Hotel door lock systems: key cards, encoders and the link to the PMS

A hotel door lock system is four parts working together: the lock on the door, the key card, the encoder at the front desk that writes the card, and the software that decides who may enter which door and when. Linked to the PMS, a card is written at check-in and cancelled at checkout.

A guest checks out at 09:00, the bill is closed, and the card in their pocket still opens the room until noon. Nothing in the PMS shows it, because the lock was never told. This article explains how a hotel door lock system works part by part, what the PMS link actually changes, and what to check before you spend money on new locks. After reading, you will be able to judge any vendor's proposal against your own building and your own desk.

What are the parts of a hotel door lock system?#

A hotel door lock system has four parts: the lock on the door, the card the guest carries, the encoder at the front desk that writes the card, and the software that decides who may enter which door and when.

The lock is a small computer with a card reader, a processor, a motor or solenoid and a memory that holds the cards currently allowed in, plus a log of what happened at the door. In most hotels it works with no cable to the network. The card is not a key: it carries a credential, a room reference, a validity window and a value the lock can check. The permission lives on the card and in the lock, not in the plastic itself.

The encoder is the desk device that writes and reads cards. It is also how staff cards are made, which makes it a security device, not a peripheral. The management software issues, expires and cancels credentials; it may be the PMS itself, or a separate lock system the PMS talks to through an interface. If you want to see where this fits in the wider picture, read how the core systems of a hotel technology stack fit together.

The distinction that matters: the lock decides and the software authorizes. When the two disagree, the lock keeps its own version until someone updates it. The common buying mistake is treating locks and software as one purchase and the PMS link as an afterthought, when the link is what the front desk touches at every check-in.

Which card technology should a hotel choose?#

Three families are common: magnetic stripe, low-frequency contactless cards at 125 kHz, and high-frequency contactless cards at 13.56 MHz. They differ in how hard they are to copy, how they wear, and what the locks cost.

Magnetic stripe cards store the data on a stripe that a sliding or motorized reader reads. The stripe collects dirt and wears out, and the data can be read and rewritten with cheap, openly sold equipment. The 125 kHz proximity cards hold a fixed number, and the lock checks that number against its list: simple, cheap and durable, but a fixed number can be duplicated with tools that are widely available.

The protection comes from authentication, not from the carrier frequency. A 13.56 MHz card that runs an authentication exchange with the reader, in which the value changes each time, is harder to copy, because copying the card's memory does not automatically produce something the door accepts. Frequency alone does not decide this: some 13.56 MHz cards carry a fixed value and are as easy to clone as 125 kHz ones. Harder to copy, not impossible. Wear matters more than hotels expect: contactless cards survive pockets, phone cases and repeated reissue better than stripes, and printed cards cost money per stay, so the return rate is part of the calculation.

The card type is decided by the lock, not the other way round. Changing card technology later means changing readers, which means changing locks.

What changes at check-in and checkout when the lock is linked to the PMS?#

With a link, the card is written inside the check-in flow and the credential expires on its own at checkout. Without a link, the receptionist types the same stay twice and the card lives until a fixed date.

Without a link, the receptionist finishes check-in in the PMS, opens the lock software, types the room number and the dates, and writes the card. That is two records and two chances to mistype, with no shared idea of when the stay ends. With a link, the PMS passes room, guest reference, arrival and departure to the lock system, and the card is written at the desk in the same action, so the name on the reservation and the card in the guest's hand match.

At checkout the PMS tells the lock system the stay has ended and the credential is cancelled. On offline locks that cancellation reaches the door only when the lock next meets the encoder or a portable programmer, so the expiry time written on the card is the real protection. Early departure is the case hotels get wrong: the room is free in the PMS but the card may still work until its expiry, so set expiry at the departure time rather than at a fixed hour of the day. A room move done only in the PMS leaves a working card for the room the guest has left, so the old card must be cancelled and the new one written.

The link does not make the lock secure, does not stop a copied card and does not replace the lock's own record. It removes typing and it makes cancellation automatic, which is most of the daily value. For context, the hotel operating system that holds reservations, front desk and billing in one place is where this link lands on our side: AI Otel's hotel operating system is built and working, ahead of launch, and door locks are architected, designed for the major door-lock vendors, not connected today.

