Key control for small landlords: rekeying, codes, fobs, and the move-in access log

The cheapest risk in your rental is probably on someone's key ring

Here is a small-landlord nightmare that does not look dramatic on paper:

The old tenant moved out cleanly. You got two front-door keys back. The new tenant moved in Friday. On Monday they ask, "Did the last tenant have any other keys?"

You do not know.

Not because you are careless. Because keys multiply quietly. A copy went to a dog walker. A mailbox key sat in a junk drawer. A garage remote lived in a glove box. A contractor kept a lockbox code for a week and nobody changed it. A tenant-installed keypad still has an old guest code named "Mom."

Key control is not glamorous property management. It is a simple owner habit: know what opens the property, who has it, when it changed, and what you handed to the next tenant.

For landlords with one to fifty doors, the system does not need to be fancy. It does need to exist.

Start with an access inventory

Before you can control access, list every way someone can get in.

For a single-family rental, that might include:

• Front door key
• Back door key
• Garage entry door key
• Detached garage key
• Garage remote or keypad code
• Mailbox key
• Gate key or gate code
• Shed, storage, basement, or utility-room key
• Alarm code
• Smart-lock app access or keypad code
• Lockbox code used during showings or repairs

For a duplex, condo, or small building, add:

• Building entry fobs
• Common-area keys
• Laundry-room keys or codes
• Parking gate devices
• Amenity cards
• Elevator, stairwell, storage, or trash-room access
• HOA or condo access credentials

Walk the property with this question: "If I had never been here before, what would I need to enter every area the tenant can use and every area I must maintain?"

That list becomes your key-control checklist.

Rekey between unrelated tenancies

For most small landlords, the clean default is to rekey exterior locks between unrelated tenants.

Why? Because you cannot know how many copies exist. Even if every lease says keys cannot be copied, copies happen. Even if the tenant was excellent, their roommate, partner, cleaner, friend, or former roommate may still have one. Rekeying is usually cheaper than explaining to a new tenant that you are "pretty sure" the old keys are all back.

Rekeying does not always mean replacing the whole lock. A locksmith can often change the cylinder or pins so the old key no longer works. Some landlords use rekeyable lock systems that let them reset locks with a control key. Others standardize on a locksmith and keep a record of which keyway belongs to each property.

Do not make this a case-by-case emotional decision:

• "They were good tenants, so I trust them."
• "They said they only made one copy."
• "It is probably fine because the property is in a nice neighborhood."

Key control is not a character judgment. It is a turnover step.

Know when changing the code is not enough

Keypads and smart locks can make turnover easier, but only if you understand what changed.

If a lock has a physical key override, changing the keypad code does not make old physical keys stop working. If a garage keypad code changes but old remotes still work, the property is still accessible. If a smart lock code changes but a former tenant still controls the app account, you have not actually taken back control.

At turnover, check each access type separately:

The test matters. Do not just update the app and assume. Try the old code if you know it. Confirm old fobs are disabled. Make the garage opener forget prior remotes if the model allows it. If an HOA controls the gate or building system, get confirmation in writing.

Use a move-in access log

At move-in, give the tenant a short access log. It can be a one-page form, a line in the lease packet, or a record in your property-management software.

It should say:

• Property address and unit
• Tenant names
• Move-in date
• Number of front-door keys issued
• Number of mailbox keys issued
• Number of garage remotes, gate cards, fobs, or parking devices issued
• Codes issued, if you document them this way
• Any access devices the tenant did not receive
• Tenant acknowledgment that these items must be returned at move-out

Example:

This is not about making the tenant feel watched. It is about avoiding mystery math later. If you issued two fobs and one comes back, everyone knows what is missing and what replacement or deactivation step is needed.

Separate owner, tenant, and vendor access

Small landlords often mix access casually:

• The tenant has their keys.
• The owner has a spare.
• The plumber gets the lockbox code.
• The cleaner knows the garage keypad.
• The showing agent has an old code saved in a text thread.

That works until it does not.

Create three buckets.

Tenant access is what the tenant receives for normal possession: keys, fobs, remotes, and approved codes.

Owner access is what you retain for lawful entry under the lease and local law: a spare key, emergency access method, or admin control for landlord-owned smart devices.

Vendor access is temporary. A vendor should not keep a permanent code just because it is convenient. Use a lockbox, temporary smart-lock code, scheduled access with the tenant, or a unique code that gets deleted after the job.

If you use smart locks, avoid one shared "contractor code" that lives forever. Use named codes when possible, set expiration dates if the system supports them, and delete codes after work is complete.

Do not let rekeying become an illegal lockout

Changing locks is normal after a tenant returns possession. Changing locks while a tenant still has legal possession is a different issue.

Before you rekey, make sure you have a clear legal right to do it:

• The lease ended and possession was returned.
• The tenant surrendered possession in writing.
• Keys were returned and the unit is actually vacant.
• A court process gave you possession, if required.
• Local abandonment rules have been followed where they apply.

