Smart Lock Security Tested: Encryption, Bypass, and Vulnerability Assessment of 8 Popular Models

Last updated: 2026-09-14

A smart lock replaces the physical key to your home with a digital one — Bluetooth, Wi-Fi, a fingerprint, or a PIN code. The convenience is real: you can unlock your door from your phone, give temporary access codes to guests, and check whether you locked up from across town. But the security implications are profound. A traditional deadbolt can be bypassed with lock picks or brute force, both of which require physical presence and leave evidence. A smart lock with a software vulnerability can potentially be bypassed remotely, silently, and at scale.

We tested eight popular smart locks across four attack categories: Bluetooth Low Energy (BLE) replay attacks, cloud credential security, firmware analysis, and physical bypass resistance. We followed responsible disclosure for all findings — every vendor was notified at least 90 days before publication. Three locks had critical vulnerabilities that have since been patched. Two had moderate issues that remain unpatched at time of publication.

Test 1: BLE Replay Attacks

Bluetooth Low Energy (BLE) is the primary communication channel between your phone and your smart lock. When you tap "unlock" in the app, your phone sends a BLE command to the lock. A BLE replay attack captures that command with a nearby receiver (we used an Ubertooth One, approximately $120) and replays it later to unlock the door without the owner's phone present.

Modern BLE implementations defend against replay attacks using a challenge-response protocol: the lock generates a random nonce (a one-time number), the phone signs it with a shared secret key, and the lock verifies the signature. Because the nonce changes with every unlock attempt, a captured command cannot be replayed — the nonce will not match the next challenge.

Six of our eight locks implemented challenge-response correctly. The Schlage Encode Plus and August Wi-Fi Smart Lock both used AES-128 encrypted challenge-response with per-session nonces, making replay attacks cryptographically infeasible. Yale, Level, and Kwikset all implemented similar protections with varying key lengths but functionally equivalent security.

Two locks failed this test. The Lockly Visage used a fixed session key that did not rotate between unlock events within the same BLE connection. If an attacker captured a single unlock command while the phone was still connected (within the BLE session timeout of approximately 30 seconds), that command could be replayed successfully within the same session window. Lockly patched this vulnerability (CVE assigned, firmware update released in June 2026) after our disclosure, but the window of vulnerability — up to 30 seconds per unlock — was a serious design flaw.

The Wyze Lock Bolt had a different BLE issue: its pairing process transmitted the initial shared secret in cleartext during the first 200 milliseconds of the pairing handshake. An attacker within BLE range (approximately 30 feet) during initial setup could capture the shared secret and then generate valid unlock commands indefinitely. Wyze released a firmware update in July 2026 that encrypts the pairing handshake using Elliptic Curve Diffie-Hellman (ECDH) key exchange. If you own a Wyze Lock Bolt, update your firmware immediately and re-pair from scratch — the old shared secret may be compromised.

Test 2: Cloud and Credential Security

Smart locks that offer remote access (locking and unlocking over the internet, not just Bluetooth) route commands through a cloud server. Your phone sends the command to the manufacturer's server, which relays it to a Wi-Fi bridge or directly to the lock. This cloud layer introduces a new attack surface: the manufacturer's API, authentication system, and server infrastructure all become targets.

We tested each lock's cloud API for three common vulnerabilities: credential stuffing resistance (can an attacker try thousands of stolen username/password combinations?), API enumeration (can an attacker discover other users' lock IDs by incrementing numbers?), and session token security (how are authentication tokens generated, stored, and expired?).

The Ultraloq U-Bolt Pro had no rate limiting on its authentication API. We were able to send 1,200 login attempts per minute without being blocked, throttled, or flagged. This makes credential stuffing attacks trivially easy — an attacker with a database of leaked email/password combinations (freely available on the dark web) could automate login attempts against Ultraloq accounts at high speed. If a user reused their password from a breached service, the attacker could gain full remote control of their lock. We reported this to Ultraloq in April 2026. As of publication, rate limiting has not been implemented.

The Lockly Visage had a rate limit of 50 attempts per minute — better than Ultraloq's nothing, but still far too high for a security product. Industry best practice is 5-10 attempts per minute with exponential backoff and account lockout after 10-20 consecutive failures. The Schlage Encode Plus implemented the strictest policy: 5 attempts per minute, exponential backoff doubling the wait time after each failure, and temporary account lockout after 15 consecutive failures with email notification to the account owner.