How do staff cards and master cards work?#

Staff cards carry levels rather than keys: a housekeeping card opens the rooms on a floor for a shift, a master card opens everything, and each level is a decision the hotel makes and should write down.

The usual levels are a guest card for one room and one window, a floor or section card for housekeeping, a department card for a specific area, a master or emergency card for all doors, and often a separate level that overrides a deadbolt. Issue by name: a card that is not tied to a person cannot be traced in the lock's record, which turns every dispute into a guess. Expire staff cards at the end of the shift, not the end of the month, because a card that outlives the shift is an open door with nobody watching it.

A lost master card is a building-wide event. Cancel it in the software, and on offline locks either walk the affected doors with the encoder or accept the gap until the next visit. This is why master cards should be few and signed out. A shared master card kept in a drawer defeats the record entirely, and staff turnover is the quiet risk: cards must be cancelled on the last working day, not when someone remembers. The same discipline applies to software, as covered in PMS user roles and permissions.

What does the lock record, and who can read it?#

Every lock keeps its own log: which card, which door, what time and whether the door opened. It is the only record that survives when a guest says the room was entered.

The lock stores a card identity, a time, the door and a result: opened, refused, deadbolt engaged, and on some models whether the door was left open. The identity is a card number, not a name, so the software maps that number to a person; a hotel that keeps no issue log can prove a card was used but not who held it. Reading the log means visiting the door with a portable device, or pulling it from the desk software where the lock is online. On offline locks, someone has to walk.

The memory is finite and older events are overwritten, so how often you collect decides how far back you can answer. The collection interval is a policy decision, not an IT detail. The uses are concrete: a guest reporting missing property, an insurance or police request, and the ordinary question of why a card that should work did not. Its limit is equally concrete: it is evidence of a card and a time, not proof of who was holding the card. For how we think about records and access, see how records and access are handled in the AI Otel system.

Do hotel door locks need a network, and what about batteries?#

Most hotel locks work offline: the card carries the permission and the lock decides alone. Online locks report to the desk in real time, cost more, and depend on power and network at every door.

Offline locks need no cable to the door. The encoder writes the card, the lock holds a list of valid cards and its own clock, and changes reach it only when a card or a programmer visits. This suits older buildings and keeps installation simple. Online locks talk to a hub or the hotel network, so a cancellation is immediate and the event log arrives without a walk; the trade is wiring, network dependency and a plan for when either fails. Many systems sit in between, with offline locks and a data collector on each floor that gathers events and pushes updates.

Batteries are the maintenance item nobody budgets time for. Locks run on cells, the desk should see a low-battery warning, and cold corridors and heavy traffic shorten life; the vendor's replacement interval is the starting point, not a guarantee. A dead battery should not lock a guest out, so ask what the mechanical override or external power point is and who in the building holds it. Keep a maintenance kit: a replacement schedule, one spare lock, one spare encoder, a stock of cards and one person who knows the software well enough to train the next.

What should you check before replacing your door locks?#

Check the PMS link first, the cards second and the hardware third. Locks are the part you cannot change quickly, and the software link is the part that decides daily work at the desk.

Start from the PMS: does the lock vendor have a working interface with your PMS, in writing, with a reference hotel you can call? Which events flow, in which direction, and what happens when the link is down? Then card economics: cost per card, return rate, printing, and whether the new locks accept the cards you already own and have already printed.

The doors themselves matter: thickness, backset, mortise type, finish and the door's own certification. Ask the door supplier and the lock vendor to confirm in writing that the two are compatible; do not assume it. Decide coverage, guest rooms only or also back-of-house, stores, offices and lifts, since each extra door adds licences and keys to manage. Plan the changeover night as carefully as a system switch, the same discipline as in a PMS cutover plan, and run the new locks and the link on one floor before the whole building. A floor is enough to find the door that does not fit and the interface that does not behave.

What to do next#

Write down the four parts you have today, the lock, the card, the encoder and the software, then ask your lock vendor and your PMS vendor the same three questions in writing: which events flow between them, what the desk does when the link is down, and how the lock record is collected. That one page tells you whether you need new locks or only a link, and it is the same page you will need again when either vendor changes. If you want to discuss how door locks fit a hotel operating system, request a briefing.