If you have shopped for a keypad lock online you have met Tuya, whether or not you noticed. Dozens of unfamiliar names, locks that look oddly similar to each other, and every listing telling you to download the same app.
The usual conclusion is that these are all the same cheap lock with different stickers. That is close, but it gets the important part backwards.
What Tuya actually sells
Tuya is an IoT platform company. What it sells is the difficult, unglamorous half of a connected product: the wireless module, the cloud service behind it, the phone app, and the tooling to tie them together. Its customers are manufacturers — including a great many traditional lock makers who were perfectly good at metal and had no interest in becoming software companies.
Tuya's own pitch to those manufacturers is explicitly about cost: adopt the platform and skip the R&D budget a connected product would otherwise need. That is a real service and it explains the shape of the market. It is why the entry price for a keypad lock collapsed, and it is why so many of them share an app.
The badge on the front tells you who assembled it. The app tells you who wrote the software. They are not the same company and only one of them is consistent.
This is the same category error people make with TTLock, and it produces the same confusion. Asking whether Tuya locks are any good is like asking whether Android phones are any good. The honest answer is that the question is aimed at the wrong layer.
What you are actually choosing between
Because the software is the constant, the variables are all physical, and they are the ones that decide whether the thing is still working in three years:
The cylinder. Rated or not. On a UK door this matters more than every app feature combined, and a cheap lock set is exactly where an unrated one turns up.
The gearbox and the motor. What actually throws the bolts, several times a day, for years. It is also the part you cannot inspect from a photograph.
The handle and the fixings. Whether it feels like hardware or like a toy the first time you use it.
Whether anyone answers. A platform does not do warranty. The company on the box does, if it still exists.
The data question, and the part nobody mentions
Tuya attracts security and privacy scrutiny, and it is worth being precise about what is actually claimed rather than trading in vibes.
Independent security researchers and US policy voices have raised concerns about Tuya-powered devices — network connections to servers in China, weaknesses found in app and device security, and the broader worry that Chinese law can compel a company to hand over data it holds. Tuya's position is that user data is assigned to regional data centres by the user's location, that it operates several worldwide, and that European and American customers' data sits with mainstream cloud providers rather than in China.
We are not in a position to adjudicate that, and we are not going to pretend otherwise. What we can tell you is what it means on a door.
These locks do not need the cloud to work. Codes live on the lock itself. Bluetooth unlocking from your phone works with no internet connection at all, and offline passcodes can be generated and used without one. What you lose without a network is the remote half — issuing a code to somebody while you are out, seeing the log from elsewhere, remote unlocking.
So if the data question genuinely bothers you, the answer is not to avoid the category. It is to fit the lock, skip the gateway, and run it as a keypad lock that happens to have an app for setup. Plenty of households never wanted the remote features anyway.
The other thing worth knowing is that anything sold to consumers in the UK now has to meet the Product Security and Telecommunications Infrastructure Act 2022, regardless of where it was made — no universal default passwords, a published route for reporting vulnerabilities, and a stated minimum period for security updates. That last one is a published, comparable number, and on a platform product sold under many badges it is one of the few ways to tell a serious seller from a drop-shipper.
Where it is the right answer
On price and features, nothing else is close. A Tuya-based lock will give you fingerprint, keypad, card, app and a key override for less than a single-brand lock costs with half of that. For an internal door, a holiday let, an office store room, a second property — places where the consequence of a failure is inconvenience rather than a catastrophe — that trade is often exactly right.
The app is also, genuinely, fine. It is mature, it is actively developed, and it does more than several manufacturers' own apps do.
Where it is the wrong answer
When you need one company answerable. If something fails in year three, the platform is not who you ring. Buyers who want that should pay the premium for a manufacturer instead.
When you cannot inspect it first. The variation is in the hardware, and photographs hide hardware. Buying blind from an unfamiliar name is where the bad outcomes in this category concentrate.
On a main entrance door with an unrated cylinder. This is the one that actually loses people money. Fitting a cheap all-in-one set in place of a rated cylinder makes the door worse, and the app does not tell you that has happened.
If the data question will bother you indefinitely. The offline route above is real, but if you would rather not think about it at all, that is a legitimate reason to buy something else and nobody should talk you out of it.
At a glance
| What it is | An IoT platform — module, cloud and app sold to manufacturers |
|---|---|
| Who makes the lock | Somebody else, and it differs every time |
| What the name guarantees | The software and the app. Nothing physical |
| Strongest point | Features per pound, by a distance |
| Weakest point | No single party accountable for the finished product |
| Works without internet | Yes — codes and Bluetooth unlocking are local |
| UK obligation | PSTI Act 2022 applies regardless of where it was made |
Verdict
Best forInternal doors, holiday lets, second properties and anyone who wants the full feature list without paying manufacturer prices for it
What works
- Features per pound that no single manufacturer matches
- A mature app that does more than several makers' own
- Works with no internet at all — codes and Bluetooth unlocking are held on the lock
- Enormous range, so the specific combination you want probably exists
What doesn't
- The badge tells you nothing about how the lock is built
- No single company answerable for the finished product or its warranty
- Unrated cylinders turn up in cheap sets, which is the one failure that matters
- Data and app-security concerns have been raised by researchers and remain contested
Where this assessment comes from
We fit Tuya-based locks. The observations about build variation, cylinders and what survives a few years on a door are ours, from putting them on doors and being called back to some of them. The description of what Tuya sells is from the company's own material aimed at manufacturers; the security concerns are as reported by independent researchers and policy bodies, and Tuya's response is as the company states it. We have not audited any of it and we do not claim to have. The UK obligations are in the Product Security and Telecommunications Infrastructure Act 2022. See editorial standards.
How we assess Our views come from installing and configuring these locks on real doors, and from living with the apps and the admin side afterwards. We do not run laboratory security or durability tests, and we say so rather than implying a rigour we don't have. Read more on our editorial standards page.