Most smart lock problems start at the door, not in the app. A lock that does not fit the cylinder, cannot be opened from outside while a key sits in the inside, or needs a hub you do not own will annoy you every day, whatever its feature list says. The checks below go in the order that saves money: the door first, then the radio, then the way you will unlock it, and finally security and power.

Retrofit or full replacement

Smart locks for front doors come in two broad designs.

A retrofit lock sits on the inside of the door and turns the key you already have. Nuki's Smart Lock Pro is a typical example: it mounts over the existing key on the inside, the outside of the door does not change, and you keep using your normal key from outside. Nuki states the lock is for indoor use only and must not be mounted on the outside of the door.

A replacement lock takes the place of the existing lock hardware, usually with a keypad or reader on the outside. Aqara's U600 for UK multipoint doors is one of these: HomeKit News reports door thickness of 40-80 mm and backsets of 35-70 mm, a 15-30 minute install with a screwdriver, and the option to put the original lock back when you move.

A retrofit lock is usually the easier choice for renters, because the cylinder and the outside of the door stay as they are. A replacement lock gives you a keypad, fingerprint reader or NFC reader on the outside, which a retrofit lock can only add with a separate keypad.

Measure the door before you shop

Every maker publishes a compatibility guide, and it is worth reading before you order. Nuki's guide for the Smart Lock Pro shows the kind of numbers that matter:

  • a cylinder that sticks out less than 6 mm works with the stick-on mounting plate,
  • the key may be at most 4 mm thick and stick out at most 37 mm,
  • on a door that opens inwards, the keyhole centre needs more than 30 mm to the frame and to the handle,
  • on a door that opens outwards, it needs more than 40 mm to the frame and more than 30 mm to the handle.

The same guide says the lock can drive multipoint locks and cylinders that need several turns. Other brands use other limits, so check the guide for the exact model. Take the measurements with a ruler, not by eye. A few millimetres decide whether the lock fits.

Check the emergency function on your cylinder

This step is easy to skip and expensive to get wrong. A retrofit lock leaves a key permanently in the inside of the cylinder. With an ordinary cylinder, a key inserted on the inside blocks a key on the outside. If the battery dies or the lock jams, you cannot get in with your own key.

A cylinder with the emergency function lets you open it from outside even when a key sits on the inside, and the inner and outer keys turn together. Nuki's test takes a minute:

  1. With the door open, insert a key on the inside and turn it to an angle.
  2. Insert a second key on the outside.
  3. Try to lock the door.

If it locks, the cylinder has the emergency function. If not, Nuki suggests two options: replace the profile cylinder, which is a standard part, or ask a locksmith whether your current cylinder can be retrofitted. For cylinders without the function, Nuki recommends its Smart Lock Ultra instead of the Pro.

Choose the radio based on how you will use it

The radio decides what works when you are away, what needs a hub and how much of it runs locally.

Bluetooth only. Almost every smart lock talks Bluetooth to the phone. That covers unlocking at the door. Remote access, notifications away from home and integration with a smart home platform usually need something else: a bridge, a hub, built-in Wi-Fi or Matter.

Matter over Thread. This is the standard way to get one lock into several smart home platforms at once. Nuki's Matter locks (Smart Lock 4th generation and newer) support Apple Home, SmartThings, Google Home and Amazon Alexa, and Nuki describes the Matter connection as local, inside your home network. In practice this means you need a Thread border router within radio range of the door. During setup, Nuki lists three conditions: the phone within Bluetooth range of the lock, the hub within Thread range of the lock, and phone and hub on the same Wi-Fi network. Nuki also warns that not every Matter hub supports remote access over Thread, so check that if you want to unlock from outside the house. If you have border routers from several brands, see our article on Thread networks: a lock at the edge of the house benefits most from one dense mesh.

Cloud next to Matter. Nuki states that its cloud service, Nuki Web, can run alongside Matter for Google Home and Alexa and acts as a fallback for remote access. Aqara's U600 needs an Aqara hub for remote unlocking and Aqara automations through the Aqara Home app, according to HomeKit News. Look at what each path requires before you count on it.

