Compromising Locks
Compromising Locks
Time to share what little knowledge I possess about lock picking. I have tried to include as much
information about the different types of locks that I am familiar with and the techniques that may be
used to compromise them. This list is not exhaustive by any means. It simply covers the types of locks
that I have been exposed to and have had the time to research.
There is a section concerning the implications of relying on locks for your personal security
purposes at the end of this document.
I do not hold a degree in this subject: remember I said "little knowledge". If there is information in
this document that you believe to be erroneous, please feel free to contact me and I will be happy to
change or remove the material in question. Enjoy.
NEWS
April 18th 2005 - I have added a tutorial for those of you that want to build your
own lock picks. You can find it HERE!
March 17th 2005 - A new technique for compromising ~90% of pin tumbler locks
has recently been documented. The technique is referred to as 'Bumping locks'. This
rather trivial (mechanically) technique is suprisingly affective on what were up to now
thought of as high security locks. The whitepaper is available here:
http://www.toool.nl/bumping.pdf
March 22nd 2004 - I have added a forum for topics related to this page. If you
have information that you would like to share or you just wish to browse the forum,
click the forum link on the navigation bar.
Sept 12th 2004 - I was going through some old pictures and found something that
I meant to talk about a while ago. I will have the info up by the weekend.
Sept 2004 - I am kinda playing with the site a bit. If it looks like crap don't give me
a hard time. I am kinda busy right now.
LEGAL
I guess I should indulge myself in a little preach about the implications of this knowledge. I do not in
any way condone the criminal negligence that may occur from the misuse of this information. I am not
teaching the reader how to become a criminal. This information is presented strictly for educational
purposes. If you -DO- misuse this information you -WILL- be committing a felony. Knowing how to
pick a lock is no more criminal than knowing how to use bolt cutters or how to project a brick through a
window.
From this view we can clearly begin to see the internal mechanisms of the lock. Let's remove them
and take a closer look..
The most important component of a lock is the center item in figure 2. The locking mechanism. What
exactly comprises this mechanism you ask? Move on to figure 3.
When a key is inserted into a lock ( figure 4 ), it moves the key pins to their necessary height which
also raises the set pins. When the set pins clear the shear line they enable the main cylinder to rotate
freely thus opening the lock.
There are some noticeable differences between padlock cylinders and dead bolt cylinders. The first
thing that you will likely notice is the number of pins. Dead bolts usually contain anywhere from 5-8
pins while padlocks are limited to 4-5 pins. These pins are also slightly larger in size than those of a
padlock.
The more expensive the dead bolt or padlock, the more intricate the pin design and
implementation. Although there are many different implementations of parts and assembly, all locks of
these types follow this basic design. I will spend a little more time on the subtle differences between
manufacturer designs a little later on as these differences pertain to picking them.
I would like to cover one more lock design before I jump into some theory.
Wafer tumbler locks typically implement some type of lever catch system. The catch usually
consisting of a metal stop plate or a mortised hole that accepts the lever in whatever material the lock
happens to be installed in.
A quick glance at that key tells us that there is at least 6 pins in this devil. Sound threatening? Don't
let these locks fool you. They are tecnologically inferior to their pin tumbler counterparts. In fact, they
don't contain any pins at all. These locks rely on a series of spring loaded brass wafers for their
security, see figure 9.
To determine whether it is a pin tumbler or wafer tumbler mehcanism that you are up against the
following tests should quiclky confirm the type:
1) Visual inspection-> Look into the keyway and examine the first pin/wafer. If they are visible it is
usually a dead giveaway.
2) Cylinder displacement-> The keycylinder is usually ill fitted. You will notice significant side to side
play as force is applied to the cylinder.
3) Pin resets-> Due to the construction of wafer locks there is a lot of deadspace surrounding the
parts. If you depress the wafers and quiclky release them you will notice that they make a "snapping"
sound as opposed to a "click" as expected of pin tumbler models.
That said, let's take a closer look at the semantics of wafer designs.
Looking at the cylinder body (item on the right in figure 8) we can see that their is more than one
position that the main cylinder can lock into place. The reason for this is that the key cylinder is not
controlling a complex opening mechanism (interacting with other levers, springs, etc). The state of this
lever is either 1/4 turn to the right "open" or 1/4 turn to the left "closed". This of course depends on
orientation. So what are the other two flutes for? Let's look what happens when the key is inserted..
As the key passes through the wafers it moves them up and down (figure 10). The wafers that are
up reside in the upper flute of the cylinder body and the ones that are pushed down reside in the
bottom flute. Until the proper key has been fully inserted their will always be 6 points of contact on the
main body. This ensures that the lock will provide maximum security if anything not resembling the
original key were to be inserted and turned.Wafer tumbler locks while anatomically different from pin
tumbler mechanisms still react to the same pin manipulation techniques.
