Smart Locks Are Not What You Think They Are
I installed my first Mi smart lock in 2019. Three years later it still works, but not for the reasons the marketing materials suggest. The reality of these devices is far more complicated than unboxing a sleek piece of hardware and pairing it with your phone. I have seen too many people treat these locks like ordinary deadbolts with Wi-Fi attached. That approach fails. The first thing nobody tells you is that most "smart" locks do not actually secure anything intelligently. They secure with electronics that can be compromised by basic interference. I learned this the hard way when my lock suddenly stopped responding to Bluetooth commands during a cold snap. The battery voltage had dropped below the operational threshold, but the app showed 40 percent remaining. The voltage curve on those CR123A cells is not linear. The lock thought it had power. It did not. Here is what happens in practice when these devices are evaluated properly. The Mi ecosystem uses BLE for local communication and bridges through the gateway to cloud services. That gateway dependency means your lock can be locked out even when the hardware is fully functional. I spent four hours troubleshooting what I thought was a firmware bug. It was a router DNS issue that prevented the gateway from authenticating with Xiaomi servers. The lock worked perfectly offline. It just could not receive commands.
The second layer of disappointment involves the build quality of the actuator mechanism. Many of these locks use small stepper motors with plastic gears. After approximately eighteen months of daily use, I noticed the deadbolt taking noticeably longer to throw. The motor was still running at the same speed. The gears were stripped internally. Replacing the module costs about sixty dollars and requires disassembling the entire interior panel. The lock is not designed to be serviced. It is designed to be replaced.
What Actually Goes Wrong With These Devices
Power management is the single biggest failure point. Most users install four CR123A batteries and forget about them. The standby current draws approximately twelve milliamps. In normal conditions that lasts eight to twelve months. If your door is used frequently or if the weather sealing degrades and introduces moisture, you are looking at six months before the voltage sags into the danger zone. I switch to lithium CR123A cells instead of alkaline. The capacity difference is significant and the self-discharge rate is lower. My intervals between changes went from roughly seven months to fourteen months. Another issue that rarely gets discussed is the fallback mechanical key system. These locks include a physical key cylinder as a backup. The cylinder is almost always a low-security wafer or disc-tumbler mechanism at best. I picked mine with a standard tension wrench and a single-pin method in under thirty seconds. The mechanical backup exists to prevent total lockout, not to prevent forced entry. If someone has access to the spare key hidden near the door, the entire electronic security model becomes irrelevant. The app integration layer is where the user experience falls apart. Xiaomi's Mi Home application has changed its device pairing protocol multiple times. I had three locks that required complete removal and re-addition after a routine app update in 2023. The devices were not bricked. They simply could not authenticate with the updated server handshake. Re-pairing required physically pressing the reset button on each lock while holding the programming mode. The instructions in the manual do not cover this scenario. I found the solution on a Chinese forum thread that Google indexed once before being taken down.
Get the Full Details
The Technical Details People Skip
The encryption implementation on these locks uses AES-128 for BLE communication, which is standard. However, the key rotation happens infrequently. The initial pairing key remains valid until the lock is factory reset or the user manually changes the administrator credentials. I tested this by logging into the device's debug serial port using a USB-to-UART adapter. The output confirmed that previously paired devices retained their session keys across reboots. If your phone is stolen and the attacker has your Mi account credentials, they have access to the pairing history for every lock associated with that account. The geofencing feature that supposedly unlocks your door when you arrive home is unreliable in dense urban environments. GPS drift causes the lock to trigger randomly or not at all. I disabled it and switched to a manual tap-to-unlock gesture on the exterior panel. The response time dropped from approximately four seconds to under one second because the BLE link establishes directly without cloud round-trip latency. That four-second delay sounds minor until you are standing in the rain with groceries.
What You Should Do Instead
If you are buying a smart lock in this category, budget an additional hundred dollars for a separate mechanical deadbolt installed above or below the smart lock as a redundant layer. The smart lock handles convenience. The mechanical bolt handles security. Do not rely on a single system for both functions. Monitor battery voltage directly rather than trusting the percentage indicator. The Mi Home app does not expose raw voltage readings through the standard API. I modified the Lovelace dashboard on Home Assistant to pull the voltage value from the lock's device information endpoint. Low voltage warnings now trigger at 6.8 volts instead of waiting for the misleading thirty percent notification. That gives me roughly two weeks of warning before failure instead of two days. Keep a copy of the pairing credentials written on paper in a location that is not near the door. Cloud services fail. Servers go offline. Routers get replaced with new firmware that breaks compatibility. A physical record of your pairing keys is the only backup that cannot be hacked, updated away, or rendered useless by a power outage at the ISP level.
I have not recommended these locks to anyone without explicitly stating the failure modes first. They work adequately for people who understand what they are purchasing. The convenience is real. The security is conditional. Most buyers do not read past the first page of reviews and assume that a five-star rating from four hundred people means the product is reliable. It means four hundred people unlocked their front doors with their phones. Those are two different things.
