Scanning Electron Microscope Analysis of Pin Tumblers

Naturally, everyone knows picking locks makes some sort of marks on the pins. Steel is harder than brass, ergo it’s pretty likely to scrape away brass material. I got interested and looked around a bit. I saw a couple decent photos taken with a high MP camera and cropped, but nothing truly showing close up shots. So, I decided to toss a couple pins under an scanning electron microscope. I didn’t happen to have one in my kitchen, so I went to the logical folks. Nanotech physics geeks, of course.

I went to the local Target and picked up three Master branded doorknobs. I liked the brand, as they seemed decent quality but not overly expensive. One was left pristine, one was picked, and one was bumped. I bagged all three cylinders and mailed them off along with a couple bags of candy. If you ever want to get geeks to do something, bribe them with sugar and/or caffeine. In this case, I decided to entertain myself by sending them Smarties and Nerds. I was gonna include a bag of Dum-Dums for the nano geeks to give to the chemistry department, but decided that wouldn’t be nice.

Anyways, onto the photos:

I chopped down the photos a bit to save on bandwidth. Download and zoom to view properly. If anyone really wants the larger files, let me know. They’re not substantially different than if you just zoomed in on the provided. All pins were imaged, and numbered from front to back. Pin 1 being closest to the keyway, Pin 5 being furthest in.

Pristine Cylinder, Pin 5, Photo C


I noticed deep, long scratches even on the unused cylinder. Likely they tested a key at the factory. They were on all pins in all cylinders tested. Often one long scratch, and several smaller ones at different angles.

Pristine Cylinder, Pin 5, Photo D


Different shot of the same pin. You can notice some surface deformation from manufacturing.

Pristine Cylinder, Pin 2


You may notice black specks in various photos. This is primarily dust, but occasionally specks of brass or other contaminates. This is a 100 micron shot of one example of a piece of dust.

Picked Cylinder, Pin 1, Photo B


And now we get to the interesting part. You can fairly clearly see evidence of picking. It does not look even remotely like the key marks. They are significantly less uniform in both length and angle, as keys generally do not have that much play when entering or leaving a lock. The most telling factor (if you look closely) is that they damage the edges of the pin. While key marks do leave scrapes on the pins, they do not mutilate the edges of the pins anywhere near to the same level as picking.


Here is a close up shot of the edge of Picked Cylinder, Pin 1. The edge mutilation is quite visible.

Picked Cylinder, Pin 1, Photo C


Another shot of Pin 1.

Bump Cylinder, Pin 2, Photo B


The evidence of bumping is slightly harder to see at first glance. Bumping appears to leave deeper key marks. Occassionally these key marks are punctuated, like dashes. Regular key marks are long, smooth scrapes.

Bump Cylinder, Pin 2, Photo C


Another shot of the same pin. Note the punctuated key marks.

Bump Cylinder, Pin 3, Photo C


Bumping also plays hell on the edges of a pin. Very deep key marks.

Bump Cylinder, Pin 5, Photo D


Nice clear photo of both punctuated key marks and deep key marks on the edge of the pins.

Pristine Cylinder, Pin 3, Photo C

50 micron shot of a key mark. Key marks are approximately 25 microns wide.

Pristine Cylinder, Pin 3, Photo N


Another 50 micron shot of a key mark.

Picked Cylinder, Pin 3, Photo A


Clear shots of pick marks at the edge of a pin

Picked Cylinder, Pin 3, Photo C


Closer shot of pick marks

All images courtesy of Jeff Doughty and the Nano-Development Lab at Portland State University.

Read More

Physical Security Countermeasures


The three most common ways of illegally entering a house is kicking in the door, breaking a window and drilling.

Doors are the usual way of entering and leaving a residence. They should and do receive a significant amount of attention, but oddly, 90% of doors are poorly secured. Most doors sold in America frankly suck. They are either metal or wood. Ironically, solid wood doors are usually the more secure. Most wood doors are not solid one piece construction, but often cheap relatively soft light wood with an appealing veneer. Any wood door with deep sections cut out of the door for aesthetic purposes is not recommended. Most residential metal doors are a very light gauge steel of dubious quality. They are near universally hollow or foam filled. At the moment, there are no brand of doors that I would unhesitatingly recommend. It’s usually cheaper to make your own. Laminate a few sheets of decent gauge sheet steel, optionally adding insulation between layers. Glue on wood veneer for pleasing aesthetics. Use three or four decent hinges and the door should still open rather cleanly.

Even with the generally poor quality of locks on residential homes, often the locks are stronger than the door and door jamb. The most common occurrence when a door is kicked is for the latches of the doorknob and deadbolt to rip through the thin surrounding material or for the lock to rip through the door. There is a very simple and relatively inexpensive solution. Reinforce the door jamb. I highly recommend DJ Armor (, but other cheaper versions are better than nothing at all. Your reinforcement kit should include decent gauge metal to go on both sides of the door and a U shaped square of metal to go around the lock.

