A lockbox is the one asset you deliberately leave behind. It hangs on a door handle or bolts to a wall at a property you visit once a week, holding the keys to everything inside, and it relies entirely on your memory of where it is and who knows the code. Multiply that by every listing, rental turnover and contractor job, and memory stops being a plan. This guide covers how to register, code-manage and audit key safes and realtor lockboxes properly.
What you will learn
- The lockbox blind spot
- A register entry for every box
- Codes: rotate them, don’t collect them
- Identifying boxes without advertising them
- Placement and removal as check-outs
- Auditing boxes in the field
- Tools that make this easier
- FAQ
The lockbox blind spot
Lockboxes fail in a way most equipment cannot: by succeeding quietly. The box is mounted for a viewing season, a renovation or a turnover, the job ends, and the box stays - working perfectly, holding live keys, known to a circle of people that only ever grows. Nobody owns its removal because it was never anyone’s asset to begin with. The common patterns:
- The box outlives the job. Mounted “for the contractor”, still there two contractors later.
- The code outlives the circle. Shared with the cleaner, the agent, the plumber and a tenant’s relative - and never changed afterwards.
- The contents are unknown. Nobody can say whether the box on unit 12 holds a front-door key, a master key or nothing at all.
- The fleet is invisible. Boxes were bought ad hoc by different people, so there is no list to audit against.
A register entry for every box
The fix starts with treating the box as an asset with its own identity, separate from whatever property it currently sits on:
| Field | Why it matters |
|---|---|
| Box ID | A neutral code for the box itself, independent of any property it visits |
| Type | Push-button, dial or electronic - decides how codes change and how the box fails |
| Mounted location | Property and exact spot (“rear gas meter cupboard”) - useless if vague |
| Contents | Which keys, by key ID - a lockbox is a container, and the keys are the real asset |
| Code status | Date last changed and circle shared with - the code itself lives somewhere restricted |
| Placed by / date | Every box gets an owner the moment it is mounted |
| Planned removal date | The single field that stops boxes outliving their job |
| Condition | Stiff wheels and corroded shutters fail in winter, with a contractor in the rain |
Codes: rotate them, don't collect them
Run codes on two rules. First, rotate at every change of circle: tenancy turnover, contractor completion, listing closed, staff member gone. Between events, change codes on a calendar anyway - a code with no known reason to change is a code nobody is thinking about. Second, record the change, not the code: the register holds the date of the last change and who the current code was shared with, while the code itself sits in a restricted place that only the people who genuinely need it can reach. A code in a widely shared spreadsheet has the same security properties as a code written on the box.
Identifying boxes without advertising them
Label the inside, not the outside. A box ID and a printable QR label inside the door or under the lid lets anyone who legitimately opens the box scan it with a phone camera and land on its record - confirm the contents, log a code change, flag a stiff mechanism. The outside stays anonymous: no property name, no unit number, no company sticker that tells a passer-by these keys are worth working for. If boxes move between properties often, the inside label is also what stops the register confusing two identical grey boxes on the same street.
Placement and removal as check-outs
The habit that keeps the fleet visible: placing a box is a check-out to a property, and removing it is a return.
- Place: record the property, the exact spot, the contents and - critically - the planned removal date.
- While mounted: log code changes and contents swaps against the box, not in someone’s notes.
- Remove: return the box to the pool, note its condition, and confirm where the keys went.
- Review: the overdue list - boxes past their planned removal date - is your standing to-do, and it is the entire defence against the blind spot in section one.
Tip: update the record kerbside, before driving away. A code change or removal logged “back at the office” is the one that gets forgotten, and lockbox records are only ever updated in the field or not at all.
Auditing boxes in the field
Because boxes are scattered across properties, audits work best as routes: fold a lockbox check into visits already happening - inspections, viewings, turnovers - confirming the box is present, opens smoothly and holds what the register says. Reconcile the whole fleet against the register a few times a year, the same discipline you would apply to gate remotes and other off-site access kit. A box that fails the audit gets treated as lost keys: the register scopes which locks are exposed, the affected locks or codes change the same day, and the incident is logged with the decision.
Tools that make this easier
The standard lockbox sheet is written at a desk while the boxes live on door handles three postcodes away, so every update depends on someone remembering a code change through a drive home. That gap - states recorded once, events never - is why spreadsheets fail for asset tracking, and lockboxes are a worst case because every meaningful event happens in the field.
An asset management tool like AMPthilly closes the gap because it works from any phone browser, no app install: scan the QR label inside the box, and the record is open at the kerb. Each box carries its location, contents, custom fields for code-changed dates, attached photos of the mounting spot, and a permanent audit history of placements, returns and edits. Check-outs with due dates put overdue boxes on a list automatically. The free plan covers 3 users and 25 assets - most agencies’ and property managers’ lockbox fleets fit inside it.
FAQ
How do you keep track of lockboxes across properties? Own ID per box, a register with location, contents, code-changed date and planned removal date, and placement/removal handled as check-outs and returns.
How often should lockbox codes be changed? At every change of circle - turnover, contractor completion, listing closed, departure - and on a calendar in between. Record the date, keep the code itself restricted.
What should a lockbox register include? Box ID, type, exact mounted location, contents by key ID, code status, placed-by and date, planned removal date, condition.
Should you label a lockbox? Inside, yes - box ID plus a QR label under the lid. Outside, nothing that hints at what the keys open.
What should you do if a lockbox goes missing? Treat it as lost keys: scope the exposure from the recorded contents, change the affected locks or codes that day, log the decision, and fix whatever let the box go unwatched.
The takeaway
A lockbox earns its keep by being left behind, which is exactly why it needs a register that does not rely on anyone passing by. Identify every box inside the lid, track contents and code changes as events, set a removal date at placement, and audit along routes you already drive. The box is a container - manage the information about it, and the keys inside stop being a standing question.