Now that we have covered the basics of design, let's move onto some theory on how it is possible to
open these types of locks without the use of keys.
TOP | NEXT
The picture above ( figure 12 ) is that of a dead bolt ( same one from figures 5 & 6 before I chopped
it in half ). I have placed two set pins, one at each end to stabilize the key cylinder. The key is under
pressure, gravity to be more precise. Now, carefully examine those columns. Do you notice anything
odd as you peer down them? If you look closely you can see that the top of the key cylinder is visible
(brass ledge). Why?
Let's face it, locks are not exactly a precision instrument. In order for a lock to operate smoothly
there must be some play in the system. This play is achieved by the allowance for these columns to be
slightly larger than the pins themselves. If they weren't, the first piece of dirt, grit, etc. that entered
these columns or the expansion and contraction of the malleable metals that comprise these parts,
would hinder it's operation. Also, as the lock ages (repeated usage's) friction may play a role in further
expansion of these columns.
Going back to figure 12 for a sec. If I got out my micrometer and measured each overlap I would
notice that the distances away from the cylinder body would not be consistent. What I mean by this is:
If I drew a straight line across these columns, the point at which the cylinder holes make contact with
the line would not be exactly parallel. This is due to the inherent play between the cylinder and the
cylinder body. In order for the cylinder to spin there must be an allowance for movement. When a key (
or something simulating a key ) is inserted and turned there will be side pressure on the cylinder
causing it to skew and create this situation.
This play I mentioned varies from lock to lock. The more expensive the lock, the more likely it was
designed with superior materials and more advanced machining processes. With this, tolerance levels
will be decreased and the lock will be more difficult to pick. There are also other methods that
manufacturers employ that can make picking a lock not only more difficult but also frustrating.
moving on..
Above (figure 13) is a picture of a key pin and a set pin. These are actually butted up tight to each
other. Notice how where they make contact they are rounded and not flat.
Considering what we have examined so far, we can deduce that as long as there is pressure on the
key, the cylinder holes will overlap the cylinder body creating a ledge. Even if the pins were flat, they
would most likely get stuck on this ledge and the fact that they are tapered (more surface area for
contact) just reinforces there tendency to get stuck. Now, considering the inconsistency of this ledge,
every time a pin is lodged past the shear line ( see figure 4.) the cylinder will move slightly. If the
pressure on the cylinder is maintained and another pin is depressed it too will get caught on this ledge,
and so on.
So if we can insert something into the key way and apply pressure (a torque wrench) and use
another utensil (a pick) to push on those pins until they become trapped, the cylinder will be free and
the lock will open. : )
Diamond pick: As you become a little better at lock picking this is the pick of choice for scrubbing.
They are available in many different sizes but you will probably find the smaller more tapered edge
type is the most versatile. The brass handle that you see is typical. The pick is held in place with a
couple of hex head set screws. These can be loosened so that the handle may except other picks.
Snake pick: Again, designed specifically for scrubbing. The main advantage of this pick is the
likelihood of the pick setting more than one pin at once. On an easy lock you can sometimes open it
with one sweep.
Torque wrench: The torque wrench is simply used to apply pressure on the cylinder. They come in
various sizes and it is a good idea to have some smaller ones (in width) on hand. When working on
some of the more advanced locks a feather torque wrench (relies on springs) can really come in
handy.
There are many other types of picks available on the market. However with this basic set and some
skill you should be able to pick most of the pin tumbler locks you will encounter.
Note: There are some lock designs that can not be compromised with conventional lock picks, such as
tubular locks and warded pad locks. There are picks designed specifically for these types.
brands like Medeco(tm) and Schlage(tm) (explained later) and preferably not the dead bolt on your
neighbors front door. Unless of course they are away on vacation and you need to feed their cat etc.
You may have some locks laying around your house. If not, go to the hardware store and buy the
cheapest padlock you can find. Try and find one that is a decent size so that it will be more
comfortable in your hand while you are still a little "wet behind the ears" lock picker.
I have chosen to begin with padlocks strictly because they are a little easier to practice on while you
build up your dexterity with the tools.
Lock picks although tools are not the same as say a hammer or screwdriver. They are precision
tools comprised of very soft materials. Consider this as you are practicing. If you are bending your
tools, then you are definitely doing something wrong. Force is not your ally.
