Are Smart Locks Safe? ANSI Grades, Hacks and Lockouts

How strong is a smart lock compared with a regular deadbolt?

Physical strength is graded the same way for smart and mechanical locks. The Builders Hardware Manufacturers Association (BHMA) writes the American National Standards for door hardware. Its standard for home deadbolts is ANSI/BHMA A156.40, which covers durability, security and finish. BHMA's summary says it specifies seventeen security tests, including one that loads the door against the deadbolt with 1,350 pounds of force, and that a Grade A residential deadlatch must pass 400,000 opening and closing cycles.

The residential system grades three categories separately. Schlage explains it as C for good, B for better and A for best in Security, Durability and Finish, so AAA is the top grade in all three. Most other BHMA standards use Grades 1, 2 and 3, with Grade 1 the highest. As an example of how far apart those grades are, BHMA's own explanation of a lock standard lists a cylinder ram test at 75 ft-lbf, survived for 10 blows at Grade 1, 5 at Grade 2 and 2 at Grade 3.

What makers publish for the smart locks covered here, as of October 2026:

Retrofit locks are a special case. They motorize the deadbolt you already have, so the strength of the door is the strength of that existing bolt, strike and frame. BHMA also cautions that its grades are laboratory tests with no absolute correlation to real-world lifespan.

A graded lock still depends on the door around it. The strike plate, its screws and the frame are usually what gives. The same logic applies to every entry point, including patio doors, which our sliding glass door security guide covers.

Can smart locks be hacked?

Yes, and some have been, in documented and disclosed cases. Two examples from primary sources:

• Bluetooth relay attack on Kwikset Kevo (2022). NCC Group demonstrated a link layer relay attack on Bluetooth Low Energy proximity unlocking. Its advisory says attackers could unlock Kevo locks without authorization by placing one device near the lock and another within Bluetooth range of the owner's phone or fob. Kevo disabled touch-to-unlock after the phone had been stationary for 30 seconds, but the attack still worked while the phone was being carried. NCC Group's advice to users was to disable passive unlock features that do not require explicit approval.
• August Connect Wi-Fi bridge (CVE-2019-17098). The US National Vulnerability Database lists a hard-coded cryptographic key in the August Connect Wi-Fi Bridge app and firmware that let an attacker decrypt an intercepted payload containing the home Wi-Fi credentials. It affected app version 10.11.0 and earlier on Android and Connect firmware 2.2.12 and earlier.

Neither flaw is a remote "open any door" exploit. The Kevo attack needed equipment near both the lock and the owner, and the August bug exposed home Wi-Fi credentials in an intercepted payload rather than opening the lock. Both show the pattern: the risk sits in the radio, the app and the cloud account, not the bolt.

Radio security has improved on some platforms. Ring says its Alarm sensors use Z-Wave S2, introduced in 2018, with Elliptic Curve Diffie-Hellman key exchange and AES encryption, and tells buyers to check with the lock maker whether a given lock supports S2.

The account is usually the softer target. The steps that matter are the same as for cameras: a unique password, two-factor login on the app account, firmware updates, and removing shared codes and guest users you no longer need. Our can security cameras be hacked guide covers the account side in more detail.

What happens when the app or the battery fails?

The most common smart lock failures are not attacks. They are a dead battery and a dead service.

When the maker shuts down the app. ASSA ABLOY ended support for the Kevo app and web portal on November 14, 2025, covering Kwikset, Weiser and Baldwin Kevo locks of all generations. Remote control stopped, while the physical key and the key fob kept working. Owners were offered discounts on replacement locks. The lesson is that remote features depend on the company behind them, so a lock with a mechanical key, or one that works locally through standard protocols, ages better.

When the battery dies. Keyed and retrofit locks fall back to the key. Key-free locks need a 9V battery held to external terminals or a USB-C power bank. Our smart lock battery dies guide lists the method for each brand.

When someone guesses codes. Some locks publish their response. SimpliSafe's Smart Lock starts notifications and progressively longer lockouts from the fifth wrong PIN, triggers system cameras to record, and has the monitoring center call professionally monitored customers after the eleventh. Its duress PIN opens the door but silently alerts the monitoring center, with select plans.

On paper, a safe setup looks like this: a lock with a published BHMA grade (or a retrofit on a solid existing deadbolt), a working key or emergency power path, passive proximity unlock turned off unless you need it, and an app account locked down with two-factor login. No lock prevents every break-in; the smart locks for security systems guide covers how pairing a lock with an alarm adds detection on top of the bolt.