Locksmith software in Baltimore: Maryland wants the phone quote on the invoice and the license number in every ad

On a Friday night in October, three people in Baltimore need a locksmith. The first is a nurse coming off a late shift who is locked out of a rowhouse in Canton, standing on the marble steps with a phone at 9% battery, typing “locksmith near me.” The second is a landlord in Hamilton who has a new tenant moving in on Monday and wants the locks in a two-unit building rekeyed for a fixed price, with an invoice for the property manager. The third has lost the only key to a 2017 Hyundai Elantra parked in Highlandtown, and wants to know, before anyone drives over, whether a new key can be cut and programmed tonight and what it will cost.

All three will find a locksmith through a search box, and all three will be quoted a price before anyone picks up a tool. In most states, what happens next is between the customer and whoever answers the phone. In Maryland it is also a matter of record. Under a law passed in 2009, the state requires locksmith businesses to be licensed, to work from a fixed address rather than a van or a post office box, to print their license number in every advertisement, and to write on every invoice the price they quoted before the customer agreed, next to the price the customer actually paid. The car key job adds a vehicle identification number to that invoice, and behind it a registry the carmakers use to decide who may have a key code.

Very little of this is visible in the software most locksmiths use or on the websites and map listings their customers see. The field-service apps that run the trade were built for plumbers and electricians as much as for locksmiths, and the map that sends many of the calls has spent a decade fighting fake locksmith listings with checks of its own. The rules apply whether or not anyone has set the software up to follow them.

This guide is for people who run locksmith businesses in Baltimore City and Baltimore County, and for anyone choosing their software or building their website and online store. It starts with the market and what locksmith software costs, works through the arithmetic of a month of calls, then reads the Maryland Locksmiths Act as the data model it is, the map’s own licensing system, and the federal rules that reach a locksmith’s van, from car key codes to the radio rules for key fobs. It ends with what 50 Baltimore locksmith websites and 152 across the country show their customers and machines, how we would sell keys, fobs, locks and lockouts online, a note for readers in Lithuania, and what we would build. We are a software studio, not lawyers, and nothing here is legal advice; where we read a statute, we say so and link to it.

Baltimore’s locksmiths: seven shops with a payroll in the City, fourteen in the County, and most of the money is commercial

Counted by businesses with employees, the trade is small. The Census Bureau’s County Business Patterns for 2023 finds seven locksmith establishments with a payroll in Baltimore City, employing 25 people in mid-March, and 14 in Baltimore County with 93; four of the City’s seven and ten of the County’s fourteen have fewer than five people. Maryland as a whole has 83, down from 92 in 2018, and the country 3,961, almost exactly the number it had five years earlier. Nobody dominates: the 2022 Economic Census finds that the four largest locksmith firms in the country take 6.5% of the industry’s receipts, and in the 2023 business patterns three in four shops with employees have fewer than five people. Those counts leave out everyone who works alone. The Census does not publish figures for self-employed locksmiths on their own; the closest group, “investigation and security services,” which mixes locksmiths with guards, private investigators and alarm installers, counted 346 businesses without employees in Baltimore City in 2024. That is a ceiling, not a count. The state’s own license register is a better guide than either, but the last official count, about 234 licensed locksmith businesses in 2015, is more than a decade old, and Maryland publishes no current figure.

The money is bigger than the head count suggests. In the 2022 Economic Census, the City’s seven locksmith shops took in $6.8 million, about $971,000 each, against an average of $660,000 nationally, and the County’s eighteen took in $16.2 million. What they are paid for is not mostly lockouts. Across the country, installing and repairing locks and security hardware for businesses and institutions brings in 42.5% of locksmith revenue, more than twice the 20.6% from homes; cutting keys brings in 14.9% and is offered by 85% of shops; selling hardware adds 12.8% and safes 4.6%. Maryland tilts further toward institutions than almost anywhere. Households pay just 14.5% of Maryland locksmiths’ revenue, half the national share, while federal, state and local governments together pay 27.1%, the fifth-highest share among the states. A Maryland locksmith’s most valuable customers are buildings, which means purchase orders, master key systems, net-30 invoices and procurement portals as much as midnight calls.

The people are paid better here too. The Bureau of Labor Statistics counts 130 employed locksmiths and safe repairers in the Baltimore metro area in May 2025, with a median wage of $60,850, 18.6% above the national median of $51,320; the self-employed are not in that count. In its own 2025 survey of readers, the trade magazine Locksmith Ledger found that 45% of respondents work only from vehicles and that the most common business-hours service-call charge was $75 to $100.

Baltimore supplies the demand in its own way. Half of the City’s homes are rowhouses and more than half of its households rent, which means a steady flow of rekeys and lock changes between tenancies; the City’s rental license inspection includes a check for secure locks. There are 11,394 open vacant building notices, each a building somebody has to keep shut. And in 2023 the City lived through the theft wave that followed social media videos showing how to start certain Hyundais and Kias without a key. Vehicle thefts in Baltimore City went from 3,601 in 2022 to 11,301 in 2023, with 1,674 in July 2023 alone, and Baltimore police data reported by local television put Hyundais and Kias at nearly 70% of the cars stolen that year. Thefts have fallen since, to 4,491 in 2025, but they are running 5.5% ahead of last year’s pace in 2026, while burglaries are down 13.6%. Every one of those thefts and break-ins is a potential call for a new key, a new ignition or a new lock.

What locksmith software costs, and what each meter counts

The best-known apps sold to locksmiths for dispatch, quotes and invoices are not locksmith software. They are field-service software, sold to every trade that drives to its customers, and on October 11, 2026, their published prices looked like this. ServiceM8 charges by the job: $29 a month for 50 jobs, $79 for 150 and $149 for 500, with unlimited users. Jobber charges by team size: its Core plan is $49 a month for one user, and its Connect plan $199 a month for up to five, or $169 with a one-year commitment and $149 prepaid annually, with Grow at $299, Plus at $499 and $29 for each additional user. Housecall Pro lists $79 a month for one user, $189 for five and $329 for eight, less on annual billing, although its page now steers visitors to a demo for “tailored pricing.” Service Fusion charges a flat $245, $382 or $627 a month with unlimited users, GorillaDesk charges by the route, which is roughly a van, Tradify $47 to $61 per user, Kickserv $60 to $199 a month by user cap and Markate $49.95 plus $5 per employee.

The platform that courts locksmiths most openly publishes nothing. Workiz has a page for the trade and locksmith testimonials on its pricing page, and every plan on that page says “Request pricing”; its card processing rate is not published either. ServiceTitan and FieldPulse quote privately, and mHelpDesk’s pricing page has gone. Software written for locksmiths specifically is an older, smaller market built around key codes and master keying: Treskat sells its six Windows programs for locksmiths for $180 a year, or as one-time licenses from $99 to $395, and WH Software’s InstaCode key-code database starts at $13.50 a month per device. The same company’s master-keying program, ProMaster, has no public price in dollars.

The meters that matter more sit outside the software. Car keys are priced by the car. Advanced Diagnostics’ Smart Pro programmer runs on tokens, $18.36 each when bought 25 at a time from a US dealer, with one token for a spare key and up to three for an all-keys-lost job on some newer Toyotas, according to an Australian dealer’s guide; its unlimited plan, $3,329.28 a year, pays for itself at about 15 to 18 tokens a month. Keeping an Autel IM608 updated costs $671 a year at a US dealer, and Xhorse updates its tools free but sells some functions separately. The codes cost money too: the NASTF registry that automakers use to vet locksmiths charges $435 for two years for a primary registration and $250 for each W-2 employee added to it, and Toyota’s technical information site sells key codes at $20 each and immobilizer reset access at $80 for two days or $1,500 a year. Leads are the largest and least transparent meter. Google publishes no price for Local Services Ads; marketing agencies that run them report a median of about $32 a locksmith lead, with a range of $18 to $58 and about 55% of leads turning into booked jobs. Angi and Thumbtack also sell leads, and neither publishes a locksmith price.

The arithmetic of a month of calls

To see how these meters add up, take a model Baltimore shop: three vans, staffed by an owner who still takes calls and two technicians; 150 jobs a month at an average invoice of $150, so $22,500 in revenue; 25 car keys that need the programmer, five Toyota key codes, and 60 of the 150 jobs bought through paid leads. All prices are the published ones above, and the lead prices are the third-party estimates.

