product claims can be checked against BHMA's certified products directory.

For scale on the commercial side, ANSI/BHMA A156.36 sets the Grade 1 deadbolt figure at 250,000 cycles. See ANSI/BHMA lock grades.

Security Trade-Offs

Connecting a lock changes what an attacker might target. The mechanical parts still matter, but so do the radio link, the app account, and the firmware.

Bluetooth relay. In a technical advisory dated May 15, 2022, the security firm NCC Group described a link-layer relay attack on Bluetooth LE proximity authentication. This covers systems that unlock or stay unlocked when a trusted phone seems to be nearby, and NCC listed "residential smart locks" among common examples.

The advisory found that two common defenses don't stop this kind of relay:

• link-layer encryption
• normal response-timing checks

NCC recommended that developers require user interaction on the phone to authorize an unlock, or use time-of-flight distance bounding such as Ultra-Wide Band. For existing products, it recommended giving users the option to turn off passive, proximity-only unlocking. This encyclopedia describes the issue only at that level.

Practical habits. Practical precautions follow from these points:

• Treat passive auto-unlock as a convenience setting to weigh, not a default.
• Remove codes and shared access when they are no longer needed.
• Review the access history.
• Replace batteries when the low-battery warning appears.

Mechanical Backup and the Cylinder

Many smart deadbolts keep a key cylinder as a backup, and retrofit units keep the existing one. A cylinder that stays on the door is still part of the lock's security. A low-grade or common-keyway cylinder is unaffected by the electronics in front of it. Where a key cylinder is present, the usual guidance on pin tumbler locks, security pins, and key control still applies. Whether a given model offers a keyed backup, and what happens when its batteries fail, is a product-by-product question. Check the manufacturer's documentation.

Related Topics

• Electronic locks: the broader category
• Smart lock protocols: Bluetooth, Wi-Fi, Z-Wave, Zigbee, Thread, Matter, Aliro
• Deadbolts: the mechanism most smart locks drive
• ANSI/BHMA lock grades: residential and commercial grades
• Smart keys and RFID locks: related credentials
• Biometric locks: fingerprint and similar inputs
• Access control: the commercial equivalent
• Pin tumbler locks: the backup cylinder

Sources