Z-Wave. Z-Wave locks must be added securely. Silicon Labs' certified door lock reference application requests the S0 and S2 Access Control security classes, and the controller must support S2 Access Control or S0 to control the lock. A controller without S2 Access Control or S0 support cannot operate such a lock.

Decide how you will unlock it day to day

Phone wallet keys. Apple Home Key lets you tap an iPhone or Apple Watch on the lock. On the Aqara U600 it requires an Apple Home hub (HomePod, HomePod mini or Apple TV). Samsung offers a similar wallet key through SmartThings.

Aliro. The Connectivity Standards Alliance released Aliro 1.0 on 26 February 2026. It stores a digital key in the phone or watch wallet and works over NFC for tap to unlock, Bluetooth LE, and Bluetooth LE with UWB for hands-free entry. The CSA says it uses asymmetric cryptography and works without network coverage. Apple, Google and Samsung committed to it, and the first expected certifications include Apple, Allegion, Aqara, Google, Kwikset, Nuki and Samsung. Two caveats from The Verge's reporting: in the home, Aliro will initially need a Matter platform and controller because Aliro does not define how keys are created and managed, and many current locks will not get it by update. Kwikset said its Halo Select Plus would not be upgraded, and Yale said the same about its Assure Lock 2 Plus. If Aliro matters to you, buy a model with a confirmed Aliro update or wait for certified hardware.

Keypads and fingerprints. These work for guests, children and anyone without a phone. They also give you a way in when the phone is dead.

Voice. Unlocking by voice is convenient and risky in equal measure. In the Alexa app you have to turn on "Unlock by Voice" and set a voice code, and Alexa asks for that code before unlocking. Nuki notes that Google Home currently does not support locking and unlocking its locks by voice, because of the switch to Gemini and the PIN required for security devices. If you enable voice unlocking, always set the code.

Security questions to ask before buying

A lock is a security device, so the vendor matters as much as the hardware. The TTLock case from October 2026 shows why. According to VulnCheck's advisory for CVE-2026-112345, the TTLock Android app before version 9.8.260718 and the related lock firmware protect the per-pairing session key with a hard-coded AES key. Someone within Bluetooth range who records the pairing can recover the session key and forge requests to unlock the lock, add fingerprints or access codes and perform admin actions. VulnCheck rates it 8.6 on CVSS 4.0. We covered it in our TTLock news item.

Questions worth asking, based on that case:

  • Does the maker publish security advisories and firmware updates, and does the app update the lock firmware?
  • Does the lock work locally (Bluetooth, Matter, Z-Wave) if the vendor's cloud goes down or the company stops the service?
  • Can you see and revoke every user, code and fingerprint in one place, and does the lock keep a log?
  • Is pairing protected by something better than a key shared by every unit?

Practical habits help whatever you buy: pair the lock at home rather than in a public place, keep the app and firmware updated, remove old users and temporary codes, and check the access log now and then.

Power and the day the batteries run out

Every battery lock will run flat eventually, so plan the way back in before it happens. A retrofit lock on a cylinder with the emergency function always leaves the mechanical key as a backup. Replacement locks handle this differently. The Aqara U600, for example, has a concealed USB-C port on the outside that powers the lock from a power bank, and Aqara quotes up to about ten months on four AA cells, depending on use. Turn on low-battery notifications and replace batteries when the app warns you, not when the lock stops responding.

Common mistakes

  • Ordering before measuring the cylinder, key and distances to frame and handle.
  • Fitting a retrofit lock on a cylinder without the emergency function.
  • Assuming "works with Matter" means remote access, without checking the hub and Thread coverage at the door.
  • Setting up a Matter lock straight from a phone with a Thread radio instead of a permanent border router. Nuki warns that such a lock loses its connection when the phone leaves or turns the temporary network off.
  • Turning on voice unlock without a code.
  • Leaving former tenants, cleaners or tradespeople in the user list.