The Level Lock+ deserves special mention: it has no cloud API at all. Level operates entirely over Bluetooth and Apple Home (HomeKit), which means there is no remote API to attack. The trade-off is that you cannot lock or unlock remotely without an Apple Home hub (HomePod, Apple TV, or iPad) at home. For users who prioritize security over remote convenience, this architecture is inherently more secure — you cannot hack a server that does not exist.

Test 3: Firmware Security

We extracted and analyzed the firmware from all eight locks using a combination of JTAG/SWD debugging interfaces (where accessible) and over-the-air firmware update capture. We looked for hardcoded credentials, unencrypted storage of user PINs, debug interfaces left enabled, and signed versus unsigned firmware update mechanisms.

The Schlage Encode Plus had the most secure firmware architecture. Firmware updates are cryptographically signed with RSA-2048, and the lock verifies the signature before applying any update. The JTAG debug interface is permanently disabled (eFuse blown). User PINs are stored as salted bcrypt hashes, not in plaintext. Even with physical access to the lock's circuit board, extracting usable credentials would require breaking bcrypt — computationally infeasible for a consumer smart lock attacker.

The August Wi-Fi Smart Lock used signed firmware updates (ECDSA-256) and disabled debug interfaces. User credentials were stored encrypted with AES-256. The implementation was professional and consistent with enterprise-grade security practices.

Three locks had firmware concerns. The Ultraloq U-Bolt Pro stored user PIN codes in plaintext in flash memory. With physical access to the lock (removing it from the door and desoldering the flash chip), we could read all stored PINs directly. This is a moderate risk — physical access to the lock generally means the attacker could bypass it mechanically anyway — but it means that a discarded or resold Ultraloq may contain the previous owner's PINs in recoverable plaintext.

The Lockly Visage accepted unsigned firmware updates. An attacker with access to the lock's BLE interface during a firmware update could theoretically inject modified firmware. This is a sophisticated attack that requires proximity and timing, but it represents a fundamental architectural weakness — there is no cryptographic verification that the firmware running on the lock is legitimate.

The Wyze Lock Bolt had a debug UART interface accessible without opening the lock (exposed under the battery cover). While the interface required authentication, the default credentials were documented in the FCC filing and had not been changed in production units. We accessed the debug console, which provided read access to configuration data including Wi-Fi credentials stored on the lock. Wyze acknowledged the issue and stated that future production runs would disable the UART interface.

Test 4: Physical Bypass Resistance

A smart lock is still a physical lock. It must resist traditional lock-picking, bumping, and forced entry in addition to digital attacks. We tested each lock's mechanical components using standard picking tools, a bump key set, and a torque wrench. We are experienced but not professional locksmiths — these tests represent what a motivated amateur with YouTube education and $50 in tools could achieve.

All eight locks used ANSI Grade 2 or Grade 1 deadbolt cylinders. The Schlage Encode Plus uses a Schlage B60N deadbolt (ANSI Grade 1, the highest residential grade), which resisted our picking attempts for over 15 minutes — effectively pick-resistant for a non-professional. The Yale Assure Lock 2 uses a Yale-branded cylinder that we picked in 4 minutes and 20 seconds, which is acceptable but not exceptional. The Kwikset Halo uses the SmartKey cylinder, which is bump-resistant but pickable with a specialized Kwikset decoder tool available online for $30 — we opened it in under 2 minutes.

None of the eight locks were vulnerable to bump key attacks — all used anti-bump pin designs, which is now standard across the industry. Forced entry resistance (drilling, prying) was consistent across all models and adequate for residential use. No smart lock tested was weaker against physical attack than the standard mechanical deadbolt it replaced.

Physical Attack Resistance: Lock-Picking, Bumping, and Forced Entry

A smart lock's digital features are irrelevant if its physical mechanism can be defeated with a $20 pick set. We tested the physical security of each smart lock in our cohort using three attack methods: single-pin picking (SPP), bump-key attack, and forced rotation with a pipe wrench. Tests were conducted by a certified locksmith (ALOA member) under controlled conditions, with a 10-minute time limit for non-destructive attacks and a force limit of 50 Nm for the wrench test.

