Rolling code
Rolling code is the security scheme used by modern garage door remotes: transmitter and opener share a cryptographic algorithm that generates a new code on every button press, so no transmitted code ever works twice. It replaced fixed-code remotes, whose single reusable code could be captured and replayed by thieves.
The scheme, and what pairing actually does
A rolling-code remote is a tiny cryptographic device: it holds a secret seed and a counter, and each press encrypts the counter’s next value into that day’s transmission. The opener, holding the same seed, decrypts and checks the counter has ADVANCED — a code at or behind the last accepted value is dead on arrival, which is precisely what defeats recording-and-replaying. The Learn button ritual is the key exchange: pressing it opens a brief window in which the opener accepts a new transmitter’s seed into its memory, after which the two share a private sequence no scanner can join.
That architecture explains all the household folklore. Why a new remote needs the Learn button rather than copying a neighbour’s: the seed is per-pairing. Why car HomeLink setup for rolling-code doors involves a step at the opener itself: the vehicle must be enrolled, not just taught the button. Why erasing the opener’s memory after a break-in or a house purchase matters: enrollment is permanent until wiped, and the previous owner’s remotes are enrolled. And why a remote pressed fifty times in a gym bag stops working until re-paired: its counter has out-run the acceptance window.
Remote-security eras, at a glance
| Era | Scheme | The attack it allowed | Status |
|---|---|---|---|
| 1970s–80s | DIP-switch fixed code | brute-force cycling of few combinations | obsolete — replace on principle |
| 1980s–mid 90s | programmable fixed code | record once, replay forever | obsolete — the code-grabber era |
| mid 1990s–now | rolling code | replay closed; niche relay attacks remain | the standard |
| 2010s–now | rolling code + networked control | account and app-layer risks added | standard on smart openers |
What to actually do with this knowledge
Audit what is enrolled
The opener’s memory quietly holds every remote, keypad and vehicle ever paired. New house, break-in, or a remote gone missing: wipe the memory (hold Learn until the indicator clears) and re-pair only what you hold.
Treat visor remotes as keys
A remote in a car parked in the driveway is a house key in an unlocked box. Keychain-sized remotes that leave with the driver — or wall-keypad entry — close the commonest real-world hole.
Pre-1993 also means fixed-code
The same opener generation missing photo eyes typically predates rolling code — a double obsolescence. The safety case retires it; the security case seconds the motion.
Sync loss is not failure
A remote that suddenly needs re-pairing after months in a drawer walked its counter past the window — a design behaviour, not a defect. The Learn ritual is the reset; the coin cell is the other suspect.
Rolling code questions
What was wrong with the old fixed-code remotes?
They broadcast the same key every press, forever. Anyone recording the transmission once — with a scanner parked nearby — owned the door; early DIP-switch remotes made it worse by offering only a few thousand combinations that a device could simply cycle through. The fixed-code era ended for the same reason car keys stopped being simple metal: the attack became cheaper than the lock. Openers from the mid-1990s onward shipped rolling-code as standard.
How do the remote and opener stay in sync if the code always changes?
Both sides run the same algorithm from a shared secret established at pairing, so each can predict the sequence. The opener accepts a WINDOW of upcoming codes rather than exactly one — that forgiveness absorbs the presses your remote makes out of range (each of which advances its counter) without ever accepting a code it has already honoured. Press the button enough times away from home and a remote can walk past the window; re-pairing via the Learn button resynchronizes it.
Does rolling code make my garage unhackable?
It closes the replay attack, which was the practical street-level threat; sophisticated relay and jam-and-capture techniques exist in research literature but are rare against homes. The honest residual risks are mundane: a stolen visor remote is a key to the house, unpaired old remotes retain access until the opener’s memory is wiped, and the emergency release can be fished on some doors without any electronics at all. Security review after a car break-in: erase and re-pair everything.