August Smart Lock: Is It Actually Secure?

An earlier version of this page credited August's security posture to ASSA ABLOY, "August's parent company." That was true once. It stopped being true on 20 June 2023. Corrected

Here is what happened, and it's on the public record because a court made it so. ASSA ABLOY agreed to buy Spectrum Brands' hardware division — Kwikset, Weiser, Baldwin — for $4.3 billion. The United States Department of Justice sued to block it. The settlement let the deal proceed on condition that ASSA ABLOY divest its August and Yale residential and multifamily smart lock businesses in the United States and Canada. Those went to Fortune Brands for $800 million, and both transactions closed the same day. Documented

Why does it matter more here than on a mechanical lock? Because a mechanical deadbolt doesn't need anyone to stay in business. A Schlage B60N from 1998 still works. This lock needs an app, an account, a cloud service and a firmware pipeline, and every one of those is a promise from whoever currently owns the brand. Ownership changes are the single best predictor of that promise changing — and this one was compelled by antitrust remedy rather than chosen.

The same shuffle covers Yale, which is why our August versus Yale comparison is now a comparison between two brands under one roof in North America and two different roofs elsewhere.

The consistent pattern across long-term owner reports is that the first fortnight is delightful and month two is where the character shows. Auto-unlock throws the deadbolt before you touch the door; you hand out virtual keys; you set auto-lock to thirty seconds.

Then the edges appear. Community

Auto-unlock is the most commonly reported weak point. Community It is a geofence plus a Bluetooth handshake, so it can fire too early — unlocking while you are still on the drive — or too late, leaving you waiting at the door with your hands full. Households with several people on auto-unlock report it getting confused about who is arriving. Few call it broken; many say it is the feature they stopped relying on.

Owners widely report the motor slowing before the low-battery warning becomes urgent. Community August states the app warns you well ahead of failure. Manufacturer The practical advice from people living with one is the same either way: keep spares in a drawer and change them when it sounds tired, not when you are told to.

DoorSense is the underrated part. A small magnetic sensor on the frame tells the app whether the door is physically shut, not merely whether the bolt is thrown. That distinction matters more than most people realise, because a deadbolt extended into thin air is the classic false sense of security. You can set auto-lock to engage only when the door is genuinely closed.

The battery figures, corrected

We previously wrote that the lock takes "CR123 batteries (Wi-Fi model) or 2× AA batteries (4th Gen)," as though those were two different products. They aren't. Corrected The Wi-Fi Smart Lock is the 4th generation, and it takes two 3V CR123 or CR123A lithium cells. Manufacturer The AA-powered unit was the earlier generation, which needed a separate Connect bridge to reach your network.

August rates the current lock at three to six months, not the four to five previously published here. Manufacturer And there's a detail worth knowing: the 4th generation has worse battery life than the 3rd, because moving the Wi-Fi radio into the lock body removed the bridge and put the network load on the batteries. August's own figures at launch were six months for the old bridge-dependent model against three to six for this one. Documented You traded a wall wart for shorter battery life. Most people would take that trade; nobody mentions it.

One more constraint that catches people: it is 2.4 GHz only, with no Z-Wave support, so hubs that require Z-Wave will not see it. Manufacturer

The blunt version first, because this is the part that separates this site from every other review.

The August is only as secure as the deadbolt underneath it. It doesn't replace your lock; it wraps around the interior thumb turn of the lock you already have. If that's a cylinder with a documented bypass, the August doesn't fix it — it adds app control to a lock that can still be defeated in seconds. The tailpiece adapter joining August's motor to your thumb turn is a coupling. It adds no kick resistance, no strike plate, no bolt throw.

The electronic side deserves more than one sentence

We previously said "remote hacking isn't the realistic threat vector here" and moved on. That's the right conclusion and the wrong amount of work. August has a real, documented security history, and it's more interesting than either "it's fine" or "smart locks are hackable." Corrected

At DEF CON 24 in 2016, researcher Jmaxxz presented Backdooring the Frontdoor, covering the first and second generation locks. He performed a man-in-the-middle attack that bypassed the app's certificate pinning, mapped August's entire web interface, and demonstrated escalating a guest account to owner. He also found that the app's debug logs contained credentials sufficient to authenticate a user. Documented At the same conference, separate research reported that twelve of sixteen Bluetooth smart locks tested had broken security. Documented

Now the part that's genuinely to August's credit, and which the outrage coverage skipped: they shipped fixes about ten days later. Documented In a category where "manufacturer ignores researcher" is the default story, that is a meaningful signal about how a company will treat the next disclosure.