To begin place the lock in your hand. The easiest and most comfortable way of holding a padlock is
with your middle finger through the bolt with the pins facing your body. Insert the torque wrench
applying only enough pressure to keep the wrench inserted in the key way.
Next insert your pick. For this exercise we will use the hook shaped pick. We will begin by trying to
set each pin individually. Although this process is usually reserved for more difficult locks it clearly
demonstrates how to recognize setting pins.
How much torque?
Typically, to open a lock you require only enough torque to spin the cylinder, which once freed from
the pins is very little. The torque required to trap the pins in their respective columns varies, and is
influenced mainly by environmental conditions and the quality of the lock. The biggest mistake
beginners make is applying far too much torque thus bottoming out the pins or jamming them
altogether. Be gentle and reap the rewards. The easiest way to judge the proper torque for your lock is
to insert your pick, beginning with the diamond, and gently sweep the pins from back to front waiting
for a pin to set. The lowest amount of torque that it took to set that pin is usually the amount of torque
required to pick the lock.
While applying torque on the cylinder gently push down on the first pin. When a pin sets it will make
an audible "click" which will also be transferred to the pick itself and felt. If nothing happens maintain
your torque and depress another pin. When you reach a pin that sets search for another. If you have
depressed all of the pins yet none will set increase your torque and start over.
While you were performing the above you probably noticed that as pins began to set that the
cylinder also slightly rotated. This is a very important feature that locks display as the shear line is
cleared of the pins. There are times when you are picking that you are unaware of pins setting, this
feature helps to assist you in determining the progress of picking at hand.
There is no _real_ order as to how the pins will set or how much the cylinder will turn as pins are
set. It all depends on the the type of lock and the manufacturer. If at some point you feel as though all
of the pins are set yet the lock will not open, you have probably lodged a pin too far past the shear line
so you must begin again. If you get frustrated, take a break.
How many pins?
It all depends. To check insert your torque wrench, pick etc. until it hits the back wall of the lock.
Depress it onto the pins and slowly drag it out of the lock. Listen carefully as the pins pop back into
place counting as you go. Most padlocks have 4 pins, some have 5 (typically brass). Dead bolts have
anywhere from 5 to 8. It all depends on the manufacturer. So check before you pick. While on this
subject I would just like to mention that the amount of pins rarely has anything to do with the security
of a lock.
Which way to turn?
On our test subject it doesn't matter as we can see ( figure 16 ). The cylinder when in place can pull
the lever either left or right. Not all locks are the same, especially when it comes to dead bolts. Before
you do anything with a lock you must determine which way to turn the cylinder.
To determine the turn of a lock insert your torque wrench in the cylinder and apply moderate
pressure both ways. The direction that offers the least resistance i.e.. not an instant _dead_ stop, will
be the turn of the lock. Another simple test that you can employ is to insert your torque wrench and
apply ample force on the cylinder both ways. As you do each brush your pick across the pins and note
whether they set. On most locks all of the pins should set only on the correct turn.
Once you do succeed in picking your first lock, begin timing yourself on that lock. When you can
pick a familiar lock, pin-at-a-time, in less than 10 seconds it's time to move on.
What about dead bolts?
Most people find it a little awkward at first working on dead bolts. This is usually due to the fact that
they are accompanied by a large door and fastened to it quite well. You cannot manipulate the lock to
improve your positioning so you must rely on your dexterity with your tools 100%.
The techniques that you used on the padlock are exactly the same as you will apply to dead bolts.
You will however require a little more skill in identifying set pins as dead bolts tend not to give as easy
as padlocks.
Note: I just noticed that from what I have said so far I am creating the impression that dead bolts are much more difficult than padlocks.
This is not necessarily true. There are some very decent padlocks out there that are very difficult to pick. The likelihood of encountering
one however is rare. I will maintain my current distinctions between the two for the rest of this paper but keep in mind for the sake of
accuracy, that it all depends on the make of the lock.
The most difficult thing about lock picking is just this. Choosing your plan of attack. You must
approach each new lock as a challenge and never allow yourself to become a victim of the memory
effect. Beginners especially, may be inclined to become accustomed to a particular lock. Now, they
can pick this lock in about 2 seconds, knowing exactly the order and just how much tension and
pressure it will take for the pins to pop. So, with this lock they have acquired something, the sequence
of operations for brand "X", a template if you will. From this point on, this template will be used for all
locks to follow.
As you can guess from what we have learned so far, this will not get them very far. With each new
lock, there is a new challenge. When you first insert your pick into a lock, never begin with the
assumption that it is going to open. Assume that you are going to learn something from it, nothing
more. And if it happens to open, then great. If not try to gather a little more information about it and try
again.