The line that locksmiths spend the most time choosing is one of the smallest. The field-service app costs between 53 cents and $1.63 a job, 7% to 15% of the bill before leads. The programmer and the card processor each cost more than the app, and the leads cost more than everything else put together. At the agencies’ median of $32 a lead and a 55% booking rate, each booked job carries about $58 of lead cost before anyone has driven anywhere; at $58 a lead it is $105 a job, more than the $75 median lowest lockout price published by the locksmiths in our national sample. That is the economics behind the $19 service call. It is also the strongest argument for a website that can take a booking: every job that arrives through a published price on your own page is a job you did not have to buy.

The part no national platform models: Maryland licenses locksmiths, and the law reads like a database schema

Most states leave locksmiths alone. When the Federal Trade Commission last published advice on finding a locksmith, in a 2016 consumer article that has since been taken down, it counted fifteen states that license or register them. Maryland is one. Chapters 551 and 552 of 2009 created the Maryland Locksmiths Act, Title 12.5 of the Business Regulation Article, and under §12.5–201 a business must be licensed by the Secretary of Labor “before the business and employees of the business provide locksmith services in the State.” The definition in §12.5–101 is broad. It covers repairing, rekeying, repinning, installing or adjusting mechanical, electrical or electromechanical locks, safes and vaults, and opening any of them “by a means other than that intended by the manufacturer,” which is the statute’s description of a lockout. The license belongs to the business, not to the person holding the tools.

The exemptions in §12.5–103 say as much about the trade as the rule does. Cutting keys and selling key blanks are not locksmith services, so a hardware counter or a kiosk needs no license to copy a house key. Neither is swapping a core that its manufacturer designed to be changed by the owner, work on a car’s locks by a repair shop, locks installed by building trades on a job that needs a permit, installation by a retailer as part of its normal business, work by a security systems technician licensed under Title 18 of the Business Occupations and Professions Article, or lock work done for a property owner by its own staff, agent or management company. Everything else that a locksmith does for money, from a lockout at 2 a.m. to rekeying a dentist’s office, needs the license.

Getting one is not hard, and that was deliberate. The owner signs the application under oath and attaches a recent passport-size photograph of the owner and of every employee; the owner and every employee are fingerprinted for a national and state criminal history check, and a new hire’s check has to be applied for before the person starts work (§12.5–203 and §12.5–204). The business must carry at least $300,000 of general liability insurance and tell the Secretary at least 10 days before a policy is canceled (§12.5–205). The license is issued only for a “fixed business address,” a single physical place where the owner or an employee is available during business hours, and §12.5–206 rules out a hotel or motel room, a motor vehicle and a post office box. It lasts two years, and the clock is unforgiving: under §12.5–209, “Once expired, a license may not be renewed,” so a business that misses the date has to apply again from the beginning. Moving to a new address needs the Secretary’s written approval. Every person doing locksmith work must carry a durable photo identification card, issued by the business, that shows its license number and the license’s expiration date (§12.5–207 and §12.5–210). The fees are modest, $225 to apply and $225 to renew under COMAR 09.40.01.02, and no experience or exam is required. The legislature’s 2009 fiscal note expected about 375 businesses to be licensed by July 2010; the last official count, in a 2015 fiscal note, was “approximately 234.” The state publishes no current figure, but its Locksmith Licensing Program runs a public search that lists every licensed business and every employee registered under it. An amendment to the Act’s licensing section took effect this month: since October 1, 2026, Chapter 493 of 2026 has let members of the Foreign Service and their spouses who hold a license from another jurisdiction work under it in Maryland, in some circumstances.

Maryland argued about this for thirteen years before it acted. A 1996 bill for a State Board of Locksmiths with exams and apprenticeships passed the Senate 28 to 19 and died in a House committee, and licensing bills failed again in 2006 and 2008. The 2009 law then passed both chambers without a single vote against it, after a fiscal note that cited a rise of almost 75% in locksmith complaints to the Better Business Bureau from 2005 to 2006, from companies that posed as local locksmiths with local phone numbers and fake street addresses and forwarded the calls to national call centers. The licensing program had a slow start. A December 2013 report from the then Department of Labor, Licensing and Regulation to the legislature explains that, because of cost containment, it did not begin issuing locksmith licenses until January 1, 2013, more than three years after the law took effect. In its first year it received six complaints about locksmiths, and two led to criminal charges against people working without a license. The report describes the typical complaint in a sentence that could have been written last week: a homeowner is quoted a price over the phone, usually under $50, and is then charged a much higher one, with little explanation, once the work is done. The department recommended against adding a competency exam and said the barrier to entry should stay low so that well-meaning locksmiths would get licensed, with the effort going into unlicensed operators instead.

The invoice Maryland wrote in 2009

What makes the Act unusual is not the license but the records. Section 12.5–301 requires every invoice or receipt for a service call to show five things: the address where the work was done, the type of lock serviced, the vehicle identification number if a vehicle was involved, “the quoted cost of the service provided to the customer prior to agreeing to provide the service,” and the actual cost the customer paid. The fourth field answers the complaint that both the 2009 fiscal note and the 2013 report describe. A Maryland locksmith’s invoice has to show the gap between the price that was quoted and the price that was charged, and §12.5–503 separately forbids failing “in any material respect” to finish a job for the price stated in the contract.

The invoices then have a life of their own. They must be kept for three years at the fixed business address and shown to the department on reasonable notice (§12.5–302). If a police department or the department asks for one, the locksmith must send it with the license number on it, within five business days by mail or delivery, or within two business days if it is sent electronically (§12.5–303). Those copies are confidential and are not public records. And the same section contains a sentence we have not seen in any other trade statute in this series: “The Secretary shall encourage licensed locksmiths to develop a system for maintaining the records required by this subtitle electronically.” The legislature asked for software in 2009. It is a short list of fields, and a phone, a paper invoice book or a generic field-service app can all hold it, but only if someone sets them up to.

The license number goes in every ad. Is a map listing an ad?

Under §12.5–401, “each locksmith advertisement, business card, or any other means of providing notice to the public” must show the licensed locksmith’s name and license number. On our reading, which is not legal advice, that includes a website, a Google Business Profile, a paid search ad, a Local Services listing and the lettering on a van, because each of them is a means of telling the public about the business. In 2015 a bill tried to say so explicitly. House Bill 1255, with a Senate cross-file, SB 936, would have named websites and email expressly and gone much further: any advertisement, directory or “search result information” that listed locksmiths would have had to show the verbatim licensed name, the fixed business address, the telephone number and the license number on file with the state, plus the date on which the publisher had checked the license with the department. It never got that far. House Bill 1255 never left the House Rules Committee after its first reading on March 6, 2015, SB 936 was heard on April 2 without a vote, and nothing like them has been introduced since. Virginia, which licenses locksmith businesses and registers each locksmith under a 2008 law, went the other way: its advertising rule now reaches “any electronic medium, including the Internet, social media, and digital advertising.”

The penalties in the Act are heavier than its paperwork suggests. Working as a locksmith, offering to, or holding oneself out as one without a license is a misdemeanor with a fine of up to $1,000, or up to $5,000 for a repeat conviction (§12.5–505), and the Secretary can also order an unlicensed operator to stop and impose a civil penalty of up to $100 a day (§12.5–506). Disregarding building or safety laws, helping an unlicensed locksmith and failing to finish a job for the contract price are misdemeanors carrying up to $10,000 and two years in prison (§12.5–504). On our reading, the invoice and advertising rules sit outside that section, but repeated violations of them are a misdemeanor with a fine of up to $5,000 (§12.5–507), and the Secretary may fine a licensee up to $5,000 per violation in place of, or on top of, a reprimand, suspension or revocation (§12.5–211). A license can be lost for “a pattern of unfair or deceptive trade practices” under the Consumer Protection Act, which is the state’s general tool against bait-and-switch pricing.

The rules change at the state line, which matters to a Baltimore business that takes jobs in Washington or northern Virginia. Virginia licenses the business and also registers each locksmith individually, requires 18 hours of entry-level training, and charges $800 for a two-year business license plus $25 for each individual registration; its definition of locksmith services includes copying keys, which Maryland exempts, and programming electronic keys, which Maryland’s definition does not mention. The District of Columbia appears to have no locksmith license of its own, so a locksmith there most likely works under a general business license, although the D.C. Code makes possessing lock picks with intent to use them unlawfully a crime. On our reading, a locksmith working in all three places needs its Maryland license and a Virginia business license with a registration for each technician who works there, but no locksmith license in the District, and its website, ID cards and invoices have to keep those straight.

