The PN532 is the more capable 13.56 MHz option: it reads and writes MIFARE cards and NFC tags such as NTAG215, and supports I2C, SPI or UART, selected with switches. I2C makes wiring easy, and ESPHome has a native PN532 component that triggers automations when a tag is scanned. That’s also how Home Assistant’s tag feature works for NFC stickers. This 3-pack (about 4.1 stars from 24 ratings) leaves spares for several doors.

Fingerprint entry means nothing to lose or forget. The AS608 (about 4.4 stars from 33 ratings) is an optical sensor that stores fingerprint templates and does the matching itself, so the ESP32 just asks “which ID matched?” over a UART. Popular Arduino fingerprint libraries and ESPHome’s fingerprint component work with this family of sensors. Optical sensors struggle with wet, dirty or very dry fingers and in direct sunlight, so mount them indoors or under cover, and always keep a backup way in. 8 were in stock when we checked.

For indoor PIN entry on a cabinet, safe or alarm panel, a 4×4 membrane keypad is the cheapest option (this 4-pack has about 4.3 stars from 76 ratings). It uses 8 pins in a row/column matrix; ESPHome’s matrix keypad component and Arduino’s Keypad library scan it for you. Save GPIOs by connecting it through an MCP23017 I/O expander. Combine it with an RFID reader for two-factor entry: card plus PIN.

This slim, waterproof reader (about 4.4 stars from 84 ratings) fits on a narrow door frame and outputs card numbers over Wiegand 26 or 34. It’s the clean way to put a card reader outdoors while the ESP32 stays inside. Like all 125 kHz EM readers, it’s for convenience-level security. Level-shift the 5 V data lines to the ESP32. Only 6 were in stock when we checked.

For cabinets, drawers, lockers and parcel boxes, a small solenoid bolt is the simplest lock. ATOPLEE’s slim 12 V lock (about 4.1 stars from 368 ratings) draws about 0.43 A while energised and retracts its bolt to open. Drive it from the ESP32 through a MOSFET module or relay with a flyback diode, and only energise it briefly: these locks are designed for short pulses, not continuous power. They’re “fail-secure”, meaning they stay locked when power is lost. 20 were in stock when we checked.

For a real door with a normal latch, an electric strike replaces the strike plate in the frame, and when the ESP32 energises it, the latch can push through and the door opens. Crucially, the inside handle still opens the door mechanically, so people can always get out. UHPPOTE’s strike (about 4.4 stars from 291 ratings) is selectable between fail-secure (stays locked without power) and fail-safe (unlocks without power). Fitting it means cutting the door frame, so it’s a careful installation. 18 were in stock when we checked.

A maglock holds the door with an electromagnet and a steel plate, with no moving parts and 600 lb of holding force here (about 4.0 stars from 341 ratings). Z and L brackets fit inward-opening and glass doors. Maglocks are inherently fail-safe: they release when power is cut, which is why they’re used on commercial exits. That also means a power cut leaves the door unlocked unless you add a battery backup. Because the magnet holds the door shut against any handle, you need a request-to-exit button or sensor, and codes often require additional emergency release measures. Check local rules before fitting one to an exit door.

An access system should know whether the door is actually closed. The MC-31 (about 4.1 stars from 497 ratings) is a wired normally closed reed switch: wire it to a GPIO with the internal pull-up and you’ll know when the door opens, whether it was left ajar, or if it was forced open without a valid credential. Use it to relock automatically after the door closes and to send alerts. Normally closed wiring also detects a cut wire as an “open” event.

You’ll need credentials to hand out, and NTAG215 stickers are the cheapest, most flexible option (this 50-pack has about 4.5 stars from 3,582 ratings). Stick them on key rings, phone cases or cards, read them with the PN532, or tap them with a phone to trigger Home Assistant tag automations such as “arm the alarm when I leave”. As with all simple tags, a tag’s ID can be copied, so use them for convenience and automation rather than high-security doors.

Smart tool cabinet

RC522 + solenoid lock + MOSFET module, logging who opened it.

Garage side door

Retekess keypad outside + ESP32 inside + electric strike + door contact.

Keyless office or study

AS608 fingerprint + 4×4 keypad backup + strike.

NFC automation hub

PN532 + NTAG215 tags triggering Home Assistant scenes.

What’s the difference between fail-safe and fail-secure?

A fail-safe lock unlocks when power is lost (maglocks, some strikes), which protects people in an emergency. A fail-secure lock stays locked without power (solenoid bolts, most strikes), which protects property. Choose based on the door: exits and escape routes usually need fail-safe or a mechanical exit, while cabinets and stores are usually fail-secure.

How do I drive a 12 V lock from an ESP32?

Never from a GPIO directly. Use a relay module or a logic-level MOSFET module, powered from a 12 V supply sized for the lock’s current, with a flyback diode across the coil. Our ESP32 relay board guide covers suitable boards.

What if Wi-Fi or Home Assistant goes down?

Design the ESP32 to check credentials locally against a list stored in flash, so the door works offline, and sync the list when the network returns. Always keep a mechanical key or another backup entry method.

Where should the ESP32 go?

Inside the secured area, in an enclosure, with only the reader outside. If the controller is outside, someone can open the housing and short the lock wires. Wiegand and other remote readers exist exactly so the brain stays protected. See our enclosures guide.