Airbnb door code rotation: the schedule I run and the security mistake I kept making for 18 months

The same code for 14 months

My first smart lock — a Nuki on the Broughton Street flat — ran on the same door code from installation in early 2023 until I finally changed it in March 2024. Fourteen months. About 180 guest stays. Same four digits, every single time.

Nothing terrible happened. No one broke in, no one turned up unexpectedly, no one shared the code in a way I ever noticed. But that's not really the point. The point is I had no idea whether a hundred and eighty people's worth of guests still had the code to my flat. Some had screenshots. Some had shared it with partners or friends. One had probably written it on a piece of paper that's still in a jacket pocket somewhere. I didn't know, and I had no way to find out.

That's what I mean when I say my first rotation rule was wrong. The rule was: change it "occasionally." Which meant: never.

Why code rotation matters more than it seems

The security argument is obvious: an old guest with the current code can return. But there's a subtler operational problem I hadn't considered. Guests sometimes share codes with family members, or with their cleaner (if you're doing a mid-stay clean and they're not there to let the cleaner in), or with a friend who's meeting them at the property. That's all fine while they're guests. The issue is what happens if that third party also has the code and you've never changed it.

I found this out when a previous guest's mother turned up at the Broughton Street flat eight months after the original stay. She'd been given the code during the visit, she happened to be passing through Edinburgh, and she let herself in. My current guest was using the bathroom. The mother thought she'd booked — she hadn't, the son had, months ago, for a different trip. Considerable awkwardness followed. Nobody was harmed. Nobody had bad intentions. But that situation happens if and only if you're not rotating codes.

How smart locks handle this

If you're on Nuki or Yale or a similar smart lock that integrates with your booking calendar, you can set access codes that are automatically generated per booking and expire at checkout. This is by far the cleanest solution. Each guest gets a unique time-limited code — active from their check-in time to their checkout time, and then gone. You don't need to think about rotation because there's nothing to rotate.

My Nuki setup generates codes through the app automatically when a booking syncs. The guest gets a message with their specific code and its validity window. Works well. I've had it running for eighteen months and the only issue is occasionally when a booking is modified last-minute and the code generation needs a manual push — but that's rare and the Nuki app is quick to fix.

If you're not on a smart lock with booking integration — either because you've got a key safe or a basic code lock — the rotation schedule is something you need to manage manually.

My current rotation schedule (manual key safes and code locks)

My Lake District barn uses a key safe rather than a smart lock. It's a Masterlock 5440D — sturdy, weather-resistant, four-digit combination. The code changes every four weeks minimum, or after any stay longer than five nights, whichever comes first.

Why four weeks? Partly arbitrary, partly based on the booking pattern for that property. It turns over roughly six to eight times a month in summer, less in winter. After four weeks there have been enough stays that I'm comfortable a rotation is warranted. In practice, I change it slightly more often than the four-week rule because I'm on-site quarterly for maintenance and it's a natural moment to do it.

The process: I update the code, update the listing description (which includes the property address and access instructions but not the code — that goes in the guest message), and send the new code in the pre-arrival message to any upcoming guests. It takes about four minutes. The main risk is forgetting to update the guest message before the new code goes live, which I've done once and noticed fortunately before the guest arrived.

For any property where I'm using a key safe: I keep a record of the last four codes in a notes file. Not for any security reason — just so if something has gone wrong and I need to troubleshoot whether a guest is using an expired code, I can check.

What to do if a guest reports a break-in or access issue

Change the code immediately, obviously. Then report to Airbnb through the resolution centre and, if there's evidence of actual unauthorised entry, to the police. Keep the previous code noted — you may need it for the report.

One thing I've learned: if a guest says the code "didn't work" and they had to call you to reset it, check first whether it was a user error (entering the wrong code, pressing the button sequence incorrectly on a Masterlock) before assuming a technical failure. I've had three "the code doesn't work" messages across five properties in three years, and two of them turned out to be guests pressing the buttons in the wrong order on a fresh key safe that needed a firm press. The third was a genuine lock malfunction — battery fault — which is a separate problem with a different fix.

The guest experience angle

One thing I've never seen mentioned in the security debate: frequent code rotation slightly reduces the chance of a guest arriving with the wrong (old) code from a previous booking. This sounds like a fringe case but it's happened to a host in my local hosting group twice in two years — both times because a guest received a corrected message with a new code after a code change but checked their original booking confirmation instead. Clear messaging about which code is current, and not including the code in the initial booking confirmation (only in the pre-arrival message that goes out 24–48 hours before check-in), solves this.

My pre-arrival message goes out 36 hours before check-in. It includes the current code, valid check-in time, and a specific note that this code is only valid for the duration of their stay. I've had no confusion since adding that last line. Small thing, avoids a bigger problem.

The rotation schedule I'd recommend

Smart lock with booking integration: let the system generate per-booking codes. Don't think about it further. Review the integration settings quarterly to make sure nothing has drifted.

Key safe or basic code lock: change the code every 4–6 weeks minimum, or after any stay longer than a week, or immediately after any stay where you have concerns about a guest. Note the date of each change somewhere simple. Send the new code in the pre-arrival message, not in the initial booking confirmation.

And review this annually. The smart lock landscape changes, key safe technology improves, and what made sense as a setup in 2023 might not be the right call in 2026. I upgraded two properties from key safes to Nuki in the past year and the operational overhead reduction was significant. If you're still on a four-digit code on a key safe and doing six-plus turnovers a week, look at whether a smart lock integration pays for itself in time saved. For me, across five properties, it did — about six months in.