The map is the other licensing board

A licensing statute only helps a customer who can see the license, and many locksmith customers never get that far. They search on a phone, often outdoors, often at night, tap a result and call. That moment has been gamed for at least a decade, and locksmithing is the trade where it has been gamed most. In a 2017 study, researchers from Google and the University of California, San Diego examined more than 100,000 Google Maps business listings that appeared between June 2014 and September 2015 and were later suspended for abuse. Locksmiths were the largest single category, 25.7% of abusive listings worldwide and 43.9% of those in the United States. The pattern they describe is the one in the Maryland complaints: a listing placed to look like a local business, a phone number routed to a call center, a low price quoted on the phone, and a much higher one demanded once the job is done. Google’s own summary said contractors such as locksmiths, plumbers and electricians accounted for roughly two in five fake listings, that their operators cycled through non-existent addresses and disposable internet phone numbers, and that fewer than 0.5% of local searches then led to a fake listing.

The response, built up over the years since, is a private licensing system that sits on top of the public one. Ads for locksmith services are a restricted category in Google Ads, and to run them in the United States or Canada a business must first pass Google’s Advanced Verification, which Google extended to Maryland locksmiths in November 2017. It checks public records such as state registrations and professional licenses, includes recorded video interviews, takes six to eight weeks, can be repeated every 12 months, and requires any flat-rate offer to explain what it includes and excludes; Google’s own help page advises applicants to keep words like “emergency” and “lockout” off their website and keywords while the review is pending, which tells you how often those words were abused. In several European countries, including Germany, the Netherlands, Spain, Sweden and Belgium, Google’s local services policy does not let locksmith ads run at all. Google’s pay-per-lead product, Local Services Ads, treats locksmiths as an “urgent category,” and its screening requirements for the United States add background checks on the business, the owner and each service professional, proof of general and professional liability insurance, and a state business and owner license where local law requires one, which in Maryland, on our reading, means the Title 12.5 license. Businesses that pass now carry a “Google Verified” badge, which replaced the old Google Guaranteed and Google Screened badges, and the money-back guarantee that came with the old badge covered only jobs booked before December 7, 2025. Google charges for each lead and publishes no price for one.

The free listing has rules too, and one of them pulls against Maryland’s. Google’s guidelines for Business Profiles forbid post office boxes and unstaffed “virtual” offices, limit a service area to roughly two hours’ drive, and say that a service-area business, one that travels to its customers, “should hide your business address from customers.” A Maryland locksmith that works from vans is licensed to a fixed business address the state insists on, and is told by the map not to show it. The license number is the one credential that survives both rules, because it can sit in the business description, on every page of the website and in the structured data, and it is the piece a fake listing cannot copy without inviting a lookup. Google’s own help page on video verification uses a locksmith as its example of a service-area business, and asks for a live recording made on a phone that shows street signs or landmarks at the business address, the tools of the trade, and proof of management, such as unlocking a branded van or showing a business permit, an invoice or a utility bill. A Maryland license and a Maryland invoice are exactly those documents.

None of this makes the platforms answerable for a fake locksmith. Federal courts have twice refused to hold search engines liable for scam locksmith listings. In Baldino’s Lock & Key v. Google, a locksmith company that works in Maryland, Virginia and the District lost in 2015, and in Marshall’s Locksmith Service v. Google in 2019, fourteen locksmith companies lost again: the federal appeals court in Washington held that Section 230 of the Communications Decency Act protected Google, Microsoft and Yahoo when their algorithms turned scam locksmiths’ addresses into map pins, though it said a search engine that made up the information itself would not be protected. That is the background to the failed 2015 bill: Maryland’s legislators tried to put the license check on the publisher, and federal law largely shields publishers from liability for what others post. What a Maryland business can control is its own side of the record, and the Federal Trade Commission has made that side stricter. Since October 21, 2024, the Trade Regulation Rule on the Use of Consumer Reviews and Testimonials has prohibited fake reviews, paying for reviews on condition that they say something positive (or, about a competitor, something negative), suppressing bad reviews with groundless legal threats or intimidation, and reviews written by owners or managers, or solicited from staff and relatives, that do not disclose the relationship. Each knowing violation can carry a civil penalty of up to $53,088 in 2026. The rule has started to bite, and close to this trade. In April 2026 the Commission proposed a settlement with a supplement seller that it had charged with violating the rule, requiring a $750,000 payment. In May 2026 the Justice Department and the State of Illinois sued B.E.S.T. GDR LLC, which does business as Premium Home Service, in federal court in Chicago, alleging that it created “thousands of individual online business profiles posing as local home repair companies” for electrical, plumbing, heating and garage-door work, deceived well over 100,000 consumers since 2018 and posted fake reviews in breach of the rule. The company has moved to dismiss, arguing among other things that the rule cannot reach conduct before it took effect, and the case is undecided. Locksmiths are not named in it, but the pattern is the one the 2017 study described.

Google has since gone to court itself. In June 2023 it sued the operators of a service that sold fake Business Profiles and reviews, which advertised that its listings would stick “including the notorious locksmith and garage repairs,” and obtained a permanent injunction in 2024. In March 2025 it filed a lawsuit in California against the operator of a locksmith business in Beltsville, Maryland, alleging more than 1,000 edits to the profiles of at least 149 businesses, concentrated in the Washington area, that turned them into locksmith listings whose leads were sold on and padded with fake reviews; the case was closed in February 2026 and the outcome is not public in the free docket. In its April 2025 summary, Google said it had removed more than 10,000 listings run by people who impersonated real locksmiths, and for 2025 it reported removing over 13 million fake Business Profiles and blocking or removing over 292 million reviews that broke its policies. The problem is not historical, and it is not far from Baltimore.

When the assistant answers instead of the map

Customers increasingly ask an assistant rather than scroll a map, and the assistants inherit the map’s weaknesses. In August 2025 the Washington Post reported that a Google AI Overview had given a traveler a scammer’s phone number for a cruise line, and that the same number turned up in ChatGPT; Google said it had taken action, and OpenAI said results can lag after abusive content is removed at the source. In September 2026 security researchers described a campaign that had seeded tens of thousands of pages to push fake support numbers for at least 374 companies into ChatGPT, Gemini and AI Overviews. We found no report of an assistant serving a fake locksmith number, but the method transfers directly to a trade whose customers dial the first number they see. Google’s guidance for its AI features says there are no extra requirements to appear in AI Overviews or AI Mode, that sites need no special AI text files or markup, and that businesses should keep their Business Profile information up to date. OpenAI’s help pages say ChatGPT’s search relies on third-party providers, Microsoft among them, and shares a user’s location with partners for things like nearby business listings. For a locksmith, that means the defense is old-fashioned: one licensed name, one fixed address, one phone number the business controls and one license number, repeated identically wherever they appear: the website, the Business Profile, every directory and every invoice, so that any machine that cross-checks sources finds the same business.

The federal layer: a registry for car keys, a radio rule for fobs, and a label for smart locks that nobody can use yet

Washington does not license locksmiths, but three federal systems now shape what a locksmith can sell and how it has to describe it. The first is about cars. The federal theft standard, FMVSS 114, requires that removing the key prevent the normal starting of the engine and either the steering or the car’s ability to move forward under its own power, and that each model have at least 1,000 different key combinations; it does not, on its plain text, require an electronic immobilizer. That gap is the subject of the lawsuits that followed the Hyundai and Kia thefts, including the one Baltimore City filed in federal court in Maryland on May 11, 2023, which was moved to California with the other cases and is still open. A national consumer class settlement won final approval on October 1, 2024.

For a locksmith, the practical gatekeeper is not the government but the automakers’ own registry. The National Automotive Service Task Force runs the Secure Data Release Model, which 38 carmakers rely on to release key codes and immobilizer data to vetted locksmiths; in May 2026 the trade publisher MOTOR reported more than 471,000 secure transactions in a year. A locksmith registers as a Vehicle Security Professional for $435 for two years, adds W-2 employees at $250 each, and has to show general liability insurance of at least $500,000 per occurrence and $1 million in aggregate, an aggregate more than three times the $300,000 Maryland requires for the license. A cheaper option for immobilizer work, $45 for each of the first five jobs a year, expressly excludes key programming. Maryland’s invoice rule sits neatly on top of this: §12.5–301 already requires the VIN on the invoice for any automotive job, and the registry wants to know whose car it is. The federal REPAIR Act, H.R. 1566, which would give independent repairers access to vehicle data, cleared a House subcommittee in February 2026; its introduced text never mentions keys or immobilizers and expressly preserves “cryptographic or technological protections” for vehicle security.

