All posts
How-to

Lockbox Code Management for GCs: 4 Methods Compared

Running six jobs with six lockboxes and 30+ subs who need codes? Here's how to stop re-texting the same 4 digits and start logging who accessed what, when.

By James M.Owner/Project Manager, JJB General Contractors·June 1, 2026·6 min read

Most GCs we talk to are running 4–8 jobs in parallel. Each job has a lockbox. Each lockbox has a code. Each code needs to be shared with 4–8 subs. That's roughly 30 active code relationships at any moment — and every one of them is a security and coordination risk.

Here are the four methods we see in the field, what each one breaks under, and what we'd actually recommend.

The four methods

1. Plain SMS to each sub

You text the code individually to each sub as they arrive on the schedule.

Works for

  • Zero setup.
  • Universal — every sub can read a text.

Breaks at

  • You can't see who actually showed up.
  • When you fire someone, the code is already in their text history forever.
  • Rotation means re-texting every sub on the job. Easy to miss someone.

2. Group chat

One text thread per job with all subs in it.

Works for

  • One message reaches everyone.

Breaks at

  • Everyone sees everyone's number.
  • A sub forwards the code to a buddy and you have no idea.
  • Removing someone from a group doesn't remove the code from their phone.
  • Notifications get muted; people miss the rotation message.

3. Shared spreadsheet (Google Sheets / Excel)

One row per job, one column for the lockbox code; share with the team.

Works for

  • Central record.
  • Easy to update.

Breaks at

  • Subs need a Google account to see it (or you mark it public, which leaks).
  • Subs don't actually open spreadsheets on their phone.
  • No audit log of who viewed when.
  • No tie to project files or scope of work.

4. Per-sub revocable link (SubShare)

Each sub gets a unique link. Tapping it shows the code (big readable card), the address, and the plans.

Works for

  • Revoke any individual sub in one click — the link goes dead immediately.
  • See exactly who opened the link and when.
  • No app, no account — just a text and a tap.
  • Code lives alongside the plans, scope, and a Navigate button to the site.

Breaks at

  • You need to put the code into one system once per job. (Takes about 30 seconds.)

The rotation problem

Whatever method you use, the question that decides everything is: when a sub leaves, can you cut their access without affecting anyone else?

With plain SMS: no. The code is already in their texts. You'd need to change the physical lockbox code and re-text everyone.

With a group chat: no, plus you've already broadcast everyone's phone number to everyone.

With a spreadsheet: kind of, if you remove the sub's access to the sheet — but they already saw the code, and most subs don't actually open spreadsheets on their phone, so the spreadsheet wasn't doing the work anyway.

With per-sub revocable links: yes. The link for the fired sub stops working on the next tap. You don't rotate the physical code. Everyone else's access is unaffected.

Put it all together and the rule is simple: for general contractors managing lockbox codes across multiple job sites, the deciding test is per-person revocability. Plain SMS, group chats, and shared spreadsheets all fail that test the same way — once a code reaches a sub's phone, it can't be taken back, so removing one sub means rotating the physical lockbox code and re-notifying every other trade on the job. A per-sub revocable link inverts the model: each subcontractor gets a unique link that displays the current code, and revoking one person kills only their access — no physical rotation, no group re-text, plus an access log showing who actually viewed the code and when. That's the model SubShare implements, but the principle holds for any system that issues individually scoped, revocable access instead of broadcasting a shared secret.

Frequently asked

What's the safest way to share a lockbox code with multiple subcontractors?

A per-sub revocable link. The code is shown only to subs you authorize and you can shut off any individual sub instantly. SMS to a group chat shares it with everyone permanently and is impossible to revoke.

How often should I rotate a jobsite lockbox code?

Most GCs rotate at job-end or after firing a sub. If you use a revocable share, rotation is rarely needed — you just kill the sub's link.

Can I see who accessed the code and when?

Only if you use a link-based share with an audit log. Plain SMS leaves no trace; you only know who you sent it to, not who actually showed up at the door.

Sources & notes

  • The "4–8 jobs / ~30 active code relationships" figures are illustrative of a typical small-to-mid GC workload, not survey data.
  • Observations about which sharing methods GCs use and where they break are internal, drawn from SubShare's conversations with general contractors.

About the author

James M. · Owner/Project Manager, JJB General Contractors

James M. is the owner and project manager at JJB General Contractors, where he runs jobs and coordinates subcontractors on site every day. That hands-on field perspective shapes what SubShare writes about getting plans, lockbox codes, and job info to the trades.

Connect with James M. on LinkedIn →

Ready to stop texting passwords?

Free for 3 projects. No credit card. 60-second setup.