Best Smart Locks (2026)

Here is the thing almost every other article gets wrong about this lock. Schlage's own specification sheet for the BE499 lists two certifications: ANSI/BHMA A156.36 Commercial Grade 1, and ANSI/BHMA A156.40 Residential Grade AAA. Those are different standards measuring different things, and the Encode Plus holds both. Calling it "Grade 1, the highest residential rating" — as roughly half the internet does — collapses two facts into one wrong one. Grade 1 is the commercial scale. AAA is the residential top mark. This lock has cleared both bars, which is genuinely rare and considerably more impressive than the sloppy version.

What that buys you in practice: a bolt tested to 250,000 cycles, ten impact blows at 75 foot-pounds with the lock still working afterwards, and a 20-minute fire door listing. The tamper alarm is a real one — it responds to the door being struck or the lock being worked at, not just to a wrong code. Apple Home Key is the standout convenience feature, and it is the only reliability number on this page we have from someone who ran the locks side by side: a reviewer who lived with the Encode Plus, the Yale Assure 2 Plus and the Level Lock+ for several months reported the Schlage opening on the first tap upwards of 99% of the time, with Yale close behind. That is one person's experience over months, not a laboratory measurement, and we are labelling it as such.

One figure you will find circulating about this lock: that its anti-drill pins resisted high-speed steel bits for over four minutes. We do not repeat it. It traces to a site claiming its own 2026 laboratory results in an article published in December 2025, whose companion "kick test" finding is simply the published ANSI Grade 1 specification restated as though it were a measurement. Treat any drill time quoted for a consumer deadbolt the same way — almost nobody actually runs that test. If you want the cylinder story rather than the marketing, our Schlage B60N review covers what a Schlage cylinder resists; the Encode Plus uses the same family.

The modular design is the whole argument. Every other lock here bakes its radio into the body, so switching ecosystems means buying a new lock. The Assure 2 takes a module the size of a stick of gum. Move from Google to Apple, or bring an old Z-Wave hub into the picture, and you swap a part rather than a product.

The key-free version is the one worth thinking hardest about, and it is the most interesting lock on this page from a picking standpoint. There is no keyway. Not a hardened one, not a high-security one — none. Every technique in the lock picking repertoire needs somewhere to put a tension wrench, and this door does not have one. It is also, obviously, the lock that leaves you standing outside in the rain if the electronics fail, which is why the 9V emergency terminals under the keypad are not a gimmick. Yale's own manual documents holding a 9V battery against the two contacts below the keypad to wake the lock long enough to type your code. We checked, because a claim like that is exactly the sort of thing that gets attached to the wrong lock — it holds up.

Two cautions. First, battery life: Yale rates the lock at up to twelve months, and owner reports routinely land at three to six, particularly on Z-Wave with a thin mesh. Take the rating as a ceiling, not a forecast. Second, ownership, which nobody mentions and which affects who honours your warranty: Yale in the United States and Canada is a Fortune Brands product, not an ASSA ABLOY one. That has been true since June 2023 and articles published this year still get it wrong. The ownership section explains how that happened. Our full Yale Assure Lock 2 review goes deeper, and August vs Yale covers the sibling rivalry.

Retrofit locks do not have grades. They cannot. A grade is awarded to a bolt, a cylinder and a housing tested as an assembly, and the August is none of those — it is a motor that turns the thumbturn you already own. Any article that assigns this lock a Grade 2 has made something up. What you are actually buying is a remote control for your landlord's deadbolt, and if that deadbolt is the fifteen-dollar builder special, you have bought a smartphone interface for a weak lock. Pair it with something like a Schlage B60N and the combination is genuinely strong. That is not a caveat, it is the entire calculation.

The security history here is worth knowing and, unusually, ends well. At DEF CON 24 in 2016, a researcher working under the name Jmaxxz presented Backdooring the Frontdoor — a teardown of August's system that bypassed certificate pinning, mapped the whole API, escalated a guest account to owner, and found credentials sitting in debug logs. It was a bad day. August shipped fixes in roughly ten days, which by the standards of this industry is close to heroic; you will read further down what "we'll get to it" looks like at other companies. Our full August review covers the current state.