A key fob is a radio, and selling one is “marketing” it

The second system is radio law. Every remote and smart key is a radio transmitter that needs FCC equipment authorization, and under 47 CFR 2.803 “marketing” includes selling, offering for sale and “advertising for sale,” so a locksmith’s online store that lists an uncertified aftermarket remote is marketing it on the rule’s plain text. Certified devices carry an FCC ID, and because a fob is too small for a legible label, §2.925 lets the ID go in the manual and on the packaging instead. The ID is also the most useful product attribute a car-key store has, because remotes that look identical can differ inside, and the FCC ID, with the part number, is how the trade tells them apart.

The rule is tightening as this article is published. An FCC order published on September 11, 2026, and effective October 13, 2026, makes online marketplaces that warehouse, pack or ship devices for third-party sellers responsible for “marketing” them, without any need to show they knew a device was unauthorized, and requires marketplaces to display a valid FCC ID at the online point of sale, from March 1, 2027, for devices they sell or physically handle and from June 1, 2027, for listings by high-volume third-party sellers whose devices they never touch. On our reading, a locksmith’s own web store is not an online marketplace in the rule’s sense, but a locksmith who sells fobs through Amazon or eBay will see the requirement through the marketplace, and nothing stops a small store from showing the ID now. Separate orders in 2025 bar labs and certifiers controlled by “prohibited entities” from the FCC’s process and let the agency limit authorizations already granted for equipment containing covered components, so an FCC ID is a fact worth recording, not a string to copy from a supplier’s listing.

The smart-lock label that has not arrived

The third system was supposed to help with smart locks. The FCC created the U.S. Cyber Trust Mark, a voluntary security label for connected devices, in 2024, and the order that created it names smart locks as an example while excluding motor vehicles and their equipment, so, on our reading, car fobs are outside it. The White House announced the program’s launch in January 2025. Its first lead administrator, UL Solutions, withdrew in December 2025, the FCC picked the ioXt Alliance to replace it in April 2026, and the bodies that accredit testing labs were only recognized on September 28, 2026. On our reading of the FCC’s notices, no product could yet carry the mark on October 11, 2026. A locksmith selling smart locks therefore cannot point to a federal security label, and the facts a customer can actually check are the lock’s grade under the residential lock standard from the Builders Hardware Manufacturers Association, the platforms it works with and how long its maker promises updates.

One older federal rule reaches the doors a commercial locksmith works on. The 2010 ADA Standards require door hardware at public accommodations to be operable with one hand, without “tight grasping, pinching, or twisting of the wrist,” at no more than five pounds of force (§309.4), and to sit between 34 and 48 inches above the floor (§404.2.7). Maryland’s Act adds its own hook: a licensed locksmith may not “willfully or deliberately disregard any building or safety laws” (§12.5–502), which ties the hardware chosen for a shop door to the accessibility and fire codes as well as to the customer’s order. And for key copies, the only federal duplication crime we found is about postal locks: 18 U.S.C. §1704 makes it a crime to make, forge or counterfeit keys to Postal Service locks and mail receptacles.

Lockouts, landlords and the other Maryland rules a locksmith’s job touches

The Locksmiths Act is not the only Maryland law that reaches the job record. A common way for a locksmith to end up on the wrong side of a dispute is a lock change ordered by someone with the wrong kind of authority. Under Real Property §8–216, a landlord “may not take possession or threaten to take possession of a dwelling unit from a tenant or tenant holding over by locking the tenant out,” and a tenant who is locked out can recover actual damages plus reasonable attorney’s fees and costs. The statute does allow temporary measures, “including changing the locks,” to secure a property that has been left unsecured, if the landlord makes good-faith attempts to tell the tenant how to get back in. Baltimore City’s public local laws go further: under §9–15, a landlord who changes the locks and fails to give the tenant new keys commits a misdemeanor punishable by up to $500 or ten days in jail for each offense. The same risk runs through work for banks and servicers. In 2015, according to a law firm’s summary of the Attorney General’s announcement, an Ohio mortgage field-services company agreed to pay $167,000 in restitution over vendors who allegedly locked Maryland residents out of homes in default or foreclosure. A job record that says who ordered the change, in what capacity, whether the home was occupied and who received the new keys is the locksmith’s best evidence when the question comes up later.

One kind of lock change has a deadline written into law. Under Real Property §8–5A–05, a tenant protected by a protective order or peace order that requires the abuser to stay away or to vacate can ask the landlord in writing to change the locks, and the landlord must do it “by the close of the next business day.” If the landlord does not, the tenant may have the locks changed by “a certified locksmith” without the landlord’s permission and must give the landlord a duplicate key by the close of the next business day; the landlord must hand over a copy of the new key within 48 hours of a change it made and may charge no more than the reasonable cost, which the tenant has 45 days to pay. Maryland does not certify locksmiths; it licenses locksmith businesses, so on our reading a licensed one is the safe choice. For a dispatch system this is a job type with its own clock and its own paperwork, and it is the kind of call where speed and discretion matter more than anything else on the invoice.

Baltimore City’s building codes set the floor for the hardware itself. The City’s property maintenance code, Part VII of the Building, Fire, and Related Codes, requires that “locks and latching hardware must be provided at all entrances to dwelling units and rooming units and must tightly secure the doors at those entrances,” except where the rules for exit doors say otherwise, and adopts the model code’s building-security section. For the 11,394 vacant buildings with open notices, the City’s codes require every opening to be “closed, securely locked, and, if readily accessible, boarded up with substantial material.” The state’s fire prevention code adopts the 2024 editions of the NFPA fire and life safety codes, which govern locks on exit doors, and, as noted above, the Locksmiths Act forbids a licensee to disregard them. A double-cylinder deadbolt on the only exit from an apartment is a price on a quote and a code question at the same time.

Maryland has repeatedly declined to regulate car keys. Bills in 2004 to require identification and proof of ownership before cutting an ignition key, in 2005 to make locksmiths keep records of every key cut from a VIN or key code for two years, and in 2007 to give “registered locksmiths” access to replacement-key information all failed; the 2007 Senate bill passed 38 to 9 and died in the House. What remains is the Act’s VIN field on the invoice and the automakers’ own registry. The criminal law reaches tools only through intent: a “picklock” or a key is a burglar’s tool under Criminal Law §6–201, and possessing one with intent to use it in a burglary is fourth-degree burglary, punishable by up to three years, under §6–205. Bills to criminalize possessing the Postal Service’s “arrow key” for apartment mailboxes passed one chamber in 2024, 2025 and 2026 but were not enacted.

The sales tax splits a locksmith’s work into at least three treatments, and an invoice that does not split them will be wrong somewhere. On our reading, cutting a key is fabrication on special order, and under COMAR 03.06.01.30 the 6% tax applies to “the full selling price” even when the labor is listed separately. A lock sold over the counter is taxable, but installation labor stated separately is not. Hardware that becomes part of a building is treated as real property under the contractor rule in COMAR 03.06.01.19, which names doors and windows among the items that become realty; on our reading, a locksmith installing a deadbolt is acting as a contractor, paying the tax when it buys the hardware and charging the customer none. Rekeying labor is not on the list of taxable services, and we found no Comptroller guidance on rekeying or on programming a car key. Work that counts as a “security systems service” is taxable at 6%, so whether an access-control job is locksmithing or a security system changes the tax as well as the license. And since July 1, 2025, the software a locksmith runs its business on has been taxed at 3% when it is bought for use in a business’s own systems, under the rules explained in Comptroller’s Technical Bulletin 56 and our guide to Maryland’s tech tax.

Two boundaries are less settled. The Maryland Home Improvement Commission licenses anyone who repairs or replaces part of a building used as a home, and its law exempts licensed security systems technicians but not locksmiths; we found no guidance on whether replacing a lock on a single-family house is home improvement, so a locksmith that also hangs doors may want to ask the Commission before quoting that work. And the Security Systems Technicians Act, which our article on alarm company software covers in detail, never defines “security system”; the Locksmiths Act covers “mechanical, electrical, or electromechanical locking devices” and lets licensed security technicians install locks without a locksmith license, but the reverse is not written down. Finally, Maryland’s price-gouging law, Public Safety §14–1301 and following, applies only during a state of emergency declared by the Governor, to goods and services the Governor designates, and forbids charging 15% or more above the highest price charged in the 60 to 4 days before the declaration, with repair and cleanup services covered for 90 days after the emergency ends.

