Virtual Passwords Explained: Stopping Someone From Shoulder-Surfing Your Code

Anyone can watch you type a four- or six-digit code into a keypad from across the street, and once they've seen it, that code is theirs too — permanently, until you change it. That's the real weakness of any keypad entry, smart or not: the code itself never changes, so one glance is all it takes. The virtual password feature on some of our locks solves exactly this problem, and it's simpler than it sounds. Here's how it actually works, and which of our locks have it.

Why a Fixed Code Is the Weak Point of Any Keypad

A traditional keypad — smart lock or old-fashioned mechanical combination lock, it makes no difference — has one real vulnerability: the code is static. Once someone has seen it, by watching over your shoulder, glancing from a car, or catching it on a phone camera in the background of an unrelated photo, they have permanent access until you physically change the code. Unlike a password on a website, there's no second factor, no expiry, and often no log showing it was ever compromised. The convenience of a keypad — no key to carry, no app to open — is exactly what makes this specific weakness hard to avoid with a normal code.

How a Virtual Password Actually Works

The fix, supported on some of our TTLock-based keypads, is disarmingly simple: the lock doesn't require your code to be typed in isolation. Say your real code is 1234. With virtual password enabled, you can type 5917234981 and the door still unlocks — because 1234 appears somewhere within that longer string, surrounded by digits that mean nothing. Type a different set of junk digits around it next time, and it still works, because the lock is only checking whether your real sequence exists inside whatever you typed, not whether what you typed matches exactly.

This works because of how the keypad's matching logic is built, not because of any clever cryptography. Rather than comparing the entered string character-for-character against the stored code, the firmware scans the digits you type for your registered sequence appearing anywhere in order — at the start, buried in the middle, or right at the end. That's a deliberately loose match, and it's the entire trick: it costs the manufacturer nothing extra to implement, needs no additional hardware, and adds no delay to how quickly the door opens once you finish typing. It's a software decision that trades a small amount of matching strictness for a real, everyday privacy gain, which is why it's worth using by default rather than saving it for moments you specifically feel watched.

The effect for anyone watching is that every entry looks different. There's no fixed four-digit pattern to memorise from watching your fingers once — just a long, seemingly random string that changes shape every time, even though the actual secret (your real code) never does.

Which Flashmarques Locks Support This

Virtual password support is a feature of the keypad hardware and firmware, not something every lock in our range has — so it's worth checking before assuming. Two of our current models explicitly support it: the Fingerprint & Code lever lock (SL-H1) and the Long Handle Push/Pull lock (SL-P1), both of which run TTLock. There's no setup step to enable it beyond knowing the behaviour is already built into how the keypad reads your entry — you don't need to activate a mode, you simply start padding your real code with extra digits whenever you want to enter it in view of someone else.

✓ Virtual password supported

Smart Door Lock — Fingerprint & Code

Pad your real code with random digits, anywhere in the sequence, and the keypad still reads it correctly.

$349.99 AUD

View Product →

What Virtual Passwords Don't Protect Against

It's worth being precise about the boundary of this feature, because it solves one specific problem and no others. It does nothing if someone already knows your exact code from another source — a written note, a shared code you gave a former guest, or simply being told it. It doesn't protect against physical attacks on the lock hardware itself, and it doesn't replace a temporary code for situations where you specifically want access to expire (a tradesperson, a short-term guest, a cleaner). What it does, precisely, is remove the ability for a stranger to steal your permanent code by watching you type it once — which, for a code you use daily at your own front door in view of a street or shared hallway, is a genuinely common and easily preventable risk.

It's also worth thinking about who actually needs this feature most. A front door on a quiet cul-de-sac with no direct street sightline to the keypad has a genuinely low shoulder-surfing risk to begin with — there's simply nowhere for an observer to stand and watch unnoticed. A townhouse entry facing a busy footpath, a unit door visible from a shared driveway, or a holiday rental where a long string of strangers legitimately watch the code get entered by a host or cleaner are the situations where this feature earns its place. In those settings, a fixed code isn't a small risk you're accepting for convenience — it's a code that a reasonably attentive stranger could learn within days simply by being in the area at the right moment. Padding the entry costs nothing and takes it back out of play entirely, without changing the actual code you have to remember.

✓ Virtual password supported

Smart Door Lock — Long Handle Silver, IP66

Tempered-glass touchscreen with the same virtual-password support, plus a full IP66 weather rating for exposed doors.

$494.99 AUD

View Product →

Explore the Full Range

Still deciding between entry methods generally? Our guide on fingerprint vs keypad code covers that from scratch, and TTLock vs Tuya explains the app side of the range. The complete buying guide compares every model together.

Frequently Asked Questions

What exactly is a virtual password?
It's a keypad feature where your real code can be entered padded with extra random digits anywhere in the sequence, and the lock still recognises it — so what an observer sees typed is different every time, even though your real code hasn't changed.

Do I need to set up or activate virtual password mode?
No. On supported models, the behaviour is built into how the keypad reads entries — there's no separate mode to switch on. You simply start padding your real code with extra digits whenever you want to.

Which of your locks support virtual passwords?
The Fingerprint & Code lever lock (SL-H1) and the Long Handle Push/Pull lock (SL-P1), both TTLock-based. Check with us before assuming another model in the range has it.

Does a virtual password replace a temporary code?
No, they solve different problems. A virtual password stops your everyday code being copied by someone watching you type it. A temporary code is for situations where you want access to expire on its own — a tradesperson or short-term guest.

Can someone still get in if they already know my exact code?
Yes. A virtual password only protects against a code being learned by observation. If someone already has your real code from another source, padding it with extra digits doesn't change that they know the real sequence.

Is there any downside to using a virtual password every time?
Not really — it takes a couple of seconds longer to type a longer string, and that's the only cost. For a code you use in view of a street, driveway or shared entryway, that small trade-off is usually worth it.

Key Takeaways

• Shoulder-surfing is the simplest way a fixed door code gets stolen — one glance is enough.
• A virtual password lets you pad your real code with random digits, so what's typed looks different every time.
• SL-H1 and SL-P1 both support this via their TTLock keypad, with no setup step needed.
• It doesn't protect against someone who already knows your real code, or replace a temporary code for guests.
• Still deciding on entry method or app? Read fingerprint vs keypad code or TTLock vs Tuya.
• Browse the full range in Smart Door Locks, or compare every model in the complete buying guide.