IoT Smart Door Lock with Fingerprint, RFID and Temporary OTP Access

House keys get lost, copied and shared; biometric and RFID readers fix that, but a single credential becomes a single point of failure — one dead sensor or one forgotten card and nobody gets in. This project solves the problem with a multi-credential IoT door lock: an ESP32 controller accepts fingerprints through an R307 optical module, RFID cards and tags through an RC522 reader, and short-lived OTP codes entered on a 4×4 membrane keypad for visitors who cannot be enrolled permanently. All three paths converge on a relay-driven 12 V solenoid bolt, and every event — granted, denied, OTP issued, OTP expired — is published over Wi-Fi as MQTT messages to a companion access-management dashboard showing the live log, enrolled users and active guest codes.

The hardware is deliberately built like a real student prototype on a breadboard: visible modules, labeled wiring, and an enrollment routine that stores fingerprints inside the sensor module's own flash and card UIDs in the ESP32's EEPROM. The software side is two working pieces: Arduino firmware on the ESP32 handling all three credential paths with a clear priority and fallback order, and a single-file HTML/CSS/JS dashboard that subscribes to the MQTT topics and renders the access log, OTP issuance panel and user list in real time. Because the whole stack is built in the open with standard parts, the student can genuinely explain the wiring, the protocol flow and the security trade-offs in the viva.

1. The ESP32 boots, connects to Wi-Fi, subscribes to the smartlock/lock01/commands MQTT topic, and initializes the R307 fingerprint module (UART, 57600 baud), the RC522 RFID reader (SPI) and the 4×4 keypad scan loop.
2. On each scan cycle the firmware polls the fingerprint sensor first, then the RFID field, then the keypad buffer — the first credential presented is evaluated; presentation order defines priority, no combination is required.
3. A fingerprint match is confirmed by the R307 module itself against its on-board templates (match typically under 1 second); an RFID card is authorized by comparing its UID against the enrolled list in EEPROM.
4. An OTP is accepted only if it matches a dashboard-issued code whose validity window has not expired; expired or unknown codes are rejected and logged as denied attempts.
5. On acceptance, the firmware energizes the relay for the configured unlock window (default 7 seconds), drives the solenoid bolt open, publishes a granted event with user, method and timestamp, then releases and relocks.
6. On rejection, a denied event is published with the reason (unknown tag, unknown fingerprint, bad OTP, lockout); five consecutive denials trigger the 60-second keypad lockout.
7. The dashboard subscribes to the event topics and updates the access log, statistics counters, OTP panel and user list in real time; OTP issuance publishes back on the command topic, which the ESP32 caches in RAM.

Tech stack:

• ESP32 · Arduino IDE (C++ firmware)
• R307 fingerprint sensor module · RC522 RFID reader
• MQTT · Wi-Fi telemetry
• 12 V solenoid lock · relay driver
• 4×4 membrane keypad
• HTML · CSS · JavaScript dashboard (single file)
• Git

• [Triple-credential access] Unlock with any of three independent methods — enrolled fingerprint on the R307 module, authorized RFID card/tag on the RC522 reader, or a temporary OTP keyed in on the 4×4 membrane keypad. If one reader fails, the other two still work.
• [Temporary OTP guest codes] The dashboard issues 6-digit single-use OTPs with configurable expiry (30 minutes to 12 hours); the ESP32 validates the code and the time window locally, so a guest never needs a card or fingerprint enrollment.
• [Live access log over MQTT] Every event — granted, denied, unknown tag, OTP issued, OTP expired — is published to structured MQTT topics and rendered live on the dashboard with user, method, timestamp and result.
• [Enrolled-user management] Fingerprints enroll into the R307 module's on-board template storage (up to 1,000 templates) via a guided admin routine; RFID card UIDs register to the ESP32 EEPROM with names, and both lists surface on the dashboard.
• [Denied-attempt handling] After five consecutive failed attempts the keypad locks out for 60 seconds and the denial burst is flagged on the dashboard — a simple, honest brute-force deterrent.
• [Auto-relock and fail-safe wiring] The solenoid bolt releases for a configurable 5–10 seconds then relocks automatically; the lock defaults to the locked state on power loss, and a 12 V supply with a 5 V logic rail keeps the relay switching clean.
• [Dashboard simulation hooks] The single-file dashboard ships with working controls — generate/revoke OTPs, add access events, manage users — so the demo runs end-to-end even before the hardware is in hand.

• Complete wired prototype: ESP32, R307 fingerprint module, RC522 reader, 4×4 keypad, relay module, 12 V solenoid lock, breadboard and labeled wiring
• Full Arduino firmware: triple-credential state machine, enrollment routine, OTP validation, MQTT client, lockout logic
• Single-file access-management dashboard (HTML/CSS/JS): live access log, OTP issuance panel, enrolled-user list, statistics
• Wiring diagram and connection table (module → GPIO pin mapping)
• Enrollment and calibration guide (fingerprint enrollment steps, RFID registration, OTP workflow)
• Project report PDF (background, system design, circuit explanation, protocol flow, limitations, future scope)
• PPT presentation for final review
• Viva Q&A preparation document (fingerprint matching, RFID security, MQTT, OTP design, failure modes)