Baltimore’s locksmith websites, and what they tell customers and machines

To see how the Act and the map meet in practice, we read the websites of every locksmith business we could find that claims to serve Baltimore City or Baltimore County. We started from OpenStreetMap, which lists only ten locksmith businesses in the two jurisdictions, three of them with a website, and added the businesses that appeared in 16 web searches such as “locksmith Baltimore MD,” “car key replacement Baltimore” and “locksmith Towson MD,” plus names from the Better Business Bureau’s Baltimore locksmith listings. That gave us 51 businesses with websites, two of them national referral services and one a franchise, of which 50 could be read on October 11, 2026. We read each homepage and up to nine of its key pages, without calling or booking anything.

The license number is the clearest result. Thirty-three of the fifty sites call themselves licensed, and 16 show a Maryland locksmith license number; one shows two different ones. Three show other credentials, such as a number from Virginia’s Department of Criminal Justice Services or the Maryland Home Improvement Commission. We tried to check the displayed numbers against the state’s online license search, which offers lookups by business name, location and license number, but from our connection it timed out on every one of seven attempts that day, so we cannot say how many of the numbers are current. The point stands without the check: on 34 of the 50 sites, a customer reading the page cannot find the one number Maryland requires every locksmith advertisement to carry.

Addresses tell a similar story. Thirty-two sites give a street address, 27 of them in Baltimore City or Baltimore County, and eight of those 27 describe the address as a dispatch point rather than a shop. Seven of the 27 belong to businesses that also appear on OpenStreetMap as locksmiths, which proves nothing on its own but is the kind of cross-check an AI assistant or a careful customer can make. Eighteen sites show no street address at all, only a city, a ZIP code or nothing, and one site’s dispatch address puts a Baltimore County ZIP code in “Atlanta, MD.” None of this means a business is unlicensed or dishonest. It means that the page does not let anyone check.

Prices are scarce, and where they appear they tend to be either honest and specific or a hook. Eight sites publish prices of their own. Three of the eight lead with a $19 or $29 “service call,” the kind of figure the 2013 complaints described and one of the national referral sites in our list warns against as “$19 that becomes $250.” The others show what a usable price list looks like. Easter’s Lock & Security, which has a shop on East Joppa Road and shows its Maryland locksmith license number, lists a vehicle lockout at $52 plus a trip charge, a transponder key copy at $85 in the shop only, and a replacement key when all keys are lost at $280 plus the trip charge. Mico Locksmith, which also shows its license number, publishes the fullest table we found: rekeying at $35 to $65 a lock, a car lockout at $49 to $99, a house lockout from $85, transponder programming at $100 to $180 and master key systems at $200 to $500, with a note that prices vary.

Most of the selling still happens on the phone. Forty-four sites promise service around the clock and 21 promise to arrive within a stated number of minutes, most often 15 or 30, yet only one lets a customer book through a scheduling tool, a Workiz booking page; the other sites rely on a contact form or the phone number. Nine sites use the words “book online” or “schedule” without a booking tool behind them. None has a working store for keys, fobs, locks or safes, although one carries the code of an online cart that sells nothing. What machines can read is thin as well: 33 sites carry some structured data, 21 describe themselves as a business and 13 as a Locksmith; nine serve an llms.txt file, three of them generated by an SEO plugin; and one blocks AI crawlers.

Some of the sites follow patterns that suggest lead generation rather than a local shop. Two are national referral services with hundreds or thousands of city pages and toll-free numbers. Six are one-town sites, for places such as Dundalk, Catonsville and Middle River, that share the same title format, the same six- or seven-page structure, copyright years from 2018 or 2022 and, mostly, an address described as a dispatch point. Two more, both showing a 2012 copyright, share large blocks of text and carry 80 to 100 town pages each. We did not try to find out who runs them, and a licensed Maryland locksmith may sit behind any of them. The difficulty is that a customer cannot tell either, which is what §12.5–401 was written to fix.

Several businesses in our Baltimore sample do what the law and the map both reward. Advanced Security Safe and Lock lists four shops, each also on OpenStreetMap, shows its license number linked to the state’s licensing page, and publishes Locksmith structured data and an llms.txt file. Mega Lock and Key says plainly that it is mobile only rather than implying a storefront, and repeats its license number. Baltimore Lock & Hardware has a storefront on Falls Road that matches the map, and Liberty Lock & Security, based in Rockville, lists its Maryland locksmith license, its Virginia DCJS number and its Maryland home improvement license side by side, with price ranges for automatic door operators.

What 152 locksmith websites across the country show

To see whether Baltimore is unusual, we drew a national sample. OpenStreetMap lists 928 locksmiths in the United States, 364 of them with a website; leaving out Maryland and duplicates, those listings point to 331 distinct domains, from which we drew 180 at random and read the 152 that still worked, in 34 states, on October 11, 2026; four of them turned out not to be locksmiths, and we kept them in the counts. We read each homepage and the pricing, booking and store pages linked from it, without calling or booking anything. The sample leans toward the businesses that bothered to put themselves on an open map, which probably flatters the trade.

The first thing the sample shows is how broad a locksmith’s work has become. Four in five of these sites offer car keys, three in five work on safes, and three in five sell some form of access control, from card readers to keyless entry and intercoms; two in five design master key systems for buildings. The second is how little of that work is priced in public. Only 12 of the 152 sites publish a price for any service within one click of the homepage, and only five put one on the homepage itself. Where a lockout price is published, the lowest figure has a median of $75, or $80 once a stated service-call fee is added; the service-call or trip fees that sites list run from $0 to $90, with a median of $45; rekeying starts at a median of $27 a lock, and a transponder car key at $105. One homepage spends its space warning customers about internet locksmiths with “$19 or $15” service fees. The bait price has become something honest locksmiths advertise against.

Licensing shows up as a word more often than as a number. Sixty sites say they are licensed, 36 say bonded and 50 say insured, but only 19 print a locksmith or local license number anywhere we looked. Where a state licenses locksmiths, the habit varies: six of the 11 Texas sites and five of the seven in Illinois print a license number, and four of the 25 in California. The trade associations barely appear. Eight sites mention the Associated Locksmiths of America, two mention the automotive security registry NASTF, and none mentions the registry’s “VSP” credential by name. A few businesses do this well. Omega Locksmith in Illinois names its licensed locksmith, prints the license number and invites customers to check it; Rhinox Locksmith in Las Vegas publishes a flat $45 service-call fee, price ranges for each job and its license number; East Portland Locksmith lists a flat $95 weekday car lockout; and Okey Locksmith in Oklahoma City sets its $65 business-hours service call next to its other prices.

The stores are almost absent. Three of the 152 sites sell keys, fobs, locks or safes with a working checkout; five more show product catalogs with no way to buy. Fradon Lock in Syracuse, New York, is the clearest exception, with locks, safes and keys in its own BigCommerce store and an eBay store beside it. Online booking is nearly as rare: nine sites let a customer book or request a job online, six of them through a third-party widget from Housecall Pro, Workiz, Jobber or Wix Bookings. For a trade whose customers search in a hurry, almost all of the selling still happens on the phone.

What machines can read is a mix of automation and neglect. Eighty sites describe themselves in schema.org structured data as a Locksmith or a LocalBusiness, 46 of them with the specific Locksmith type, and 39 fill in a price range, though 31 of those use only dollar signs and three still carry a template placeholder reading “$0 - $000.” Fifty-six sites serve an llms.txt file for AI assistants, but 46 of those were generated by the site builder or an SEO plugin, including every site on Duda and Wix in the sample; only four sites block any AI crawler by name. Ten of the 152 sites, in six states, run on the same hand-coded template with city-named domains, and three of them give a “dispatch point” instead of a street address. We cannot tell from the outside whether they are one company, a franchise or the customers of one web vendor, but a dispatch point is not the kind of fixed business address Maryland licenses.

