The key is in the jacket hanging at the office. The care service is at the door while you are still at the supermarket. The children come home from school and nobody is there to let them in. A smart door lock solves exactly these everyday problems – provided you choose the right device and set it up properly. Stiftung Warentest examined seven (Stiftung Warentest) models, and of all things the cheapest device at 78 euros (Stiftung Warentest) came out on top. In a wireless door lock, by contrast, a vulnerability was found that prompted the German Federal Office for Information Security to publish a public warning and recommend replacement (BSI). This article takes a sober look at what a smart door lock really delivers in daily life, what matters when choosing one in 2026 – and where the limits are.
Key takeaways
- A smart door lock solves access problems: a forgotten key, the care service, children without keys, tradespeople within a time slot.
- Expensive does not mean secure: in the Stiftung Warentest test, the cheapest device at 78 euros convinced the most (Stiftung Warentest).
- The BSI IT security label has covered smart security technology since August 2025, making update commitments verifiable (BSI).
- Individual rather than pre-programmed access credentials and your own strong password are mandatory, not optional (BSI).
- The mechanical base of cylinder, fitting and door leaf remains the foundation – the motor on the cylinder replaces no mechanics (Polizeiliche Kriminalprävention).
- We check on site whether door and cylinder are suitable at all, mount, calibrate and show the fallback route – a home visit instead of a DIY afternoon.
What a smart door lock really solves in daily life
Smart home technology is no longer a niche topic: 48 percent (Bitkom) of people in Germany use at least one smart home application, up from 43 percent (Bitkom) in 2022. The most widespread are smart lamps at 38 percent (Bitkom) and thermostats at 35 percent (Bitkom). The door lock, by contrast, is the point at which many hesitate – for an understandable reason: with a lamp it is about comfort, with the front door it is about access to your own home. That is precisely why it pays to approach the topic soberly rather than on gut feeling.
The practical benefit is concrete and can be described in a few sentences. You unlock the door via app, numeric code, fingerprint or radio key instead of searching for a metal key. You issue time-limited access – for the care service that comes on weekdays between 8 and 10 in the morning, or for the neighbour who waters the plants during your holiday. And you can see remotely whether the door is really locked. If you would like to combine this topic with other home technology, our smart home consulting is the right starting point.
Equally important is the honest counter-calculation: a smart door lock does not make an unsecured door burglar-resistant. It replaces neither a good locking cylinder nor a security fitting. It needs power, it needs updates, and it brings along an account that someone can attack. Anyone who knows and plans for this gets a device that noticeably eases daily life. Anyone who mistakes it for a security product ends up disappointed.
Forgotten key
Access no longer depends on a piece of metal. A code or the app opens the door even when the key is somewhere else.
Letting in the care service
Time-limited access for fixed visiting hours replaces the spare key that is handed over permanently.
Children without keys
A personal code for each child works after school – and you can see that someone arrived home safely.
The test that raised the security question
Stiftung Warentest examined seven (Stiftung Warentest) smart door locks and delivered a result that contradicts the usual expectation: the best device in the test was also the cheapest. For around 78 euros (Stiftung Warentest), a retrofit drive mounted from the inside onto the existing locking cylinder received a rating of 2.1 (Stiftung Warentest) – partly because of the best handling in the test. A considerably more expensive model with its own locking cylinder at around 310 euros (Stiftung Warentest) reached 2.2 (Stiftung Warentest). Price and security therefore do not run in parallel automatically.
At the other end of the test field stood the problems. One lock was rated unsafe because the testers were able to simply drill it open in less than five minutes (Stiftung Warentest) – without any hacking, using conventional tools. Two devices also accepted passwords that were too short; the testers recommend at least eight characters (Stiftung Warentest). This shows what matters: a smart lock can fail in two completely different ways – mechanically at the drill and digitally at the radio protocol.
Attackers in the vicinity can, by exploiting the vulnerability, lock and unlock the radio lock and thereby gain unauthorised access to buildings, offices or apartments.
It was precisely this second route that later became a precedent. In August 2022, the BSI published a public warning under § 7 (BSI) of the BSI Act about a wireless door lock drive and recommended replacing the product. What mattered was not the gap alone but that it could not be closed: for this product generation there was no update option for customers (BSI). A device without an update path stays permanently attackable if the worst happens – so only replacement remained. Stiftung Warentest subsequently withdrew the quality rating Good (2.4) (Stiftung Warentest) as well as the individual ratings for security and data protection, and advised against continuing to use the lock.
