If you host on Airbnb, Vrbo or Booking.com and don't want to hand over keys in person, you're choosing between two fundamentally different approaches: a physical lock box that holds a key or fob behind a combination, or a digital self check-in flow that sends the guest their instructions and access code automatically, usually over WhatsApp because that's the app guests actually open on arrival day. Below is what each one is genuinely good and bad at.
The two approaches, side by side
Key lock boxes: what they're actually good at
A lock box is hard to beat for simplicity. There's no app to install, no signal required, no battery to die on the guest's phone at the worst possible moment. You buy it once, screw it to a wall or railing, and it works in a power cut. For a single property, low volume, and a host who's happy to change the code by hand between guests, a decent lock box is a completely reasonable choice — and plenty of experienced hosts use one for exactly that reason.
The catch is in the word decent. Cheap combination boxes vary hugely in build quality, and how they're fixed matters as much as the box itself. UK police forces' Secured by Design scheme independently tests key safes against forced and manipulated entry, and recommends choosing a certified model and fitting it properly — not looping it through a thin cable onto a drainpipe, which is a genuinely common installation mistake that undermines an otherwise decent box.
Where lock boxes fall down
- The code doesn't change itself. If you (or the last guest, or a cleaner) don't manually reset it, the same code sits on the wall for the next arrival, and often the one after that. That's a real exposure over a season of back-to-back guests.
- No verification gate. Anyone who has the code — guest, guest's friend, a photo shared in a group chat — can open the box. There's no step that checks the person is actually your booked guest or has accepted your house rules first.
- It doesn't scale. One box, one property, one manual code change is fine. Five properties with staggered arrivals is five things to remember, in person or by phone, every single changeover day.
- Weather and wear. Combination dials seize up, get stiff in the cold, or get harder to read at night. A guest fumbling with a lock box in the rain at 11pm is not the first-impression most hosts want.
- A site visit if it goes wrong. Jammed box, forgotten code, guest can't find it in the dark — the fallback is usually you, driving over, or a keyholder doing it for you.
WhatsApp self check-in: what it actually changes
A WhatsApp self check-in flow doesn't remove the physical access point — it can still be a lock box, or a smart lock. What it changes is how the guest gets there. Instead of one fixed code sitting on a wall, the guest receives their pre-arrival message, ID or booking-reference verification step, and access instructions automatically, timed to actually land when they need it — and on WhatsApp, which guests overwhelmingly already have open on arrival day rather than digging through an old booking-confirmation email. Airbnb's own host guidance on self check-in specifically recommends messaging apps guests will actually see, for exactly this reason.
If it's paired with a smart lock, the code can be generated uniquely per guest and expire automatically at checkout — no one manually resets anything. If it's paired with a lock box, the box code itself is still sent over WhatsApp (rather than left fixed), and can be rotated between stays without you doing it by hand. Either way, the guest also gets a channel to ask questions on arrival — "the code isn't working" — that's answered instantly instead of going to voicemail.
Side-by-side comparison
| Key lock box | WhatsApp self check-in | |
|---|---|---|
| Upfront cost | £15–£60 one-off, per property | Small monthly cost; works across all properties |
| Code changes between guests | Manual — you (or someone) has to do it | Automatic, unique code or rotated code per stay |
| Guest verification before access | None — anyone with the code gets in | Optional gate: ID/rules acceptance before code is released |
| Works without signal/app | Yes | Needs the guest to have WhatsApp and a signal on arrival |
| Multi-property scaling | Gets harder fast — one more thing per property | Same effort whether it's 1 property or 20 |
| Guest's own language | Whatever's printed/typed by the host | Can be sent in the guest's language automatically |
| Weather/mechanical wear | Dials seize, get stiff, hard to read at night | No moving parts guests have to operate correctly |
| If something goes wrong | Usually needs you, or a keyholder, on site | Guest can message and get an instant answer |
| Best for | One property, low volume, hands-on host | Multiple properties, international guests, less host time available |
What about insurance?
This is the bit hosts underestimate. Some UK home and let-property insurance policies have conditions around how keys are secured when a property is let unattended, and a claim can be affected if a key safe wasn't fit for purpose, wasn't fixed properly, or the code was never changed. That isn't a reason to avoid lock boxes — it's a reason to check your specific policy wording and, if you use one, buy a tested model and actually change the code. Whichever method you use, don't rely on assumption here; ask your insurer directly.
Guest data and verification — the bit worth doing properly
If your check-in flow asks for ID or booking confirmation before releasing a code, that's personal data, and UK GDPR applies the same way it would to any other guest information you hold. Keep it to what you actually need to verify the booking, say clearly why you're asking, and don't keep it longer than necessary. The ICO is the right place to check your obligations if you're building or buying a verification step, rather than guessing.
So which should you use?
If you run one property, do the changeovers yourself, and don't mind resetting a combination dial between guests, a decent Secured-by-Design-rated lock box is a perfectly sound choice — don't let anyone tell you it's obsolete. The calculation changes once any of these are true: you run more than one property, you host a meaningful share of international guests, you want a verification step before the code goes out, or changeover day is already eating into time you don't have. That's the point where a WhatsApp self check-in flow stops being a nice-to-have and starts paying for itself in the hours it gives back — on top of a noticeably calmer arrival for the guest.
The two aren't even mutually exclusive: plenty of hosts keep the lock box as the physical mechanism and layer WhatsApp messaging and code rotation on top, getting the reliability of a box with the automation of a digital flow. For the exact wording to send at each stage — whichever hardware you use — see our free Airbnb self check-in message templates, and for the code-delivery side specifically, how to send Airbnb door codes automatically. If guests also send you a lot of pre-booking questions, an AI receptionist can field those around the clock so check-in isn't the only thing running on autopilot.
A lock box is a good answer for one property and a hands-on host. It stops being the right answer the moment "changing the code" becomes one more thing you forget to do on changeover day.