Last, the decay. Twenty-eight of the 180 domains we sampled, 15.6%, no longer worked as the locksmith’s website. Twelve were no longer registered to anyone, one was pending deletion and one was still registered but no longer resolved, three were parked, three now served gambling pages, two belonged to unrelated businesses and six returned errors or empty pages. Some of that is the map’s lag, since the listing outlives the business. But a lapsed domain on a locksmith listing is a gift to whoever registers it next, and for a trade whose customers dial the first number they see, the name on the domain is part of the security.

How to sell keys, fobs, locks and lockouts online when the van is the store

A locksmith already runs a store; it just runs it out of a van and over the phone. Hardware, safes and key cutting together bring in about a third of the industry’s revenue, and every lockout, rekey and car key is a product with a price. Yet none of the 50 Baltimore sites we read sells anything through a working online store, and only three of the 152 across the country sell keys, fobs, locks or safes that way. Online, the trade is a phone number and a contact form. That is the gap we would build into, and in Maryland it has a legal edge: a booking made at a published price on the locksmith’s own site is, on our reading, a written quote made before the customer agreed, which is exactly the record §12.5–301 wants on the invoice.

The price list is the first product

The store starts with services, not goods. A lockout priced by time of day, a rekey priced per cylinder with the trip charge shown, a lock change priced by grade, a car key priced by make, model and year and by whether any working key survives: each can be a product with a price the customer sees before booking, and each booking can store that price as the quote. Ranges are honest when the job cannot be judged until the door is in front of you, as Mico Locksmith’s table shows; a $19 “service call” is not a price, and Google’s own rules for advertisers say a flat-rate offer has to explain what it includes and excludes. The same price list can feed the structured data on the page. Most of the locksmith sites in our national sample that filled in schema.org’s price range field used nothing but dollar signs; a locksmith with a real price list can publish real offers instead.

A car key is a product with an FCC ID

Car keys and remotes are among the trade’s most valuable goods and the hardest to list, because two remotes that look the same may not work in the same car. The product record needs the fields the trade actually uses: the FCC ID, the automaker’s part number, the frequency, the transponder chip, the number of buttons, the blade, and the years, makes and models it fits. We looked at how five established US online stores list the same item, a four-button smart key for recent Toyota Camrys, and the result is a useful map of what to copy and what to fix.

None of the five programs the key as part of the sale, and the three that sell to the public send buyers to a dealer or a local automotive locksmith to finish the job, which is the opening for a Baltimore shop: sell the remote as a product and the programming as a booked service. Google’s rules for compatible and refurbished third-party products point the same way the table does. An aftermarket remote should carry its real maker’s brand and part number, never the carmaker’s, with a title that starts with “compatible” or the maker’s name; a refurbished original carries the carmaker’s identifiers and the condition “refurbished”; and one product should be one listing, with the years it fits in its description, rather than a duplicate for every model year. Google lists replacement parts among the products that often have no barcode number and asks for the brand and part number instead, so nothing should be invented to fill the gap. The FCC ID matters twice, because selling an unauthorized remote is unlawful “marketing” under 47 CFR 2.803 and because marketplaces must show the ID at the point of sale from 2027; a store that records it from the device or its packaging, rather than copying it from a supplier’s listing, is ready for both. The checkout then has to say how the key will become a working key: shipped for the customer to program, if the car allows it; cut and programmed at the shop; or brought to the car by a technician, in which case the order captures the VIN for the invoice and the proof of ownership that the automaker registry expects. Cut and programmed keys usually cannot be resold, so the return policy has to say so before payment, not after.

Some keys are sold to a list, not to a cart

The most valuable keys a commercial locksmith handles are the ones that should not be for sale to just anyone. High-security and restricted key systems are protected by their manufacturers through patented keyways and dealer agreements, and new keys are cut only for people on the building owner’s authorization list. Patents and contracts do most of this work, not laws on copying keys. Schlage’s Everest 29 keyway is protected by a utility patent until February 18, 2029, while the patent on its Primus XP keyway ran out in 2024; BEST says its CORMAX system is patented through 2027 and CORMAX+ until June 2043; and Medeco sells its newest system on the strength of a patented key that only its authorized dealers can cut. A stamp that says “Do Not Duplicate” has legal force in few places. California’s locksmith law, Business and Professions Code §6980.54, forbids a licensed locksmith to copy a key stamped “Do Not Duplicate” or “Unlawful To Duplicate” when it also carries the originator’s company name and telephone number, and KeyMe’s kiosk terms adopt the same wording nationwide; we found no Maryland law on the point, and Maryland’s Act exempts key duplication from the license altogether. An online store for a locksmith with commercial clients therefore needs a second kind of customer account: the property manager or facilities office that holds the authorization, the named people allowed to order, and a record of every key cut, so that “who has a key to the server room” has an answer.

Federal law draws a similar line for tools. Under 39 U.S.C. §3002a, a “locksmithing device,” meaning a tool other than a key designed to manipulate a lock’s tumblers through the keyway, to open or bypass a lock without authorization, or to take an impression of a key to copy it, is nonmailable unless it is mailed to a lock manufacturer or distributor, a bona fide locksmith, a bona fide repossessor or a motor vehicle manufacturer or dealer; §3002 bars motor vehicle master keys, and advertisements for them, from the mail except where the Postal Service exempts them, as it does for locksmiths and car dealers. The marketplaces go further. Amazon’s policy permits blank keys but prohibits lock picks, tension bars, try-out keys and devices designed to duplicate a key, and eBay’s bans lock-picking and locksmithing devices, bump keys included. Google’s Shopping policies do not name lock picks, but they bar products that enable dishonest behavior under a list that is explicitly not exhaustive, and they do not allow services at all, even services bundled with goods, so a lockout, a rekey or a “remote plus programming” package cannot be a Shopping listing. A locksmith that sells tools to other locksmiths has to verify who is buying, which a generic store builder does not do.

Smart locks: sell the grade, the platform and the support

Smart locks are where the trade’s store and the trade’s license meet. Installing one is a locksmith service under Maryland’s definition, which covers electrical and electromechanical locking devices, and the sales tax depends on whether the lock is sold over the counter or becomes part of the building, so the cart has to know which. What a customer can check is limited. The federal Cyber Trust Mark has not yet reached a single product, so the facts worth putting on the page start with the lock’s grade under the Builders Hardware Manufacturers Association’s residential standard, which grades deadbolts separately for durability, security and finish, from A down to C, and lets only products in its Certified Products Directory carry the mark. After the grade come the phones and home platforms the lock works with, including whether it supports Aliro, the phone-wallet digital key standard the Connectivity Standards Alliance released on February 26, 2026; how many digital keys and access codes it holds; what happens when its batteries die; and how long its maker promises security updates. In Lithuania and the rest of the European Union, smart door locks become regulated “important products” under the Cyber Resilience Act from December 2027, and a shop that sells them has duties of its own, which we come back to below.

What Google and AI assistants can read about a locksmith

A search engine or an AI assistant answering “locksmith near me” in Baltimore is weighing the same facts a customer would, if the page lets it. schema.org has a Locksmith type, a kind of local business, with fields for the address, the area served, opening hours and prices, and Organization data can carry a credential, which is where a Maryland license number belongs, with the Department of Labor named as the body that recognizes it. Only 13 of the 50 Baltimore sites we read describe themselves as a Locksmith in structured data, and none of the 50 runs a store whose products and prices a shopping engine could read. Shopping assistants are now built to buy as well as to show, which makes the gap more expensive. Google’s new checkout in AI Mode and Gemini lets selected merchants sell through a “Buy” button while remaining the seller of record, but its rules exclude refurbished goods, final-sale items, products that need installation, freight and services, which covers most of what a locksmith sells; a new, returnable smart lock, padlock or safe that ships normally qualifies, a programmed key does not. OpenAI stepped back in 2026 from completing purchases inside ChatGPT and now mostly sends shoppers to the merchant’s own checkout, ranking merchants partly on availability, price and whether they are the maker or the primary seller. Google’s own documentation for local business data also shows the address problem from the other side: it uses Locksmith in its example, requires an address and does not list a property for a service area, so a mobile locksmith that hides its address on the map has less to put in its markup than a shop with a counter.

An llms.txt file, a plain-text summary of a site written for language models, is cheap to publish and some AI tools may read it, although Google says sites need no special AI text files to appear in its AI features. Most locksmiths who have one did not write it: in our national sample, the great majority of the files we found were generated automatically by a site builder or an SEO plugin, which means they list pages rather than say anything about licenses, prices or the area served. A short file that a person wrote, naming the licensed business, its license number, its fixed address, the services it offers with their prices and the areas it covers, is the cheapest piece of AI-search optimization a locksmith can do, and it costs nothing to keep current if the price list is already data.

