A smart lock is only as good as the credential it accepts, and the four common ones — fingerprint, passcode, card, app — behave very differently once people actually start using the door. Speed at the reader, the cost of issuing credentials in volume, and the way access gets pulled back when someone leaves all change with the credential type. Before comparing them, the definitions: a fingerprint is a biometric whose encrypted template lives on the lock; a passcode is a short numeric code typed on a keypad; a card is an RFID credential (Mifare, EM, NFC) read wirelessly; and an app is a phone running the vendor's software, talking to the lock over BLE or Wi-Fi. The useful question is what trade-offs each one makes, and how the best sites combine several types on the same door.
Security
Security is where the four diverge most. A fingerprint is the hardest to share casually — you cannot lend your finger to a friend the way you hand over a code or a card — and on a well-built lock the template is encrypted and matched on-device, so the print never leaves the lock. A passcode is only as secret as the person holding it: four digits can be brute-forced, which is why six digits plus a lockout after a few wrong attempts is the practical floor, and codes still get shoulder-surfed, stuck to the fridge with a magnet, or texted to a relative. A card is a bearer token — whoever holds it enters — and the security ceiling depends almost entirely on the card's encryption. A plain 125 kHz EM card clones with cheap hardware, while Mifare Classic or DESFire, or the lock's own rolling-code scheme, shrugs that attack off. The app sits in the middle. It authenticates against the cloud and the lock issues a fresh cryptographic challenge on every unlock, so a screenshot of a key is worthless — but the phone itself becomes the asset worth protecting, and a lost, unlocked phone is a genuine risk.
Convenience and speed
- Fingerprint is fastest at the door — a fraction of a second — and effectively hands-free once enrolled.
- Passcode is moderate. Typing six digits in the rain is slower and less pleasant than it sounds, though there is nothing to carry.
- Card is fast and familiar (tap and go), as long as you have it on you and have not lost it.
- App is convenient when the phone is already in your hand, less so when you have to dig it out, unlock it, open the app and wait for the BLE handshake. Fine for a resident who uses it daily; friction for an occasional visitor.
Cost and enrollment
A fingerprint costs nothing in consumables, but enrollment means each user has to be physically at the lock — or at a manager app — to capture the print, which is one-time friction per person. A passcode is the cheapest of all: created in software in seconds and pushed to the lock, with no hardware in the loop. A card means buying, encoding and distributing physical tokens (encoding is done with a card encoder), and because cards get lost you always buy spares — the per-credential cost is low but it never quite hits zero. An app has no physical cost either, but every user has to install it, create an account and be paired by an admin, which is usually overkill for a hotel guest staying two nights.
Revocation
How cleanly can access be taken back? A fingerprint is instant for the admin — delete the template, and the user has nothing to return and nothing to keep. A passcode is instant in software; the old code dies on the next sync. A card can be deactivated by its ID in the system, but the plastic may still be sitting in the user's pocket, so high-security sites rely on deactivation rather than recovery. An app revocation is instant in the cloud — the phone is simply uninvited — which is why distributed teams and rentals lean on it.
The four at a glance
| Criterion | Fingerprint | Passcode | Card | App |
|---|---|---|---|---|
| Security | High (hard to share) | Medium (shareable) | Low–High (card crypto dependent) | Medium–High |
| Speed at door | Fastest | Medium | Fast | Medium |
| Consumable cost | None | None | Cards + spares | None |
| Enrollment | Per-user physical capture | Seconds in software | Buy + encode + distribute | Install + pair |
| Revocation | Instant, nothing to return | Instant in software | Instant in system; card may be kept | Instant in cloud |
| Strongest role | Residents, regulars | Guests, short-term | Staff, high turnover | Owners, distributed teams |
Combining credentials in practice
Single-credential sites are rare, and for good reason — each type leaves a gap. The strongest deployments mix by role. Residents and daily users get a fingerprint, because the friction is lowest for someone who uses the door every day and they can neither forget it nor lose it. Guests and short-term visitors get a time-limited passcode, generated for the length of the stay, shared by message and left to expire on its own — no app to install, no card to collect back, with a keypad as the natural hardware. Staff, cleaners and contractors get a card or the app: a card is cheap, durable and easy to hand out in volume, while the app gives distributed teams instant revocation and an audit trail of exactly who opened the door and when. The owner or admin carries the app for remote management, with a fingerprint as the fallback for the day the phone is dead.
This layering is why a capable smart lock supports several credentials at once on the same door. For how the lock arbitrates between them internally, how smart locks work is the relevant read. No single credential wins on every axis. The friction and tamper-resistance of a fingerprint suit a resident who uses the door daily. A passcode costs nothing to issue and expires on its own, which is what a short-term guest needs. Cards make sense for staff because they are cheap to roll out in volume. And the remote revocation and audit trail of an app suit a distributed team that cannot simply walk up to the door. The practical answer is usually a combination, matched to who is standing there.