The problem should be inverted - use the package tracking number as code. This way, every code is unique, hard to guess, and the delivery person has it literally printed on the box. Being able to update the lock with expected tracking numbers is something that could be done simply and via local network.