Note the additional pin between your typical key and set pins. As mentioned earlier as pins are
cleared of the shearline the cylinder will slightly rotate. With the addition of these pins you have
created a number of different shear lines. This will greatly increase your chances of picking this type of
lock.
4) The dreaded Medeco(tm). Medeco is a high security lock manufacturer. They're products are very
expensive and _very_ secure. Their locks are very common within commercial businesses,
restaurants etc. These are by far the hardest locks to pick. Primarily these locks owe their security to
precision machining practices, and the clever sidebar they utilize (figure 18). These locks are very tight
and smooth with little play. The pins are beveled in all kinds of shapes to impede picking (discussed
below). These bevels play a further roll in allowing the key pins to align correctly with the sidebar when
the proper key is inserted. Below is the cylinder from a medeco padlock.
I have always known that Medeco locks were tough to pick, but never really understood why. It
wasn't until I actually took one apart that quite a few things came to light. The unfortunate part is, this
information (depending on your skill) only marginally increases your chances of picking it. They are
hard, period.
Looking at figure18 above, we can see some notable differences between the Medeco (tm) cylinder
and a typical cylinder. Most notably is the addition of a spring loaded sidebar on the key cylinder. This
sidebar can either inhibit or allow cylinder movement depending on pin orientation. The key pins
(figure 19) have an integral valley which runs from end to end. Take a look at Figure 20 below, paying
attention to the last two columns. Those silver protrusions reside in the valley of a properly aligned
keypin. If the pins fail to align (all of them, and regardless of the shear line being clear) this bar won't
budge and the plug will refuse to rotate.
If we remove this bar the Medeco cylinder reacts to picking as can be expected from any other
cylinder. The test to the reader here is to be able too identify just when this bar is free. Taking a look at
the columns in figure 20 you will notice that their is a cutout (about 20%) into the plug which restricts
the key pins to rotate within this constraint. This is not very encouraging as it severley decreases the
odds of proper aligment by a foreign object. Furthermore The alignment is not static (figure 22), it
varies from lock to lock which unfortunately blows away the idea of creating an alignment jig.
Options?
Theoretically speaking, it may be possible to concentrate your efforts on freeing this sidebar while
not over tourqing the plug to a point where pin setting would be impossible. Using your diamond pick
with very little torque on the plug employ a side to side in out sweep over the pins. You are not trying
to set pins here, as this would impede the rotation of the key pins, you are merely trying to align them
with the sidebar. If you can correctly align these pins there will be a slight give in the plug, a very slight
give. At this point you have not entirely freed the bar from its notch, which is good because if it travels
too far you would cause pins to bottom out on the cylinder body. You have merely depressed it
enough to transfer force back on these pins to keep them in line with the side bar. Please note that this
is _very_ difficult, but if you get to this point it will be possible to set the pins and open the lock. It may
be worth to mention that you must be very careful while scrubbing the pins after they have been
aligned. In fact you should probably concentrate on one pin at a time. The scenario that you created
by aligning the key pins with the sidebar is very delicate. Any modification in torque, while performing
your pin manipulations may cause a greater force against these aligned pins thus disturbing their
proper alignment.
I have often wondered if the utilization of a mechanical pick gun with a side to side motion across
the pins would help. One would think that this would increase your actual time spent vs. unique
attempts. However I am not sure if the pick gun would correctly reset the pins enough to allow them to
rotate. Anyone?
I am interested in any information that people can offer with their experiences with Medeco(tm) or
any locks for that matter. If you have something to offer, please drop me a line.
Warded padlocks rely on a very simple design. The main body of the lock contains voids that harbor
simple levers that rest on the bolt. The bolt has been machined with grooves in it to accept these
levers. At rest these levers reside in their respective grooves thus restricting the movement of the bolt
while maintaining the locks closed state. There are two types of levers available for warded locks.
Examining figure 23 and 24 you can see that one is a single action and the other dual.
Operation of this lock is simple (figure 25). When the key is inserted and turned this effectively lifts
these levers from their grooves and the lock opens. You can also see from this diagram that the bolt is
mushroomed at the end and tapered on the upper of the grooves so that it may pass back through the
levers without hindrance when the key is removed.
The simplistic design of the locking mechanism in warded locks make them an excellent choice for
the outdoors where a little bit of water and the subsequent rust won't hurt their "far from precision"
moving parts. These locks are unfortunately stricken with security flaws. The most apparent of which is
the amount of levers that secure the bolt. Their is usually one single action an one dual lever and from
what I have seen this appears to be the norm for almost all warded locks. In some cases their will just
be the upper dual lever securing the bolt.