A note for readers in Lithuania

Part of our team works from Lithuania, where the trade has no license at all. Lithuania’s Police Department told the news site tv3.lt in 2019 that emergency door opening is not a licensed activity, and in a 2023 article on the same site a Vilnius firm noted that, unlike some American states and several Western and Northern European countries, Lithuania requires none, and that picks and other tools are sold freely. The trade has written its own rules instead. One Vilnius company asks for an identity document and an extract from the Centre of Registers, the property register, on which at least the surname must match, and for a car the registration certificate; another wants ownership or rental papers and otherwise calls the police and waits for them; a third will accept documents after the door is open if they are locked inside, and asks the neighbors. That is a private, uneven version of what Maryland’s invoice and license try to make standard. In the 2019 report, a Vilnius tenant paid €50 to have a wooden door opened and was asked for nothing.

The bait looks the same in both countries. The 2023 article quotes firms putting a typical emergency opening at €50 to €250, or €60 to €150, and warns about advertisers who promise opening “from €20” and demand hundreds of euros on the doorstep. Marketplace prices are lower: the services site Paslaugos.lt shows starting prices of about €10 to €50 for an emergency opening in Vilnius and Kaunas and €20 to €50 for a key. Car keys are where the money is: a Vilnius car-key shop, Raktų pasaulis, posted on October 9, 2026, that it had made and programmed a spare keyless key for a 2019 Volkswagen T-Roc for €250, and a Kaunas competitor says dealer keys start at €200 and sometimes reach €1,000. As in Baltimore, most Lithuanian locksmith sites publish no price list, and we found only one running a real online store.

Europe has fought fake locksmiths mostly through advertising and fines rather than through the map. Google stopped running locksmith search ads in the Netherlands, Belgium, Germany and Sweden in February 2021 and in Spain from November 2024, and its local services ad policy still lists those countries as closed to them. In 2022 the Dutch consumer authority fined a firm that posed as local locksmiths with fake reviews and no price up front, and the Dutch domain registry deleted its domains. Google Maps has been a “very large online platform” under the EU’s Digital Services Act since April 2023, and the Act gives anyone a way to report illegal content and lets national regulators appoint “trusted flaggers” whose reports are handled first; in Lithuania that regulator is the Communications Regulatory Authority (RRT). On our reading, though, the Act’s rules on checking the identity of traders apply to marketplaces where consumers sign contracts, not to an ordinary map listing.

The newest rules concern what a lock shop sells online. Under the Cyber Resilience Act, “smart home products with security functionalities, including smart door locks” are “important products” in Class I of Annex III. Manufacturers’ duties to report actively exploited vulnerabilities began on September 11, 2026, and the Act applies in full from December 11, 2027, when the cybersecurity rules made under the radio equipment directive are repealed in its favor. From then, a shop that sells smart locks must check the CE marking and the manufacturer’s documentation before selling, must not sell a lock it has reason to think does not conform, and must alert the authorities to a significant risk; a shop that sells them under its own brand becomes the manufacturer. Since December 13, 2024, the General Product Safety Regulation has also required every online offer to show the manufacturer’s name and its postal and electronic addresses, a picture and identifier of the product and any warnings in the local language; one Lithuanian lock shop’s product page we read showed the brand but no manufacturer address. VAT on locksmith work and hardware is the standard 21%. And a customer who calls a locksmith out for an urgent repair has no 14-day right to cancel the repair itself, under Article 16(h) of the Consumer Rights Directive and the matching article of Lithuania’s Civil Code, so in Vilnius as in Baltimore it is the quoted price and the paperwork that protect them.

What custom actually costs, and when it pays

We price every project at a fixed fee, agreed before we start, and publish the starting points on our pricing page. For a Baltimore locksmith, the packages map onto this article like this.

Most of our projects land between $6,000 and $30,000, and none requires you to give up a field-service app, a key machine, a programmer subscription or an accounting package that already works; the demos page shows finished work. In Maryland, the state’s 3% tax on software and IT services applies to a custom build, so the Online Store package starts at $6,180 with tax.

Whether it pays is mostly arithmetic, and for the smallest shops the honest answer is often that it does not. A one-van locksmith that gets most of its work from repeat customers and a few property managers needs a good field-service app and a website that tells the truth, and no custom software at all. The case changes with paid leads. In our model, the 60 jobs a month bought through leads cost between about $1,964 and $6,327. If a store and booking page with published prices moved 15 of those jobs a month to direct bookings, then at the agencies’ median of about $58 of lead cost per booked job the shop would keep about $870 a month, or roughly $10,500 a year, and the Online Store package at $6,180 with tax would pay for itself in about seven months, with hosting and maintenance as a much smaller running cost. For a shop with commercial accounts, the value is in the key-control record and the invoices rather than in leads, and it is harder to put a number on.

What we would build for a Baltimore locksmith

If a Baltimore locksmith asked us to fix the problems in this article without replacing anything that already works, this is what we would build, roughly in this order.

• A price book kept as data. Every service with a price, a trip charge that depends on distance and hour, and the parts each job usually needs, so the same numbers appear on the website, in the online store, in the quote read out on the phone, in the confirmation text and on the invoice, and a flat-rate offer always says what it includes and excludes.
• A job record that is a Maryland invoice. The service address, the lock type, the VIN on automotive jobs, the quote given before the customer agreed and the amount actually paid, captured as the job happens rather than reconstructed later; any change to the price recorded and approved before the extra work; three years of retention; and a copy with the license number that can go to a police department within the two business days the law allows for electronic copies.
• A check before the door opens. The customer’s identification and proof that they live there or own the car, photographed and attached to the job before a lock is opened or a key is made, with the key code lookup logged against the job and the technician who made it.
• A credentials register with clocks. The business license and its two-year term, the insurance policy and its cancellation notice, each technician’s photo ID card and background check, the automotive registry credentials, and any security systems license, each with a reminder far enough ahead to act on.
• A store that sells the trade’s real products. Car keys and remotes cataloged by FCC ID, part number, frequency, chip and fit, with the programming option chosen at checkout; locks and safes with their grades; unrestricted key copies by mail; restricted keys only for the people on a client’s authorization list; and services booked online at the published price.
• One set of facts for people and machines. The licensed name, license number, fixed address, hours and service area published the same way on every page, in Locksmith structured data and in a short llms.txt somebody actually wrote, so that a search engine or an AI assistant that reads the site finds the same business a customer finds on the doorstep.

For a locksmith who already runs a field-service app, most of this sits beside it rather than replacing it. The dispatch board, the payment processor, the key programmer and the accounting package stay where they are; the price book, the invoice fields, the identity check, the credentials register, the store and the published facts are the parts we would build and hand over to you to own.

Build, buy, or leave it alone

Most small locksmiths should buy their field-service app, and many should keep the one they have. A one- or two-van shop is well served by ServiceM8, Jobber, Housecall Pro or one of their competitors at somewhere between $29 and $250 a month, and on our arithmetic the app is one of the smallest lines in the monthly bill; there is no software we could write that would be cheaper to own at that size. The people behind these products know how a mobile trade works, and their dispatch boards, payment links and reminders do the core job well. Choose by the meter, per job, per user, per van or flat, not by the logo, and treat the programmer subscription, the key-code fees, the card processor and the lead sources as part of the same decision, because together they cost far more than the app.

Then ask every vendor six questions, in writing, before you sign or renew. Can the job record hold the five things a Maryland invoice must show, the service address, the lock type, the VIN, the price quoted before the customer agreed and the price paid, as required fields, and print them on the invoice? Can it print my license number on every quote, invoice, email, booking page and receipt? Can I export any invoice, with the license number on it, within the two business days the law allows when a police department asks, and export every record whenever I like? Does your booking page show my published prices, and does it record the price the customer saw when they booked? Can a technician attach a photo of the customer’s identification and proof of residence or ownership to the job, and can I choose how long those photos are kept? And does your review-request feature ask every customer the same way, without filtering out the unhappy ones or rewarding the happy ones? A vendor that answers all six well has earned the renewal.

