A key lockbox is a small, lockable container that holds a physical key so somebody else can collect it without you being there.
That is the whole idea. You put a key inside, you mount or hang the box somewhere accessible, and you give the code or combination to whoever needs to get in. They open the box, take the key, unlock the door, and put the key back when they leave.
It is a genuinely useful piece of hardware, and for a lot of situations it is the right answer. It also has failure modes that are worth understanding before you rely on one.
How a lockbox actually works
The mechanism is deliberately simple, because simplicity is the point.
The container. A metal or hardened plastic shell with a hinged door or a sliding cover. Inside is a cavity large enough for one or two keys, sometimes a fob or a card.
The lock. Almost always mechanical, using one of the mechanisms below. No power, no network, no app.
The mount. Either a shackle that hangs over a door handle, a railing or a gate, or a wall plate that screws into brick, timber or render.
The credential. A number you tell someone. Four digits on most consumer models, sometimes a set of letters or a push-button pattern.
That is the entire system. There is no record of who opened it, no way to change the code remotely, and no way to know whether the key is currently inside without going to look.
The main types
Combination dial lockboxes
Rotating dials, usually four, set to a number sequence. Cheap, widely available, and the most common type on residential doors.
Strengths: No batteries, no electronics, works in any weather in principle, very low cost.
Weaknesses: Dials stiffen with age and cold. Worn dials can develop feedback that makes the combination easier to guess. Changing the code means opening the box and physically resetting it.
Push-button lockboxes
A keypad of push buttons where you press a combination of buttons in any order, then a release lever. Often used by estate agents.
Strengths: Faster to open than a dial, and slightly harder to shoulder-surf.
Weaknesses: The button combination is a set rather than a sequence, so the number of possible codes is smaller than it looks. Buttons wear visibly with use, which can narrow down the code.
Key-operated lockboxes
Opened with a small key rather than a code. Common for utility and meter cabinets.
Strengths: No code to leak.
Weaknesses: You have moved the problem rather than solved it. Now you have to distribute a key to open the box that holds the key.
Electronic and Bluetooth lockboxes
A keypad or phone-paired box with a battery and, in some models, a connection to an app.
Strengths: Codes can often be changed without opening the box, and some models log openings.
Weaknesses: Batteries fail, usually at the least convenient moment. Cold weather shortens battery life sharply. Bluetooth pairing depends on the guest's phone cooperating. And the log, where one exists, tells you the box was opened, not who opened it.
Wall-mounted key safes
A heavier, screwed-in version, often certified to a security standard and sometimes accepted by insurers where a lockbox is not.
Strengths: Considerably harder to remove than a shackle model. Certification can matter for insurance and for care and medical access schemes.
Weaknesses: Permanent installation, so not suitable for rented property without permission, and it still has all the credential problems below.
Where lockboxes work well
Let us be fair to the hardware. There are situations where a lockbox is the correct choice and anything more elaborate is over-engineering.
One property, occasional use. A spare key for a neighbour, a cleaner who comes fortnightly, a dog walker.
Care and medical access. Certified key safes are widely used so that carers and emergency services can reach a vulnerable resident. This is a well-established, well-regulated use case.
Trades access during a project. A builder needing entry for three weeks.
Somewhere with no power or connectivity. A remote cabin, an outbuilding, a site hut.
A backup. Even operations running electronic access often keep a mechanical fallback somewhere sensible.
If your situation is on that list, buy a decent one, mount it properly, and stop reading.
Where lockboxes fail
The failures are not really about the hardware. They are about what happens to a shared code over time.
The code never changes
This is the big one. A lockbox code is set once and then quietly becomes permanent, because changing it means going to the property, opening the box, resetting the mechanism, and telling everyone the new number.
So it does not get changed. The cleaner who left two years ago still knows it. So does the contractor, the previous tenant, the guest who wrote it in a group chat, and whoever they forwarded it to.
There is no record
A lockbox cannot tell you who opened it or when. If something goes missing, or a guest reports that someone was in the property, or an insurer asks who had access, you have nothing to offer but a list of everyone you have ever given the number to.