The awkward part is the brand's future. This is the last August-branded lock in production. Its successor is sold as the Yale Approach, from the same owner, doing the same job. The hardware you buy today keeps working, but do not expect a fifth generation.

Start with the good news, because there is a lot of it. At the price this lock now sells for, the feature list is absurd: fingerprint, keypad, key, app, geofenced auto-unlock and a shake-to-open gesture, plus a proper door sensor that tells you the door is shut rather than merely that the bolt has moved. The anti-peep keypad is a real security feature rather than a marketing one — you can bury your actual code inside a longer string of nonsense digits, so a neighbour watching you type learns nothing. For a side door or a garage entry it is difficult to argue with.

Now the part that belongs on a lock site. Ultraloq's marketing says the U-Bolt Pro is ANSI/BHMA A156.36 Commercial Grade 1. On Amazon it is described as "Certified Highest Security and Durability." On Walmart the product title says "ANSI Grade 1 Certified." On Ultraloq's own product page, the same lock is described as one that "Meets ANSI A156.36 Grade 1 Standard."

Those are not the same claim. "Meets" means the manufacturer believes its product would pass. "Certified" means an accredited third-party laboratory tested it and BHMA listed it. PCWorld put this directly to BHMA, whose spokesperson said that "meets standards" language is considered misleading and that they write to companies asking them to actually certify the product, adding that misuse of BHMA certification logos on uncertified hardware is commonplace. PCWorld's own conclusion on this specific lock was that it meets Grade 1 standards according to the manufacturer but is not certified as such.

We are not calling the lock weak. We have not tested it, and it may well be every bit as tough as claimed. What we are saying is that on the one specification that is supposed to be independently verifiable, you are being asked to take the manufacturer's word for it — and two different sentences on two different retail pages for the same product cannot both be right. We show you how to check this yourself further down. It takes about ninety seconds and it works on every lock on this page.

SmartKey deserves a straight explanation, because it is genuinely clever and genuinely compromised, and most reviews pick one of those and stop. It is not a pin tumbler cylinder. It uses five wafers and a side-locking bar, covered by patents US 6,978,647 and 7,225,651. Because there are no driver pins, there is nothing for a bump key to bounce — the whole attack is structurally impossible. Raking does nothing either. On the two most common ways an amateur opens a cheap deadbolt, SmartKey simply wins.

The trade-offs are real and specific. At DEF CON in 2013, Tobias and Bluzmanis demonstrated a torque bypass: a four-inch screwdriver and a wrench, roughly fifteen seconds, at around 100 pound-inches of force against a 300 pound-inch standard. There is also a documented decoding attack, and a LockTech SmartKey Decoder sold to the locksmith trade that reads wafer positions non-destructively on every generation of the cylinder. And the key space is smaller than it looks: 7,776 combinations in theory, but with half-cuts accepted at every position the practical figure is closer to 243. One more thing worth knowing before you force a stuck cylinder: a SmartKey turned over by force will keep working with its original key but will never accept a re-key again.

None of that makes this a bad lock for a suburban front door, where the realistic threat is a boot rather than a bypass tool. It does mean "SmartKey is more secure" is not a sentence anyone should write without qualification. Our Schlage vs Kwikset comparison takes the cylinder argument apart properly.

As an object this is the best-made thing on the page. Level was founded in 2016 by ex-Apple engineers, and it shows: the motor, gearbox, battery and radio all fit inside the deadbolt itself, so the exterior is a plain metal cylinder and the interior is a plain thumbturn. Nobody looking at your door can tell it is smart, which means nobody can case the electronics either. It is certified AAA — best available in all three residential categories.

Then the corporate part, which is now unavoidable. ASSA ABLOY acquired Level in September 2024 — a company with about seventy staff and roughly $16 million in 2023 sales. In late June 2026 The Verge reported that ASSA ABLOY had laid off the majority of Level Home's workforce, including co-founders John Martin and Ken Goto and most of the engineering organisation, retaining a small group to finish a product aimed at apartment buildings. ASSA ABLOY disputed that the brand is being discontinued, said Level continues to operate as a business within the group, said it would keep developing, selling and supporting the platform, and clarified afterwards that Level is not being folded into Kwikset.