So how do we pick these locks?
Warded padlocks aren't really picked per se. Although it would be possible to use a couple of pieces
of "L" shaped rolled steel to fiddle around with the levers until you perpendicularly depressed all
levers present, it would be much easier to use a key blank such as the ones in figure 27.
The second from right blank on that key ring (figure 27) will open most of the warded padlocks that
you may encounter. If this is not the case, insert your blank (second or third from left) into the lock ~ 1/8
" and gently turn it clockwise checking for any resistance. If none is felt procede further into the
keyway (1/8" steps) taking note at which levels resistance is felt. Once you have established the
number of levers present and at which depth they occur, it is a simple matter of stacking blanks to
mimic the positions.
One of the security features present on warded locks is the association between the plate that
comprises the keyway and the key itself. The keys for these locks are not flat. They are slightly "Z"
shaped and vary in thickness, width, and length. The arrangment of the stubs on these keys also vary
in width and positioning.
This system is a poor one. If we look at figure 28, those keys will still open their respective locks,
even though i removed all but two of the stubs. If I further removed some material from the key on top
and made it flat so that it may enter the key way of the other lock, it will open both locks and probably
Locks are only as strong as the material that they are installed in. i.e. glass and wood break easier
than steel.
When buying a new house the first thing you should do is change the passage sets on all of the
doors. You have no idea how many keys were
keyed for that lock during construction and who might have them. The standard passage set it
usually a very cheap one that can easily be picked.
When using a hasp, buy one that has a shroud that covers the screws that fasten it. If the screws
are visible, use carriage bolts instead.
Tools/Materials
What we are looking for is a blade that looks something like the one pictured below. These particular
wiper blades contain 2 stainless steel stiffeners that run the entire lenght of the blade. All we need to
do now is remove them.
You will notice on the right hand side of this blade that the stainless pieces are flarred to keep them in
place. The easiest way to get them out is to make a cut on the spine with your sidecutters, just before
the end of the blade. When this has been done the entire assembly (the blade itself and the 2 stainless
stiffeners) will easilly slide out. Two more cuts, and each piece will be free.
Torque Wrench
We are now ready to make some tools. Let's begin with a simple torque wrench. Place a piece of steel
into your pliers like so:
In order to get a tight bend you want to have pressure as close to the pliers as possible. So, while
pushing into your pliers with your thumb, slowly roll your other hand until you have an "L".
Once the bend is completed you can trim the torque wrench to size. You should end up with something
like this:
Lock Picks
I will demonstrate with a simple hook pick. I have chosen this pick because it is one of the most
common, and because I can demonstrate how to bend the steel laterally so that you can get more
depth. The picture below is that of a pretty aggressive hook pick. Looking at the the width of the stock
below, some may wonder how we could duplicate this pick. The answer is simple, we will bend it.
Allow me to demonstrate.
Trying to bend something so thin across it's thickness can be difficult. The object skews and wants to
flatten out. This particular problem can be addressed by using pliers that have serrations in the jaws. If
you place the steel into these serrations then you will be able to get a decent grip and the steel wont
have the abililty to 'flop out' when pressure is applied.
Now to make the hook, what you want to do is make a bunch of consecutive small bends within the
span of the last 1" of your steel, alternating your position as you go. If you bend too much you will
deform the steel. Just take your time and you will end up with a nice fluid bend as you can see
pictured below.
All that is left now is the finish work. By far the easiest way to clean up the edges and shape the steel
is with a dremel. I find that the sanding drums work really well. This is not a necessity though. If you
keep your picks simple, for example the hook pick pictured above, you can easilly break the edges
and fine tune the shape with a small file, it will just take a little longer.
Below you can see a pick starting to take shape. Also, if you had no idea what a dremel was up till
now, one is pictured below.
As for handles, I have had good experience with plastic dowels. I simply torch up the end of the pick
for a few seconds and insert it into the dowel. It should melt a nice path for itself and seat almost
immediately. You could also use a hardwood dowel that was pre-drilled, setting the pick in place with a
little epoxy. Below you can see 2 picks that are a little more creative, and that utilize the plastic dowel
for a handle. The second pick is very effective. Play around with your designs, you might find
something that works better for you.
The ability to design your own picks can come in very handy at times. Most of us, at one point or
another, have experienced frustration at the limitation of a particular pick. Those "If my pick was just
______! " this lock would open. The funny thing about this situation is that you really "do" know just
what would do the trick. Once you have played with a few designs, you will quickly find out just how
useful it can be to build your own picks.
Good Luck!
All Content 2000-2005 Paul Halliday
pintumbler at gmail dot com