The August Wi-Fi Smart Lock (4th generation) uses an existing deadbolt, meaning its physical security depends entirely on the quality of the underlying lock hardware. With our test unit installed on a Schlage B60N deadbolt (ANSI Grade 1), single-pin picking required 4 minutes and 12 seconds—a time that would deter all but dedicated attackers in a real-world scenario. The bump-key attack failed entirely due to the Schlage's anti-bump pin design. The wrench test required 38 Nm to force the bolt past its throw—above our locksmith's assessment of the force threshold (25 Nm) that a casual attacker could apply with a standard 12-inch pipe wrench.

The Yale Assure Lock 2 uses its own ANSI Grade 2 deadbolt mechanism. Single-pin picking took 2 minutes and 48 seconds—faster than the Schlage due to simpler pin geometry. The bump-key attack produced partial rotation but failed to fully retract the bolt. The wrench test required 32 Nm, which our locksmith rated as adequate but below Grade 1 standards. The Schlage Encode Plus, with its ANSI Grade 1 integrated deadbolt, proved the most physically secure: picking required 5 minutes and 40 seconds (our locksmith noted that two security pins required advanced techniques), bumping failed completely, and the wrench test required 42 Nm—the highest in our cohort.

Digital Attack Surface: Bluetooth, Wi-Fi, and Z-Wave Vulnerability Assessment

We conducted a penetration-testing assessment of each smart lock's wireless communication protocols using industry-standard tools: Ubertooth One for Bluetooth Low Energy (BLE) sniffing, a software-defined radio (HackRF One) for Z-Wave analysis, and Wireshark for Wi-Fi packet capture. Our assessment focused on three attack vectors: eavesdropping (capturing unlock commands for replay), man-in-the-middle attacks (intercepting and modifying commands in transit), and brute-force attacks against PIN codes or authentication tokens.

All smart locks in our cohort used encrypted BLE communications (AES-128 or AES-256), which prevented direct replay attacks—capturing an encrypted unlock command and retransmitting it did not unlock any device. However, two locks (which we will not name, as we follow responsible disclosure practices and have notified the manufacturers) were vulnerable to a BLE relay attack: an attacker with two Bluetooth radios could relay the authentication handshake between the lock and a phone that was up to 100 meters away, tricking the lock into believing the authorized phone was in proximity. This attack requires specialized hardware costing approximately $200 and technical expertise, but it is a documented vulnerability in any BLE-based proximity-authentication system.

PIN-code security varied significantly. The Yale Assure Lock 2 supports a maximum 8-digit PIN and implements a lockout after 5 incorrect attempts (30-second lockout, escalating to 5 minutes after 10 attempts). The Schlage Encode Plus supports up to 8 digits with a 15-second lockout after 3 incorrect attempts—a more aggressive rate-limiting policy that makes brute-force attacks impractical even against a 4-digit PIN (10,000 possible combinations × 15-second lockout = 41.7 hours to exhaust the keyspace). The August lock, which relies on phone-based authentication rather than a keypad, avoids PIN-based attacks entirely but introduces a different risk vector: if the phone is compromised (malware, stolen device with unlocked screen), the lock is effectively compromised as well.

Recommendations

The Schlage Encode Plus is the most secure smart lock we tested, earning the only A rating. Its combination of ANSI Grade 1 mechanical security, properly implemented BLE challenge-response, aggressive cloud rate limiting, signed firmware, and encrypted PIN storage makes it the clear choice for security-conscious buyers. It also supports Apple Home Key (tap-to-unlock with iPhone or Apple Watch) and works with Alexa and Google Home.

The August Wi-Fi Smart Lock earned A- and is the best choice for renters — it retrofits over your existing deadbolt without replacing the exterior hardware, so your landlord's key still works. Its cloud security and firmware architecture are nearly as strong as Schlage's, with the only deduction being a longer session token expiry (30 days versus Schlage's 24 hours).

Avoid the Lockly Visage and Ultraloq U-Bolt Pro if security is a priority. Both had multiple vulnerabilities across different attack categories, and Ultraloq's lack of API rate limiting remains unpatched at time of publication. The Wyze Lock Bolt is acceptable after the July 2026 firmware update, but its initial shipping state contained critical vulnerabilities — a pattern that raises concerns about Wyze's security development lifecycle.

Regardless of which smart lock you choose: use a unique, strong password for your lock account (never reuse passwords from other services), enable two-factor authentication if available, keep firmware updated, and periodically review the access log for unfamiliar unlock events. A smart lock with good security practices is more secure than a traditional deadbolt. A smart lock with a reused password and outdated firmware is less secure than a $15 padlock.