Here is the practical translation, and it is more reassuring than the headline. Locking and unlocking through Apple Home or Matter is processed locally on your network — that keeps working regardless of what happens in Redwood City. The Level app, auto-unlock and door status updates run through Level's cloud infrastructure. ASSA ABLOY has announced no plans to switch those off. But if you are spending real money on a lock, you are entitled to know that the convenience half of it depends on servers belonging to a business that just lost its founders, inside a group whose North American residential sales are falling.

One historical footnote we cannot resist. ASSA ABLOY was compelled by the Department of Justice in 2023 to sell its United States residential smart lock business. Fifteen months later it bought a United States residential smart lock business. Twenty-one months after that, it cut most of the staff.

Nothing here is subtle. It is a competent fingerprint deadbolt that costs meaningfully less than the Ultraloq and Kwikset while doing most of the same things, and the IP65 rating is not decoration — if your door faces weather rather than sitting behind a storm porch, sealing is one of the few specifications that reliably predicts whether a lock is still working in year four.

The asterisk is about Anker, and it needs stating carefully because it is exactly the kind of claim this site is supposed to get right. The eufy privacy scandal was about cameras, not locks. The S230 has no camera and none of what follows happened to it. But it tells you something about how the company behaves when its marketing and its engineering disagree.

In late 2022 the UK security researcher Paul Moore demonstrated that eufy devices sold under the slogan "No Clouds or Costs" were uploading name-tagged thumbnail images, including facial recognition results, to Amazon Web Services servers — while the user had cloud storage switched off and local storage selected. The Verge reproduced it and went further, streaming footage from a eufy camera from the other side of the country with no encryption at all. Anker first denied parts of it, then conceded that identifiable images were uploaded for notification purposes, then admitted in a forum post that it "must be more clear" about which processes were local, and finally acknowledged in early 2023 that the cameras had never been end-to-end encrypted.

If you buy this lock, you are buying good hardware from a company that was caught advertising a privacy property it did not have and took months to say so plainly. For a lock — which transmits far less about you than a camera does — that may be a trade you are comfortable making. Make it deliberately.

Matter over Thread is worth understanding properly, because it is the one specification on this page that will still matter in 2031. Matter is the interoperability standard Apple, Google, Amazon and Samsung all signed up to. Thread is the low-power mesh radio it runs over. Between them they mean a device that does not need a manufacturer's cloud, does not need a manufacturer's hub, and does not become a paperweight when a company reorganises — which, as the Level entry above demonstrates, is not a hypothetical concern.

What makes the U200 more interesting than its flashier successor is that it is native everywhere. The newer U400 needs an Aqara hub to reach Google Home and Alexa; the U200 does not. If your household is mixed — an iPhone, an Android, an Echo in the kitchen — the older lock is the better citizen. Both still need a Thread border router somewhere in the house for remote access, which in practice means a recent Apple TV, a HomePod, a Nest Hub or an Echo with Thread onboard.

The retrofit caveat from the August entry applies here in full. This is a motor on your existing bolt. Its certification describes the retrofit assembly, not the deadbolt underneath, and the deadbolt underneath is what somebody actually has to defeat.

The original Lock Bolt earned its place here for what it deliberately left out. Bluetooth only, thirty-foot range, no internet connection of any kind, and no keyway — which meant it could not be picked, could not be bumped, and could not be attacked remotely because there was nothing to attack. It was not secure because of clever cryptography. It was secure because it refused to participate.

The Lock Bolt v2 is a different lock wearing the same name. It has built-in Wi-Fi. It ships with physical keys. It runs on eight AA cells instead of four, is rated IP53 rather than IPX5, is certified BHMA Grade 2, adds a USB-C jump port, holds fifty codes, and adds an AI fingerprint reader that adapts to your finger over time. Every one of those is a defensible improvement. Together they demolish the exact argument that got the original onto this list. If you came here for "the lock that cannot be hacked because it is not online," you want the original, and you want to check the box carefully, because both are on sale.