If you work mostly on cars, keep the programmer that suits the makes you see, and do the token arithmetic every year: above about 15 to 18 tokens a month, an unlimited plan beats buying tokens in packs, and below that it does not. Keep your NASTF registration current for every technician who pulls codes, and make sure each lookup is tied to a job with a VIN and an owner. If you do commercial and institutional work, which is where most of a Maryland locksmith’s revenue comes from, the asset worth protecting is the record of which keys exist, who holds them and who may order more, and that record should belong to you, not to a vendor’s database. If most of your calls come from paid leads, the money is in the lead line, not the software line: a website that ranks, answers questions honestly and takes a booking at a published price is the one piece of software that can make that line shrink.

Leave alone what is cheap and works: the key machine, the programmer you know, the card processor if its rate is good, the accounting package. Build the few things listed above, which no platform we read sells to a Baltimore locksmith in a form the locksmith controls. Our guide to custom software in Baltimore explains how we work, our article on alarm company software covers the security systems license that electronic access control can bring with it, and our guide to Maryland’s privacy law for online stores covers what a file of customers’ addresses, IDs and VINs brings with it. If you want to find out which of these would pay for you, bring us a month of jobs and your price list, and we will show you.

Questions Baltimore locksmiths and their customers ask us

What is the best software for a locksmith business?

There is no single best one; there is a best meter for your size. The best-known dispatch and invoicing apps sold to locksmiths are general field-service software rather than locksmith software: ServiceM8 charges by the job ($79 a month for 150 jobs), Jobber and Housecall Pro by the user (about $189 to $199 a month for up to five users on monthly billing), and Service Fusion a flat fee with unlimited users; Workiz, which markets heavily to locksmiths, does not publish its prices. Whatever you choose, check that its job record can hold the five things a Maryland invoice must show and print your license number everywhere, and treat the key programmer, key-code fees and lead sources as part of the same decision, because they usually cost more than the app.

How much does locksmith software cost?

On October 11, 2026, published prices for the field-service apps locksmiths use ran from $29 a month (ServiceM8, 50 jobs) to $627 a month (Service Fusion Pro), and in our model a three-person shop pays $79 to $245. Locksmith-specific programs are cheaper: Treskat sells six for $180 a year and InstaCode key-code data starts at $13.50 a month per device. The larger costs are elsewhere: a key programmer’s tokens or subscription, about $277 to $459 a month in our model of a three-van shop; the automaker registry at $435 for two years; card processing; and paid leads, which marketing agencies put at about $18 to $58 each for locksmiths.

Do locksmiths need a license in Maryland?

Yes. Under the Maryland Locksmiths Act, Business Regulation Title 12.5, a business must be licensed by the Maryland Department of Labor before it or its employees provide locksmith services in the state, which includes rekeying, installing or repairing locks, safes and electronic locks and opening them by other than the intended means. The license costs $225 and lasts two years, cannot be renewed once it has expired, is tied to a fixed business address that cannot be a vehicle, hotel room or post office box, and requires $300,000 of liability insurance and fingerprint background checks for the owner and every employee. Key duplication is exempt. Baltimore City has no separate locksmith license, and we found none in Baltimore County.

How can I check whether a Maryland locksmith is licensed?

Look for the license number, which Maryland requires in every locksmith advertisement and business card and on the photo identification card that every technician must carry, and then search it in the Maryland Department of Labor’s locksmith license database, which lists licensed businesses and the employees registered under them. Ask for the price before work starts, because Maryland requires the quoted price and the actual price to appear on the invoice. In our October 2026 census, 16 of 50 Baltimore locksmith websites showed a Maryland license number, while 33 used the word “licensed.”

What must a locksmith invoice include in Maryland?

Under Business Regulation §12.5–301, every invoice or receipt for a service call must show the address where the work was done, the type of lock serviced, the vehicle identification number if a vehicle was involved, the price quoted to the customer before they agreed to the work and the actual price paid. The Department of Labor also expects the license number on it. Licensed locksmiths must keep invoices for three years at their fixed business address and send a copy to a police department or the Department of Labor on request, within two business days if sent electronically or five by mail.

How do I know if a locksmith is legitimate?

Be wary of a price that seems too low to be real, such as a $19 or $29 “service call,” a website that shows neither a street address nor a license number, and anyone who will not give a total price before starting or who wants to drill a standard lock straight away. A legitimate Maryland locksmith shows its license number, carries a photo ID card with that number, gives a price before work and puts that quoted price on the invoice next to the final one. Research by Google and the University of California, San Diego found that locksmiths made up 43.9% of the abusive U.S. listings that appeared on Google Maps in 2014 and 2015 and were later suspended, so a map listing on its own proves little.

Why does Google treat locksmiths differently?

Because the trade has a long history of fake listings. Google requires locksmiths to pass Advanced Verification before running search ads in the United States and Canada, does not allow locksmith ads at all in several European countries, and treats locksmiths as an urgent category in Local Services Ads, with background checks on the business, the owner and every technician, insurance checks and a state license where one is required. For free Business Profiles, Google may ask for a live video showing the business’s location, tools and proof of management, and tells businesses that serve customers at their homes to hide their address.

How much does a locksmith charge to program a key fob in Baltimore?

Prices vary by car and by whether you still have a working key. Two Baltimore locksmiths that publish prices list programming a transponder key at $100 to $180, copying a transponder key in the shop at $85, a remote head key at $160 plus a trip charge, and making a key when all keys are lost at $280 plus a trip charge. Across our national sample of locksmith websites, the lowest published price for a transponder car key had a median of $105. The price depends on the locksmith’s programmer, the automaker’s fees and whether the car’s security system needs an online code.

Is it illegal to copy a key stamped “Do Not Duplicate”?

In Maryland, not as far as we can find: no Maryland statute gives the stamp legal force, and the Maryland Locksmiths Act exempts key duplication from its license. California is the clearest exception: its locksmith law, Business and Professions Code §6980.54, forbids a licensed locksmith to copy a key stamped “Do Not Duplicate” or “Unlawful To Duplicate” when the key also carries the originator’s company name and telephone number, and services such as KeyMe’s kiosks refuse such keys under their own terms. Real key control comes from restricted keyways protected by patents and dealer agreements, such as Schlage Everest 29 (patented until 2029) or BEST CORMAX (through 2027), whose keys can be cut only by an authorized dealer for people on the owner’s list.

Can a landlord change the locks on a tenant in Maryland?

Not to force a tenant out. Real Property §8–216 forbids a landlord to take possession of a home by locking the tenant out, and a tenant can recover damages and attorney’s fees; in Baltimore City, changing the locks without giving the tenant new keys is also a misdemeanor punishable by up to $500 or ten days in jail per offense. A landlord may change locks temporarily to secure an unsecured property if it tries in good faith to tell the tenant how to get back in. Separately, a tenant with a protective or peace order can require the landlord to change the locks by the close of the next business day after a written request.

What is a NASTF VSP, and does a locksmith need one?

A Vehicle Security Professional is a locksmith registered with the National Automotive Service Task Force’s Secure Data Release Model, which 38 automakers use to release key codes and immobilizer information. Registration costs $435 for two years for a primary account and $250 for each W-2 employee added, and requires a background review and general liability insurance of at least $500,000 per occurrence and $1 million in aggregate. A locksmith who makes car keys from codes for newer vehicles generally needs one; Maryland’s license is a separate requirement.

Can a locksmith sell car keys and remotes online?

Yes, but a remote or smart key is a radio transmitter, and under FCC rules (47 CFR 2.803) offering an unauthorized one for sale counts as marketing it, which is prohibited. Sell only remotes with a valid FCC ID and show that ID on the product page, along with the part number, frequency, chip and the years, makes and models it fits. From 2027, an FCC order effective October 13, 2026, requires online marketplaces to display the FCC ID at the point of sale. Car keys still have to be cut and programmed to the car, so a locksmith’s store should offer them with a choice of shipping, an in-shop appointment or a mobile visit.

How much does it cost to build custom locksmith software or an online store?

At founderandai, a one-week working prototype costs $3,500; an online store on your own domain that sells keys, remotes, locks and bookable services at published prices, with your license number, structured data and Maryland’s invoice fields built in, starts at $6,000; and a technician app or an operations system that tracks licenses, insurance, key control and dispatch starts at $12,000, all at fixed prices. Maryland’s 3% tax on software services applies to custom builds. For most small locksmiths the case for building rests on reducing paid leads and owning the customer record, not on replacing a field-service app.