Flat battery, lost phone, hacking: risks and precautions

1. No lock power: spare-key use depends on the cylinder

For the current models reviewed, Go comes with four AA batteries, the fifth-generation Pro has an integrated lithium-ion battery, and Ultra has a different integrated battery (Nuki Go ; Nuki Pro (5th Gen)). Follow the exact model's instructions for maintenance. Nuki documents a warning below 20% and says battery life depends on factors including use and the door (Nuki Pro (5th Gen) ; Nuki Ultra). A warning is not a reason to keep delaying charging.

Nuki describes opening with an outside physical key when the cylinder has the appropriate emergency function; the Universal Cylinder supplied with Ultra has it (Nuki Pro (5th Gen) ; Nuki Ultra). Have this backup checked and keep a key somewhere accessible without the main phone. A Fob or keypad still sends commands to the lock: it does not replace its power supply.

2. Lost phone: regain entry and review permissions

If the lock is powered, an already configured accessory, a compatible key or help from an authorised person may provide another route. Nuki Web may be an option if its account and remote access were prepared, not a backup that becomes available afterwards without setup (Nuki Pro (5th Gen) ; Nuki App & Web). Avoid an improvised reset before arranging entry and control of permissions.

A lost phone is also a security issue. Protect it in advance with a screen lock and secure associated accounts; the French CNIL recommends this protection for connected objects (CNIL — objets connectés). After loss, use the phone provider's official protection tools and have a trusted administrator or support service review the lost device's permissions. Do not share an administrator code with a stranger offering a quick fix.

3. Internet outage: distinguish local from remote

Nuki says an authorised device communicates locally with the lock over Bluetooth even without Internet (Nuki — local access). The lock and control device must still work, and you must be within range. This does not establish that all integrations or remote commands remain available.

If a relative is expected to open from elsewhere, remote availability matters. Nuki Web requires an account and remote access (Nuki App & Web). Your fallback should not rely solely on someone using the same failed connection. Test separate scenarios before giving visitors access.

4. Hacking: documented protections, not impossibility

Nuki describes end-to-end encryption for commands and a challenge-response mechanism intended to prevent replay (Nuki — encryption). This is the manufacturer's stated architecture, not proof that your installation, phone and accounts are invulnerable. Shared or poorly managed access remains a problem without any attack on encryption.

Keep software updated, protect accounts and Wi-Fi, and remove unnecessary permissions. CNIL advice includes changing default settings and securing the phone and network (CNIL — objets connectés). Nuki promises at least five years of security updates from the product's first market introduction, not your purchase date (Nuki — security updates). Check the model and support period, particularly for an old or second-hand device.

5. Suspicious access: keep the facts and seek suitable help

If an action looks unfamiliar, record its time and permission label without publishing access information. Nuki's log describes actions with a time, user and function, but does not prove who physically entered (Nuki — data protection). Review active permissions with an authorised person and contact manufacturer support for account or operating issues. Avoid repeated experiments or an unplanned reset that could complicate entry and investigation.

Nuki's security page lists historical fixes and affected models (Nuki — security updates). Their existence does not establish that current models have those same faults. If there are signs of forced entry or danger to a person, get to safety and contact the appropriate services: checking an app is not a substitute. An installation defect and a digital incident do not automatically require the same specialist.

Your checklist

These boxes are not sent or saved.

Useful sources

• Nuki Go

  Primary documentation checked 2026-10-17. Manufacturer statement, not independent field testing.

• Nuki Pro (5th Gen)

  Primary documentation checked 2026-10-17. Manufacturer statement, not independent field testing.

• Nuki Ultra

  Primary documentation checked 2026-10-17. Manufacturer statement, not independent field testing.

• Nuki App & Web

  Primary documentation checked 2026-10-17. Manufacturer statement, not independent field testing.

• Nuki — local access

  Primary documentation checked 2026-10-17. Manufacturer statement, not independent field testing.

• Nuki — security updates

  Primary documentation checked 2026-10-17. Manufacturer statement, not independent field testing.

• Nuki — encryption

  Primary documentation checked 2026-10-17. Manufacturer statement, not independent field testing.

• Nuki — data protection

  Primary documentation checked 2026-10-17. Manufacturer statement, not independent field testing.

• CNIL — objets connectés

  Primary documentation checked 2026-10-17. French-language source.

• TFK — Nuki installation

  Primary documentation checked 2026-10-17.

Related guides — Locksmith