It advertises the property
A lockbox on a front door is a visible signal that the property is not permanently occupied and that a key is nearby. That is a legitimate security concern and one reason some insurers take a view on them.
Cold weather
Mechanical dials seize. Moisture gets into the mechanism, freezes, and the dials will not turn. In a cold climate the failure mode is a guest standing outside at night unable to get in.
Some cities are now removing them
This is new and worth knowing if you operate short-term rentals in Europe.
Several Italian cities have enforced urban decorum rules against lockboxes fixed to public property. Rome began removing them from railings, gates, drainpipes and façades in January 2025, with fines around €400 per device, and in some cases directed at the building administrator rather than the individual host. Florence acted on similar grounds. Milan introduced its own prohibition on devices on public land from January 2026.
The removals target devices attached to public surfaces and protected façades, not the concept of self check-in. But if your box is bolted to a railing in a European historic centre, it is exposed, and a removal crew does not check whether a guest is currently mid-stay.
It cannot answer the question regulators now ask
Increasingly, the question is not "did the guest get in" but "who exactly got in."
Italy requires guest identification and reporting to the police within 24 hours. Spain requires guest data submission within 24 hours. Amsterdam runs an algorithm cross-referencing listings against population and building registers, and Dutch courts have held that a host's own screenshots are not evidence. New South Wales can ban a host or a guest from the industry for five years for conduct breaches.
A box with a shared four-digit code has no idea who opened it. That is fine for a spare key at your mother's house. It is a genuine gap for a business that may have to prove something.
How to use a lockbox properly
If a lockbox is the right tool for you, these are the things that actually reduce the risk.
- Mount it out of sight of the street, at the side or rear, not on the front door.
- Screw it to a wall rather than hanging it on the handle. Shackle models can be removed with bolt croppers in seconds.
- Check what surface you are attaching it to. Not public property. Not a protected or heritage façade. Not a shared entrance without the building's agreement.
- Change the code on a schedule, and always after a contractor finishes or a member of staff leaves. Diarise it, or it will not happen.
- Never put the code in a listing, a public message or a group chat.
- Do not put anything identifying inside, such as an address tag on the keyring.
- Check your insurance. Some policies have views on key safes and some require a certified model.
- Check the mechanism seasonally, particularly before winter.
- Have a fallback. Know what happens if the box fails at 11pm.
When you have outgrown it
The honest test is not how many properties you have. It is how many people hold your codes.
One property and two trusted people is a lockbox problem. Twelve properties, three cleaning teams, a rotating set of trades and a guest every four nights is a permissions problem, and no amount of discipline with a mechanical box will fix it, because the underlying tool cannot distinguish between people.
The specific signals that you have crossed the line:
- You cannot say confidently who knows your codes
- You have not changed a code in over a year
- Someone has had to drive to a property to deal with a key this month
- You could not produce a record of who entered a property last Tuesday
- You operate somewhere that asks you to identify guests
What replaces it
The alternative is a system where access belongs to a named person for a defined period, rather than to a number that circulates.
That is what Keycafe does. A wall-mounted cabinet holds the physical keys, and each guest, cleaner, contractor or staff member is granted access for a specific window, delivered as a code, a QR, an NFC tap or a wallet pass. The window expires on its own. Every collection and return is recorded against the individual who performed it, with the time, and the log exports.
The important difference is not convenience. It is that the question "who was in the property, and when" has an answer.
Capacity starts at 9 key positions and grows through chained expansion modules, so one installation can serve a cluster of properties or an entire building.
Practically, it also removes the cold-weather problem, because the sensible placement is indoors, and it removes the public-property problem, because the unit goes on a wall you control.
See how it works or talk to our team if you want to work out whether your operation has outgrown a lockbox.
Regulatory details in this article reflect publicly available information at the time of writing and are provided for general guidance only. Rules on where key storage devices may be installed differ by city and have changed repeatedly. Confirm current requirements locally, and check your insurance policy, before installing anything.