How the encryption actually works

We previously specified a key length for the lock’s encryption. The sources don't support that precision and we've cut the number. Corrected What is documented: August locks use the Advanced Encryption Standard — AES — to secure communication between phone and lock, and each lock holds up to 256 key slots, numbered 0 to 255. Slot 0 is the privileged "firmware key" — only a session established with it can populate the other slots, and it never changes. Documented A lock that has one permanent master credential is a very different design from one that rotates everything, and that's worth knowing regardless of key length.

Two later items belong on the record with a caveat, because we could only find them through secondary reporting: a revoked-guest persistence issue, where a removed guest's key could reportedly be modified to retain owner-level access until server-side and firmware patches landed in August 2020; and an entry in the Common Vulnerabilities and Exposures catalogue, CVE-2019-17098, concerning the Connect bridge transmitting a home Wi-Fi password during setup protected by a key hardcoded into the app. Reported, not primary-sourced If either affects a lock you own, the fix in both cases is the same: update firmware and the app, and rotate your Wi-Fi password if you set up a Connect bridge before 2020.

The realistic threat to your door remains the one you had before you bought this: someone physically attacking the lock from the outside. The August does not change that equation at all.

Every smart lock review tells you about battery life. Almost none tell you what you own if the company stops caring, and after an ownership change that's the question worth asking.

The good news, and it's specific to the retrofit design: the August fails gracefully in a way most smart locks don't.

• Your key still works. The exterior cylinder is untouched. This is the single biggest advantage of a retrofit over a full replacement smart lock — the analogue path out of the building never depended on the company.
• The thumb turn still works. You turn the lock body itself from inside, like a chunky thumb turn. Dead batteries, dead Wi-Fi, dead company: the door still opens by hand.
• Bluetooth survives the cloud. If the network drops, your phone still talks to the lock at close range.

The bad news is everything that made you buy it. Remote access, guest keys, activity logs, auto-unlock and voice control all run through an account and a service. If that service is retired, repriced or migrated, the lock reverts to being an expensive motorised thumb turn. That has already happened once in a small way — the app has moved between August and Yale Access branding as the corporate arrangement shifted.

So the honest framing for anyone weighing this against a mechanical upgrade: you are renting the smart features and buying the hardware. The hardware degrades to something still usable. That's better than most of this category manages, and it's still worth knowing before you spend $200.

Installation is genuinely easy. Remove the two screws holding your interior thumb turn plate — leave the deadbolt and the exterior cylinder alone — fit the mounting plate, choose the adapter that grips your tailpiece from the set in the box, twist the lock body on until it clicks, fit the batteries, then run the in-app calibration so the motor learns the locked and unlocked positions. Stick the DoorSense sensor where the app tells you. August documents the whole job at ten to fifteen minutes with a single Phillips screwdriver, and owner reports broadly agree. Manufacturer Community

Day to day, auto-unlock handles most arrivals. When it doesn't, the app unlocks in about two seconds over Bluetooth and a few more remotely. Voice commands work and add a second. The activity log is the quietly useful feature — you can see exactly when the door was locked, unlocked, and by whom, which is worth more to most households than the remote access is.

It works with Apple HomeKit, Amazon Alexa, Google Assistant and Samsung SmartThings. Manufacturer There is no built-in keypad — PIN entry means buying the separate keypad accessory, which is an easy thing to miss when comparing prices against locks that include one.

The August is a convenience product that people mistake for a security product. Once you accept that, the decision gets easy.

If you want to stop carrying a key, hand out access from your phone, and know when your door opened and who opened it — this does all of that better than anything else that mounts over hardware you already own. It is the best retrofit smart lock on the market and it deserves that position.

If you're buying it because you think it makes your home harder to break into, it doesn't. The lock underneath is what stops a burglar. The August is what stops you from forgetting to engage it — and that isn't nothing, because a deadbolt that's always locked beats a better one standing open. Just be honest with yourself about which problem you're solving.

And spend twenty minutes on the thing that actually matters before you spend $200 on this: a reinforced strike plate and three-inch screws. Automating a deadbolt anchored in pine trim is automating the wrong component.