FlipStay blog · 30 October 2026

PIN Codes vs Phone Keys: A Safe Check-In Backup

Phone wallet keys not ready at opening? Door PIN codes can work as a safe backup. Here is how to set them up, limit risk and switch over later.

Your opening date is fixed, but the phone wallet key system is not ready, and you need guests to get into their rooms. Should you use door PIN codes in the meantime?

The short answer: yes, if you follow four rules

PIN codes are a reasonable backup for phone keys. Many guests prefer a code to a plastic card or an app, and a code works on any phone, including an old one with no wallet.

The risk is not the PIN itself. The risk is sloppy handling. A code that is reused, shared or never deleted is a key you have lost track of. Follow these four rules and a PIN system is safe enough for a small property:

1. One code per room per stay. Never give the same code to two guests in a row.
2. Codes expire. Set the start at check-in time and the end at checkout time, if your lock allows it. If it does not, you must delete the code by hand every day.
3. Random, six digits or more. Avoid 1234, the room number, the year or the property's phone number.
4. Keep a way in that does not depend on the code. That could be a master card, a mechanical override key held by the manager, or both. Dead batteries and forgotten codes will happen.

Check first that your locks support this. Some locks only have one permanent code. If so, a PIN is not a safe backup, because you cannot make it unique per guest. Use cards or mechanical keys until your lock supplier confirms time-limited codes.

How to run PIN check-in, step by step

Decide before opening who does what, and write it down.

Step 1: Collect guest details before you issue a code. A PIN does not replace guest registration. Take the guest's name, phone number and ID details, as you would at a desk. If your local rules require you to see ID in person, a PIN-only arrival may not be allowed. Check this with the local authority before you rely on remote check-in.

Step 2: Assign a room and create the code. Pick a free room, create a code in your lock software for the exact dates, and note the code against the room.

Step 3: Send the code close to arrival. Send it from your own phone, shortly before the guest arrives, with the room number and the entrance instructions. Do not send codes weeks ahead. A code sent early is a code that can be forwarded or lost in a message thread.

Step 4: Confirm the guest got in. Ask the guest to message you once they are inside. If they have not, you find out in minutes, not at midnight.

Step 5: Remove the code at checkout. Delete or let it expire, then mark the room as needing cleaning. Do not skip this even on a busy morning.

Your property system sits beside the locks, not inside them. In FlipStay (https://flipstay.app), for example, staff fill one check-in form with the guest's name, phone and ID, and the room board shows which rooms are occupied or need cleaning. FlipStay does not connect to door locks, so the code itself lives in your lock system. Use the board as the check that every occupied room has a live code and every free room does not.

A worked example: a 12-room guesthouse

Say you run 12 rooms and open with PIN codes only. Tomorrow you expect 9 arrivals and 7 departures.

• Morning: you delete or confirm expiry of 7 checkout codes. At about one minute each, that is 7 minutes.
• Afternoon: you create 9 new codes. At about three minutes each, including sending the message, that is 27 minutes.
• Daily total: about 34 minutes of staff time.

Now count the exposure if you skip the deletions for a week. With 7 departures a day, you would have roughly 49 old codes that still open a door, and some of those rooms will be occupied by new guests. Even one stale code on a room is a problem. Those 7 minutes each morning are cheap insurance.

To cut the risk further, assign a rule: the person who marks a room "needs cleaning" also confirms its code is gone. One person, one task, no assumptions.

Moving to phone keys later without a mess

Phone wallet keys are convenient, but they depend on the guest's phone, the app or wallet version, and often on a working internet connection at the property. PINs make a good permanent fallback even after phone keys go live.

When phone keys are ready:

• Test with staff first. Have your team use phone keys for a week on their own rooms or test rooms.
• Switch new bookings, not current guests. Do not change a guest's method mid-stay.
• Offer both. Tell guests the PIN is available if the phone key fails. Guests with older phones, dead batteries or no data will use it.
• Keep the same deletion routine. Phone keys expire on their own, but you should still check that no active key remains for a checked-out guest.

The rule is simple: phone keys become the default, and PINs stay as the backup you already know how to run.

What to do this week

1. Ask your lock supplier two questions in writing: can each code have a start and end date, and how many codes can a lock hold at once? If the answer to the first is no, plan for cards or mechanical keys instead.
2. Write a one-page PIN procedure: who creates codes, who sends them, who deletes them, and what to do when a guest is locked out. Put it where all staff can see it.
3. Run a trial with three rooms: create codes, check in a test guest, check them out, and confirm the old code no longer works. Fix any gaps before opening day.

Frequently asked questions

Are PIN codes less secure than phone keys?

Not necessarily. A random, single-use, time-limited code is secure enough for most small properties. Security fails when codes are reused, shared or never deleted.

What if my lock only supports one permanent code per door?

Then a PIN is not a safe backup, because you cannot make it unique to each guest. Use cards or mechanical keys until you can upgrade or change the lock settings.

Do PIN codes replace ID checks at check-in?

No. Guest registration rules still apply. If your local rules require you to see ID in person, check with the local authority before using remote PIN-only check-in.

← All articles