To share a door code with guests safely, give each guest their own code if your lock allows it. Send it in a one-time link that expires after it is read or after a set time, and send any passcode through a different channel. Change the code after checkout so old messages can't open your door.
Key takeaways
- The real risk is the code sitting in old texts, emails and booking threads long after the guest has left.
- A one-time note with both a view limit and a time limit keeps the code out of permanent message history.
- Send the link and the passcode through different channels, such as SMS for the link and the booking platform for the passcode.
- Give cleaners and contractors their own codes so you can delete one person's access without changing everyone's.
- Rotate the code between guests. A self-destructing note removes the message, not the code itself.
Why old messages are the real risk with door codes
A door code isn't like an online password with two-factor login behind it. Anyone who has the digits can walk in, and the lock has no idea who they are.
The weak point is rarely the moment you send it. It's the months afterwards. The code sits in your SMS thread, the guest's WhatsApp, an email inbox, a booking platform conversation and maybe a screenshot in someone's camera roll.
Phones get lost, accounts get shared, and a former guest who scrolls back can still find "Lockbox: 4471" long after checkout. If you never changed the code, that message still opens your door. We cover the wider version of this problem in what goes wrong when secrets sit in chat history forever.
So the goal has two parts. Keep the code out of permanent message history, and make sure any copy that does survive is useless because the code has changed.
What's the safest way to share a door code with guests?
The best option depends on your lock. If you have a smart lock that can issue a separate code per guest, with a start and end date, use that. A code that switches itself off at checkout beats any messaging trick.
If you have a keypad or lockbox with one shared code, the next best thing is to send it in a way that doesn't leave a permanent copy, then change it between stays.
| Method | Stays in history? | Who could find it later | Best for |
|---|---|---|---|
| Booking platform message | Yes, in both inboxes | Anyone with access to either account | Directions, house rules, non-sensitive details |
| SMS or iMessage | Yes, on both phones and often in backups | Anyone who picks up an unlocked phone or reads a backup | A heads-up that the code is coming |
| Yes, in both mailboxes | Anyone who gets into either inbox, plus forwarded copies | Check-in guides without codes in them | |
| Yes, unless disappearing messages are on for that chat | Chat participants and anyone holding their phone | Quick chat with guests you already message there | |
| One-time note link | No. The link stops working after it is read or expires | Only whoever opens it before it is destroyed | Lockbox, keypad, gate and alarm codes |
| Per-guest smart lock code | The code itself stops working at checkout | Nobody can use it after the stay | Hosts with compatible locks |
A one-time note doesn't stop the guest from writing the code down. Nothing does. What it removes is the long tail: the copy sitting in a thread for years. The same logic applies to a lower-stakes secret in our guide to sharing the WiFi password with guests.
How to send a lockbox code securely, step by step
Here's how to send a lockbox, keypad or gate code with SecureNotes. It's free, and neither you nor the guest needs an account.
- Write the note. Go to SecureNotes and create a self-destructing note. Paste the code plus only what the guest needs to use it, for example: "Lockbox to the left of the porch. Code 4471. Set the dials, then press down." If you've already sent the address elsewhere, leave it out.
- Choose when it self-destructs. Pick a view limit (1, 3, 5 or 10 views), a time limit (1 hour, 24 hours, 7 days or 30 days), or both. With both set, the note is destroyed at whichever comes first.
- Add a passcode (optional). A passcode means someone who stumbles on the link still can't open it. Use a random word, and never make it the door code itself.
- Send the link. Paste it into your usual message to the guest, or let SecureNotes email it to them. Turn on the read notification if you want an email when it's opened.
- Send the passcode another way. If the link went by text, send the passcode through the booking platform, or the other way round. Our guide to passcode-protected notes and how to send the passcode safely covers good choices.
- Change the code after checkout. The note disappears, but the lock doesn't know that. Rotate the code before the next guest arrives.
Each note is encrypted with AES-256 using its own random key before it's stored. Once the view or time limit is reached, the link stops working.
Which expiry settings fit door codes?
Most people only think about the view limit. In SecureNotes data, 70% of notes are set to self-destruct after a single view, but only 36% are given a time limit.
For door codes, the time limit matters. A view limit protects you once the guest reads the note. A time limit protects you if they never do, for example when a booking is cancelled or the message goes to the wrong number. Set both.
- Single guest arriving within a day: 1 view, 24 hours.
- Booking a few days out: 1 view, 7 days.
- A group where several people need the code: send one note to each person, or use 3 or 5 views with 7 days if that isn't practical.
Worked example: an Airbnb door code for a weekend guest
Maria rents out a cabin with a keypad on the front door. Tom has booked Friday to Sunday and will arrive around 4 pm. The previous guest left on Wednesday morning, so Maria changes the keypad code to 829315 that afternoon.