The real lesson: updatability decides
Selection criteria for 2026: how to spot a good lock
Since 18 August 2025 (BSI) there has been a reference point that did not exist before: the BSI introduced the product category „smart security technology“ for its IT security label. It explicitly includes smart locks, that is mechatronic locking devices, along with app-controlled alarm systems, networked smoke detectors and the associated web, app and cloud applications (BSI). The basis is the industry standard VdS 6063 (BSI) on the cyber security of fire protection and security components.
The appeal of the label lies less in the sticker than in the commitment behind it. Manufacturers undertake to report vulnerabilities to the BSI, to close them and to supply the product with security updates for the entire term of the label (BSI). The BSI reviews the application documents and issues the label after eight weeks at the latest (BSI) if the result is positive. Exactly the commitment that was missing in the 2022 warning case thus becomes a verifiable promise. That the demand is there is shown clearly on the consumer side: 96 percent (Bitkom) want an independent security seal for smart home devices, and 87 percent (Bitkom) additionally want a data protection label.
In substance, six requirement areas stand behind the label: transparency about built-in sensors and a policy for handling vulnerabilities, access protection with sufficiently strong and individual per product (BSI) passwords, cryptographically secured communication, timely updates checked for authenticity, ease of use when resetting and changing passwords, and protection of unused interfaces (BSI). Using these six points as a checklist gets you surprisingly far in a shop – even without technical background knowledge.
IT security label
Available for smart locks since August 2025. The QR code leads to current BSI security information about the product.
Update supply
How long does the manufacturer deliver security updates, and how do they reach the device? Without an update path, only replacement remains.
Individual credentials
Pre-programmed default data, identical across all devices, is a knock-out criterion. Every device needs its own keys.
Your own strong password
At least eight characters is the test recommendation, more is better. One password per account – a password manager takes over the work.
Comprehensible radio technology
Short-range radio paired at the device is more manageable than a permanently open remote connection. Fewer routes outward, less attack surface.
Matching the door
Cylinder length, door thickness, fitting and rebate clearance decide whether a drive sits properly and keeps locking reliably.
Before buying: measure the door first, then pick the lock
Mechanics remain the foundation
The crime prevention agency of the German federal states and the federal government sums up its recommendation in one sentence that applies to smart technology too: mechanics come before electronics (Polizeiliche Kriminalprävention). First you ensure good mechanical protection of doors and windows so that offenders cannot get in at all. Only then does electronics add value – as monitoring, as an alert, as comfort. The combination of mechanics and a hazard warning system recommended by the police carries the designation B+ (Polizeiliche Kriminalprävention) in the K-EINBRUCH level; the scale runs from A+ for optimal to C for insufficient protection.
A secure lock consists of more than one component. What is needed is a high-quality locking cylinder protected against pulling, drilling, picking and bumping, a burglary-resistant mortise lock with latch and bolt, and a security fitting that covers the cylinder (Polizeiliche Kriminalprävention). For mortise locks, DIN 18251 (DIN 18251) defines the classes: class 3 covers apartment entrance doors, for front doors at least class 4 (DIN 18251) with burglary resistance is recommended, and class 5 (DIN 18251) stands for increased burglary resistance. For new builds and refurbishments the path leads to tested doors under DIN EN 1627 (Polizeiliche Kriminalprävention) from resistance class RC 2, and for retrofitting to systems under DIN 18104 (Polizeiliche Kriminalprävention).
That also makes clear where the motor stands: it sits inside on the cylinder and turns it – nothing more. It reinforces no door leaf, it replaces no security fitting, and it does not help against a drill. The test demonstrated exactly this in practice when a lock was drilled open in less than five minutes (Stiftung Warentest). The one genuine security gain, by contrast, is unspectacular: many drives lock automatically when the door falls shut, so locking up can no longer be forgotten (Polizeiliche Kriminalprävention) – and a door that is merely pulled shut is the most common weak point of all.
| Task | What handles it | What does not |
|---|---|---|
| Preventing the door from being levered | Burglary-resistant door from RC 2, multi-point locking, sturdy frame | The motor drive on the cylinder |
| Protecting the cylinder against pulling and drilling | High-quality cylinder plus security fitting | The app and its encryption |
| Avoiding a forgotten lock-up | Automatic locking when the door falls shut | The best mechanical cylinder on its own |
| Limiting access in time | Codes and time slots in the smart lock | The spare key under the doormat |
| Fending off radio attacks | Current firmware, individual credentials, strong password | Mechanics of any quality class |
Two questions, two answers
Power, battery and the fallback route
A motor needs energy, and batteries run flat – that is the most banal and at the same time most underestimated property of a smart door lock. The good news: a dead battery as a rule does not mean a locked-out household, because retrofit drives sit inside on the cylinder and the cylinder can still be operated from outside with the mechanical key. The prerequisite is a cylinder that stays keyed on both sides – and that is exactly why we check this point before mounting (Projekterfahrung).