Now the part that applies to both. Wyze's security history is the weakest here, and we are not going to soften it. Bitdefender disclosed a set of flaws in March 2019 that were not fully patched until January 2022 — nearly three years. The Cam v1 could not be fixed at all and was retired in February 2022. Then in February 2024, roughly 13,000 Wyze users were shown thumbnails and feeds from strangers' cameras after a caching library mismapped device and user identifiers, following a similar incident the previous September.

Again, those were cameras. A deadbolt is a far simpler device with far less to leak, and the v2's decision to keep fingerprint templates on the lock rather than in the cloud is the right one. But when a company's pattern is slow patching and repeated identifier mix-ups, the version of its lock that is not connected to the internet starts looking less like a compromise and more like the point. Our full Wyze Lock Bolt review has the detail.

The PIN Genie keypad is the feature worth the money, and it solves a problem the rest of this industry pretends does not exist. Every fixed keypad eventually tells on you. Four buttons wear smooth, or hold fingerprints, or catch a low sun at the wrong angle, and now an attacker has four digits and at most twenty-four combinations to try. Lockly's keypad rearranges which digits sit where between uses. Watching someone type teaches you the shape of their hand movement and nothing else, because next time the 7 will be somewhere different. It is the only genuinely novel piece of physical security engineering on this page.

The face recognition is the headline and the part to be coolest about. Lockly states the system builds a three-dimensional model and checks for liveness so a photograph will not open the door. That is the manufacturer's description; we have not tested it, and neither, as far as we can find, has any independent laboratory. Treat it as a convenience feature that happens to be well designed rather than as a security guarantee — and note the general principle that every additional unlock method is another door into the same house.

Schlage calls the system Converge. It pairs UWB with the home key in your Apple Wallet and calculates your speed, trajectory and motion to work out whether you actually intend to come in, holding off until you reach the door rather than firing the moment you enter the driveway. When it works it is the closest thing to magic on this page.

The trouble is the "when." One publication ran it for over two months and came away impressed. Another tested it across multiple configurations — Apple Home and Matter both — and reported that it could not get hands-free unlocking to behave consistently, while tapping with an iPhone or Apple Watch worked every single time and the PIN pad worked flawlessly. Those two accounts are not necessarily in conflict; door geometry, hub placement and phone model all plausibly matter. But if the headline feature is the reason you are spending $399, you should know that at least one careful reviewer could not make the headline feature work.

And then the grade. This is Schlage's flagship. It costs roughly $150 more than the Encode Plus. It is certified ANSI Grade 2, where the Encode Plus holds commercial Grade 1 and residential AAA. That is not a scandal — Grade 2 is a perfectly sound residential deadbolt, and the Sense Pro has no keyway to attack, which is its own kind of security. It is simply worth saying out loud, because nobody buying a flagship expects to be trading down on the one number that describes how the thing survives a shoulder.

Aqara got here first, and by a comfortable margin — on sale in January, six months before Schlage, at two-thirds the price. It does the same trick: walk up with an iPhone or Apple Watch carrying a home key and the bolt withdraws as you arrive. It also keeps a fingerprint reader, a keypad, a near-field communication (NFC) card option and, unlike the Sense Pro, a physical key.

The gotcha is the one nobody puts on the box, and it has already caught buyers. Hands-free unlocking needs a UWB-capable Apple home hub in the house. A HomePod mini or a current Apple TV 4K will do it. An older Apple TV HD will not — you can install the lock, set everything up correctly, and simply never see the feature work, with nothing in the app to tell you why. Check what is under your television before you buy.

The other trade is platform reach. The U200 talks natively to Apple, Google, Alexa, SmartThings, Home Assistant and IFTTT with no hub at all. The newer, more expensive U400 requires an Aqara hub to reach Google Home and Alexa. If you are deep in Apple, take the U400. If your house is mixed, the older lock is quietly the better buy — which is not a sentence you often get to write about a product generation.