On Wednesday evening she creates a note: "Front door keypad: 829315, then the tick key. Spare key in the kitchen drawer if the batteries die. Please don't share this code." She sets it to 1 view and 7 days, so an unread link won't outlive the stay.
She adds the passcode "bluefinch" and sends it through the Airbnb message thread. The link itself goes by SMS to the phone number on the booking. She turns on the read notification.
On Thursday at lunchtime she gets an email saying the note has been read. Tom opened the link, entered the passcode, read the code and saved it in his phone. If anyone opens the link again, it no longer works, and the Airbnb thread holds only a random word that means nothing on its own.
On Sunday after checkout, Maria changes the keypad code again before the next booking. Even if Tom loses his phone next month, the code saved on it opens nothing.
How to share an alarm code with a cleaner or contractor
Long-term access is different from a weekend guest. Your cleaner may need the alarm code every week for years. A contractor might need the gate code for a fortnight.
Give each person their own code
Most alarm panels and many keypad locks support several user codes. Give your cleaner one that's theirs alone. When they stop working for you, you delete that one code instead of changing it for everyone, and on systems that keep a log you can see whose code was used.
Send it once, then let the note go
Send the alarm code in a one-time note with a 1 view limit and a 24-hour or 7-day expiry. Your cleaner memorises it or stores it somewhere they trust. Don't text it, and don't write it on a sticky note left by the panel.
Plan the offboarding now
Keep a short list of every code a contractor received: gate, lockbox, alarm, garage keypad. When the job ends, change or delete each one the same day.
If someone needs ongoing access that changes often, a one-time link isn't the right long-term tool. A smart lock app that gives them their own scheduled access, or simply a code that's theirs, is a better fit.
How often should you change the door code between guests?
After every guest, if your lock makes it practical. Resetting a lockbox takes about a minute, and most keypads take only a few more. Your cleaner keeps their own separate code, so rotating the guest code doesn't lock them out.
If rotating after every stay isn't realistic, change it at least:
- after any guest you had problems with;
- when a cleaner, contractor or property manager stops working for you;
- when you spot the code in a review, a photo or a shared document;
- on a fixed schedule, such as monthly.
Avoid codes tied to you, such as birthdays, your street number or the last digits of your phone. Avoid patterns like 1234 or 2580, which is a straight line down most keypads. Worn buttons can also hint at the digits, so rotating helps there too.
Common mistakes that still leave your door open
- Putting the code in the listing, house manual or auto-reply template. Templates get pasted into every booking thread, and printed manuals get photographed.
- Sending the passcode in the same thread as the link. Anyone who reads that one thread gets both halves.
- Falling back to plain text when the link fails. If a guest says the link has already stopped working, ask whether anyone else opened it. If you can't account for the view, change the code and send a fresh note.
- Forgetting about screenshots. A guest can screenshot the note. Self-destruction removes the link, not copies they made. Rotation is the fix.
- Bundling the code with the address and dates. One email with all three is a key with a label on it. Send the code on its own.
- Treating the read notification as proof of identity. It tells you the note was opened, not who opened it. That's what the separate passcode is for.
- Never changing the owner or master code. If that code has ever been shared, even once with a relative or handyman, rotate it too.
Frequently asked questions
When should I send the door code to a guest?
Send it a day or two before arrival, once the booking is confirmed and paid. Sending it weeks ahead means it sits in more places for longer and is exposed if the booking is cancelled. If you use a one-time note, pick a time limit that covers the gap until check-in, such as 24 hours or 7 days, so an unread link doesn't linger.
Is it safe to text a lockbox code?
It works, but the code stays on both phones and often in cloud backups indefinitely. If you text it, change the code after the guest leaves so the old message is useless. A safer option is texting a one-time link to the code and sending a passcode through another channel, so the SMS thread never contains the code itself.
What if a guest shares the door code with someone else?
You can't stop someone from passing on a code they know, so the fix is on your side. Change the code at checkout, ask guests in the note not to share it, and use per-guest codes on a smart lock if you have one. If you suspect it was shared during a stay, change it as soon as the guest leaves.
Are smart locks safer than lockboxes for rentals?
For short-term rentals they usually are, because many smart locks can issue a separate code for each guest that only works between check-in and checkout. That removes the need to remember to rotate. A lockbox is cheaper and has no batteries or app to fail, but you must change its code manually between guests.
I sent the door code to the wrong number. What should I do?
Change the code straight away, before the correct guest arrives if possible. Then send the new code to the right person. Deleting the message on your phone won't remove it from the recipient's device. This is one reason to send codes as expiring links with a passcode, so a misdirected link is far less useful to a stranger.
Can I send door codes automatically for each booking?
Yes, if you're comfortable with scripting. SecureNotes has a free public REST API for creating notes from scripts and tools, so you could generate a one-time link containing each guest's code and drop it into your own check-in message. Keep the code itself out of the message template, and still rotate codes between stays.
