Why should a building entrance code be changed, and how often?

An entrance code is meant to admit authorised people, but unlike a personal key it is difficult to know who actually holds it. The longer it remains unchanged, the more likely it is to pass from residents to guests, couriers, carers, contractors and temporary workers, and to remain with former residents or suppliers. The code may still open the door, but it no longer provides effective access control.

As a practical management recommendation, review and change the code every 6–12 months. The appropriate interval depends on the number of apartments, resident turnover, the number of service providers, short-term rentals, the number of entrances and how widely the code is exposed. A busy or high-turnover building should lean towards six months; a small stable building may sometimes lean towards twelve. Do not wait for the scheduled date if the code may have been shared, posted or disclosed to an unauthorised person, following a security incident, or after a significant change of residents or contractors.

Where a working intercom is available, guests, couriers and contractors should call the apartment they are visiting. The resident can identify the visitor and release the door remotely without disclosing the building’s permanent code. Residents should not buzz in unidentified callers or allow someone to follow them inside without verification. If the access system supports it, a temporary, individual or time-limited code is preferable for a supplier.

Share the new code only with residents through a private secure channel, such as the dedicated area of the residents’ platform, rather than displaying it in the lobby or posting it in an open group. Choose a code that is not predictable, avoid immediately reusing an old code, disable the previous code and verify every relevant entrance. The intercom should also be tested, residents notified in advance, and appropriate access preserved for authorised people, accessibility needs and emergencies.

Safety, insurance and privacy cannot be managed by an operational decision alone. The purpose, risk, qualified professional and relevant approval should be recorded, access to information restricted and the validity of inspections and cover checked.