How to Lock a Thermostat So No One Can Change It (And What Each Lock Actually Does)

The lock icon on your thermostat’s screen looks like the answer. It usually isn’t. On every major consumer smart thermostat, the lock blocks the physical display and leaves the app wide open.

That distinction ends up in your heating bill. A tenant who can’t press the up arrow can still pull out a phone, open the Nest app, and set 80°F. A kid who can’t touch the ecobee screen can’t override your schedule from a friend’s account, but anyone else on your home’s ecobee account can.

If you need a true range limit that no one can bypass without a physical tool, that requires a different thermostat model than most people shop for.

Here’s exactly what each lock does and doesn’t block.

The metric everyone checks vs. the engineering blind spot

The lock icon appears on the thermostat menu or in the app, and it creates a 4-digit PIN. That’s the whole consumer-surface story. Most articles stop there.

The blind spot is the app bypass: every consumer smart thermostat’s lock is a display lock. It prevents pressing buttons or swiping the touchscreen. It does nothing to the app running on any enrolled phone. Anyone who shares access to your Nest home or ecobee account retains full control, no PIN required.

The second blind spot is setpoint range limits: locking a thermostat is not the same as constraining the temperature to a range. A locked Nest still runs your schedule to any programmed temperature, including temps outside the locked range. A range limit (minimum heat setpoint of 65°F, maximum cool setpoint of 78°F) is a separate setting that exists on some thermostats and not others.

For landlords and property managers, the question is whether the lock survives an internet connection. For parents, the question is whether the schedule holds outside the locked range.

How the three compare

The blind-spot delta: what actually separates these three

Nest 4th gen lock is a schedule pass-through with a display PIN.

When you lock a Nest thermostat in the app, you set a 4-digit PIN and a temperature range. The physical ring or buttons can’t go outside that range. But Google’s own support page states it plainly: anyone sharing access to your home via the Nest or Home app can still change the temperature and settings, or unlock the thermostat entirely, without entering the PIN. The schedule also keeps running to any programmed temperature, including temperatures outside the locked range.

So a locked Nest means: the person standing in front of the thermostat is constrained. The person with the app is not.

ecobee Access Control is the same architecture.

ecobee’s Access Control lets you restrict four categories on the touchscreen: temperature and quick changes, schedule, vacation hold, and system settings. You set a 4-digit code on the thermostat itself. The key line from ecobee’s support documentation: access via the ecobee app does not require the code. A locked ecobee touchscreen is an open ecobee app.

There is also an important question about setpoint range limits: ecobee’s documentation describes restricting access to the menu that changes the setpoint, but it does not clearly document a numeric clamp (a hard floor on how low heat can be set, or how high cool can be set) that persists regardless of access method. That behavior is provisional and flagged for verification.

Honeywell T6 Pro (non-WiFi) is the structural outlier.

The non-WiFi T6 Pro, model TH6220U2000, has no app. No Total Connect Comfort. No Resideo account. The keypad lock set via ISU #435 is the only interface. Partial lock (mode 1) allows only temperature adjustment; full lock (mode 2) allows nothing. The default unlock code is 1234, which is printed in the installation manual and discoverable in about 30 seconds online. If your goal is to prevent a determined adult, change it in the installer setup.

More importantly, the T6 Pro’s installer setup includes two settings that no consumer smart thermostat exposes cleanly: ISU #430 sets the minimum cool setpoint (range 50-99°F), and ISU #431 sets the maximum heat setpoint (range 40-90°F). Set ISU #431 to 72°F and the thermostat physically cannot be told to heat above 72°F regardless of what button anyone presses. Because there’s no app, there’s no remote override of those limits.

The WiFi version of the T6 Pro (TH6320WF2003) changes this equation: the Resideo app bypasses the keypad lock the same way the Nest and ecobee apps do. If you are buying a T6 Pro specifically for lock enforcement in a rental unit, the non-WiFi model is the one that delivers.

Installation and setup traps

The default PIN is public. Honeywell T6 Pro ships with 1234 as the unlock code. Every model. That’s in the manual and in forum posts. Change it in ISU #435 before handing over keys to a tenant.

Locking doesn’t stop the schedule. On all three thermostats, your heating and cooling schedule runs during lock regardless of the locked setpoint range. If you want a consistent temperature, set a single fixed setpoint and a hold. Don’t rely on a locked thermostat to maintain a constant temperature against a running schedule.

App enrollment is the attack surface. On Nest and ecobee, every enrolled account holder bypasses the lock. Audit your home’s enrolled accounts before activating a lock. If you’re in a rental context and previously shared app access with a tenant, remove their account before you rely on the lock to mean anything.

The T6 Pro is 24V AC only. It runs on standard 24V control voltage from a furnace or air handler. It is not compatible with millivolt systems (standing-pilot fireplaces, gravity furnaces) or line-voltage electric baseboard. Confirm system compatibility before ordering.

The verdict

For a rental property or any situation where you need the lock to survive a phone: the non-WiFi Honeywell T6 Pro (TH6220U2000) is the correct tool. Set ISU #431 to cap heat at 72°F, ISU #430 to floor cool at 68°F, and ISU #435 to full lock with a non-default PIN. There is no app to work around it. That is the only option in this comparison that gives you a true hardware range limit with no remote bypass.

For parents managing kids in the home: Nest or ecobee works, with the understanding that any enrolled app user retains full override. Lock the display to prevent casual adjustments. Remove any accounts that shouldn’t have override access. The Nest lock’s temperature range feature is convenient for this: set 68-74°F and the ring can’t go outside it, while your schedule still manages night setbacks.

Skip the WiFi T6 Pro for lock enforcement. The keypad lock exists but the Resideo app bypasses it. You get the physical restriction and the app bypass in the same device.

When it flips: if the property is rented to a tenant who is also the Nest or ecobee account holder (you shared access so they can use geofencing), the entire lock model collapses. There is no consumer smart thermostat that gives an account holder true lock enforcement over themselves. That scenario requires the non-WiFi T6 Pro or a commercial building-controls thermostat entirely outside the consumer ecosystem.

Frequently asked questions

Does locking a Nest thermostat stop the schedule from running? No. A locked Nest still follows its programmed schedule, including temperatures outside the locked range. The lock only restricts manual adjustments made physically on the thermostat. If you want the temperature to stay fixed, set a temperature hold in addition to the lock.

Can I lock an ecobee so the app can’t change it? No. ecobee’s Access Control PIN applies to the touchscreen only. Any user with access to the ecobee app can change the temperature and settings without entering the code. To prevent app-based changes, you would need to remove the other user’s account from your ecobee home entirely.

What is the default unlock code for the Honeywell T6 Pro? The default keypad unlock code is 1234. This is printed in the installation guide and is widely known. Change it in the installer setup (ISU #435) before using the lock for tenant or child restriction.

What’s the difference between a display lock and a setpoint range limit? A display lock prevents someone from pressing buttons or swiping the screen to change settings. A setpoint range limit (like ISU #430 and #431 on the T6 Pro) constrains the temperature itself. The thermostat physically cannot be told to heat above or cool below the configured limits, regardless of how the command arrives. For real enforcement, you want both.