Do not change locks because rent is late, the tenant is annoying, or you believe they "basically moved out" while belongings remain. Self-help lockouts can create serious liability. If the facts are messy, get local legal guidance before you touch the locks.

For ordinary turnovers, keep the sequence boring:

1. Confirm possession is returned.
2. Document the move-out condition.
3. Rekey, reset, deactivate, or replace access.
4. Log what changed.
5. Issue clean access to the next tenant.

Decide what missing access devices cost before move-out

Keys are cheap. Fobs and remotes are not always cheap.

A missing mailbox key might require a replacement through USPS, the HOA, or a locksmith. A missing building fob may require a management office fee. A missing garage remote may require replacement and, sometimes, opener reprogramming. A missing master key to a small building may justify a broader rekey if it creates real security risk.

Your lease and move-in documents should be clear that tenants must return keys, remotes, fobs, cards, parking permits, and other access devices. If local law allows charging for missing items, charge actual, reasonable costs and document them.

Good records include:

• The access log showing what was issued
• Move-out notes showing what was returned
• Locksmith, HOA, or vendor invoices
• Photos or serial numbers for fobs/remotes where useful
• Written explanation in the deposit accounting, if deducted

Do not invent penalties after the fact. "Missing gate fob replacement per HOA invoice: $75" is cleaner than "key fee: $300."

Keep one spare-access plan per property

Every rental should have a documented owner access plan.

That might be:

• Owner-held spare key in a labeled, secure key cabinet
• Locksmith on file who can rekey that property's lock type
• Lockbox used only during turnover or scheduled vendor visits
• Landlord-controlled smart lock with a physical key backup
• On-site manager or trusted local contact for out-of-area owners

What you do not want is the only spare key sitting in your car console, unlabeled, next to three similar keys from other units.

If you own multiple doors, label keys by code rather than full address. For example, "Oak-2A" in a locked key cabinet is better than a tag that says "123 Oak Street Unit 2A front door" if someone else finds it. Keep the decoding record somewhere secure.

Also review who on your side has access. If a former handyman, property manager, assistant, or roommate has keys or codes from past work, clean that up.

Add key control to the turnover checklist

Turnover checklists often focus on paint, cleaning, utilities, and listing photos. Add access control as its own section.

Before listing:

• Confirm what locks, codes, fobs, and remotes exist.
• Change any lockbox or showing code from the prior turnover.
• Decide whether showings will use tenant access, owner access, or scheduled entry only.

After move-out:

• Collect keys, remotes, fobs, cards, permits, and mailbox keys.
• Rekey or reset exterior access.
• Delete tenant smart-lock codes and app users.
• Change garage, gate, alarm, and lockbox codes.
• Deactivate missing fobs or remotes where possible.
• Photograph access devices returned.

Before move-in:

• Test every key and code you will issue.
• Confirm owner spare access works.
• Complete the access log.
• Give the tenant only the intended access devices.
• Save locksmith and access-system receipts in the property file.

The important word is "test." A key that was supposed to open the mailbox but does not is a move-in-day irritation. A spare key that does not open the deadbolt is an emergency-access problem waiting for the worst possible time.

Use a simple rule for tenant-created copies

Some leases prohibit copying keys entirely. Some allow reasonable copies for residents but require return of all copies at move-out. Some states or local rules may affect lock and key policies, especially for multi-unit buildings.

Whatever rule you use, make it practical and written.

For example:

Tenant may not change, rekey, add, or replace any lock without Landlord's written approval. Tenant must return all keys, copies, remotes, fobs, cards, parking permits, and access devices at move-out. Landlord may charge actual allowed costs for missing access devices, rekeying required by missing keys, or deactivation/replacement fees, subject to applicable law.

Have your lease reviewed locally. The blog version is a concept, not a jurisdiction-specific clause. The point is that your access policy should exist before the move-out argument.

The field habit

When you finish a turnover, you should be able to answer four questions without searching old texts:

1. When were the exterior locks last rekeyed or reset?
2. What keys, codes, remotes, fobs, and cards did the tenant receive?
3. What owner or vendor access still exists?
4. What needs to be returned, deleted, or deactivated at move-out?

If you can answer those, key control is handled.

If you cannot, add the access log before the next move-in. Not because every tenant is a risk. Because the next tenant deserves a clean start, and you deserve a property file that does not depend on memory.

You might also like:

• What to do when a tenant gives notice: a turnover checklist for self-managing landlords
• Tenant wants to install a doorbell camera or smart lock: what landlords should approve in writing
• Move-in condition reports: the rental habit that makes deposit decisions easier
• Utility transfer checklist for rental turnover

ManorKeeper keeps access records with the unit

When key logs, rekey dates, smart-lock notes, fob numbers, move-in records, and move-out tasks live with the property record, turnover access stops depending on memory. See how ManorKeeper organizes rental operations.