The practical consequence: the mechanical key stays in play. It does not move into a drawer but into your wallet or to a trusted person. And the battery warning is not swiped away but taken seriously. With models that have their own locking cylinder and no emergency lock, the calculation looks different – here it pays to read the manual closely before buying, not afterwards.
- Activate the battery warning in the app and replace at the first notice, not the last.
- Keep the mechanical key and have it at hand – it is the fallback route, not an obsolete model.
- Clarify before buying what happens when the battery is empty and whether a backup power contact or emergency lock exists.
- Plan a second access route, such as a code on an indoor keypad or a key with a trusted person.
- After a battery change, lock and unlock once completely so the calibration is correct.
- Check the range of the radio connection in the hallway – a stable network is a prerequisite, see Wi-Fi optimization.
A power cut affects the app more than the lock
Rented flats, relatives and data minimisation
In a rented flat the first question is not a technical one but one of agreement. A retrofit drive glued or screwed onto the existing cylinder from the inside, changing no substance, is something different from replacing the locking cylinder or working on the door leaf. As soon as the door is drilled into or the cylinder is swapped, the landlord's consent belongs in the picture – beforehand and in writing. If the cylinder belongs to a master key system for the building, the matter requires agreement with the management anyway. Anyone who wants to restore the original state when moving out keeps the original cylinder and fitting.
For access by relatives and services, a simple principle applies: as much access as necessary, as little as possible. The care service does not need permanent full access but a time slot on certain weekdays. The tradesperson needs a code for one morning, not for a year. Every person gets their own access – this way a single access can be revoked without changing all the others. For older relatives a fixed code is often more pleasant than an app; our page on tech help for seniors shows which routes have proven themselves.
That leaves the log. A smart lock records who opened when – useful in case of doubt and delicate in daily life, because it also documents when someone leaves the house. Data minimisation here means keeping only the logs you really need, limiting the retention period and informing the people you live with. How to set up a connected home with data minimisation overall is covered in our guide setting up a secure and private smart home. The figures show the concern is justified: 55 percent (Bitkom) fear surveillance by smart home devices, and among non-users 54 percent (Bitkom) name hacker attacks and 43 percent (Bitkom) data misuse as a reason.
| Situation | Recommended | Better avoided |
|---|---|---|
| Care service | Own access with a time slot on fixed days | Handing over a spare key permanently |
| Children after school | A personal code per child, traceable and individually changeable | One shared code for the whole family |
| Tradespeople | A code for one morning, deactivated afterwards | Permanent access that nobody ever removes |
| Rented flat | Retrofit drive without intervention, agreed beforehand in writing | Swapping a master system cylinder on your own |
| Logs | Keep only what is needed, limit the retention period | Recording everything permanently and pushing it to the cloud |
| The lock's account | Own long password, two-factor sign-in | The same password as the mail account |
One last point belongs to honesty: the account the lock hangs on is itself a target. A separate long password per service and two-factor sign-in close the most common entry points without you having to memorise anything – how that works without slips of paper is described in our article setting up a password manager securely. If you want to connect several trades, our overview of the Matter standard explains which devices will work together in future.
How we set up the lock at your home on site
One step at a time – in the order that saves trouble. First the door: we measure cylinder protrusion, door thickness and fitting, and check whether the door falls cleanly into the lock or has to be lifted. Only once it is established that door and cylinder are suitable does the question of the device arise. If the existing cylinder does not fit, we say so openly instead of screwing a drive onto a door where it will struggle permanently. This preliminary check is the part a parcel delivery cannot provide.
Then comes mounting including calibration: the drive has to turn the cylinder over the full travel, with the right force and the right end points. Afterwards we set up the access routes – your own, the codes for children or relatives, the time slot for the care service – and define the automation rules, such as locking when the door falls shut. Finally we show the fallback route: where the mechanical key is, what the battery warning means and what to do if the router fails. If you also want to keep an eye on the access points around the house, security cameras complement the lock sensibly.
Because we drive to you in the Hildesheim and Leine valley region, this can usually be done in a single appointment. Many combine the visit with further topics – such as setting up the whole home, a video doorbell at the same entrance or securing the house before a holiday. Topics that at first glance have nothing to do with the front door can be handled too, for example the electronic patient record in the app. What a home visit costs is stated transparently on our pricing page; we are happy to give a first assessment via the contact form.
A home visit instead of a DIY afternoon
Sources and studies