Here is a somewhat cheesy video demonstrating the product:

One thing that door lamb reinforcing kits will only somewhat help alleviate is a splitter. Basically, imagine a car jack, turned sideways. You crank the jack until the frame is warped and latches are no longer protruding into the door frame. The only solution is to have heavy structural material around the door. Good brick, strong stone, cinder block or concrete. It’s not widely used, as it’s not quick, requires specific equipment, very noticeable and not very subtle. There is a relatively easy if inconvenient solution, a cross bar on the inside of the door that well connected to the frames. It’s not a likely threat, so the solution isn’t really recommended.

If you wanted to be cost effective, you could install a more robust jamb reinforcement setup on one door and devices like “Door Club” (or any other door brace) on any other door. Door braces are pretty simple. You install a device that prevents the door from opening whatsoever when installed. They vary in quality, but they’re pretty cheap and work “well enough” if the door is reasonably well constructed. Downside, of course, is you can’t open the door from the outside and you have at least one hole in your floor.

A very obvious problem is any openings (or potential openings) within arms reach of the locks. Windows, especially. Same theory applies for mail slots, wide gaps between the door and frame. If this applies, buy and install a double cylinder deadbolt. This is a keyed opening on both sides of the door and no latch to automatically open the door. Many such deadbolts include a special “inside only” key. Most people just hang it across from the door, but well out of reach. This is a perfectly valid solution.

If the door surface is flush to the door jamb, it’s easy to shim the door. aka, the old credit card trick. Don’t actually use a credit card. A bendy piece of metal works better. You use it to trip the latch and make the door think it’s currently open. If this is truly problematic, you probably want a different door or door frame. A field expedient solution is to install metal slab covering the latch area. It can be sawed with relative ease, but it’d stop or slow a shim which ordinarily take seconds. Do not use a lever doorknob on the inside of the door if at all possible. They are significantly easier to manipulate with a wire or whatnot.

The most simple and cheapest way to help secure your door is the hinges. These are often overlooked. Use some form of security hinge. Non-removable hinges have a set screw to retain the pin that is only accessible when the door is open. Safety stud hinges have a chunk of metal that sticks out of one side of the hinge to a corresponding hole on the other side of the hinge. If the pin is removed from a safety stud hinge, the door cannot be opened due to the interfering stud. Crimped pins are riveted into place and the pin is not removable. Hinges, even really secure ones, are very cheap. $10 for top of the line hinges is not uncommon. Go insanely speedy on hinges, they’re very often overlooked.

Garage doors are another lovely weak point. Change any remote garage door opener from the default combination. Remove the emergency pull rope on the inside of the door if practical. If not practical, shorten it and do not put it in a loop that is easy to snag with a shim. When you are leaving for an extended period of time, disable the garage door opener, disengage the mechanism, and use at least one padlock on the door on the inside. I personally recommend securing any door between your garage and your house like an external door, but most people do not.

Ok, enough of that. Now onto the fun stuff, locks. If you want to go the cheaper route, buy any doorknob you like and install a very good deadbolt. You don’t want to reverse that. Doorknobs by their nature are easier to attack. For cheaper doorknobs, you can remove the handle with a set of pliers or a small sledgehammer, then use a screwdriver to turn the door mechanism. Even the best doorknobs are vulnerable to this, just requiring significantly more force or time until failure.

Deadbolts. I really, really recommend an Abloy. Obviously, I’m really into lock picking. I have never, once heard about someone picking or bumping an Abloy. Not even dubious second or third hand accounts. The only weakness I’m familiar with is a specialized drill head sold in Europe to licensed locksmiths, which is obviously and definitely not a “nondestructive entry” method. Conventional drills will work. Eventually. If they don’t burn out the drill…

Now, again, you get what you pay for. You can go with an Abloy cylinder in a third party deadbolt case, which is cheaper, $120 at and is a ANSI grade 2. Or you can go whole hog, ANSI Grade 1 or Or you can take a step down and go with a Medeco. Medeco is first tier and it’d do you just fine. It’s used at the Pentagon, White House, etc. But it’s significantly less secure than an Abloy. Medecos are vulnerable to bumping. They are/were King of the Mountain, and folks REALLY threw themselves at it. The result is “Open In 30 Seconds” which is an entire book entirely on cracking Medeco locks. I don’t really recommend the BiLock deadbolts, though it is considered a first tier product. All three would do you just fine, I’m just being a security geek and pointing out theoretical attack vectors that are possible but pretty highly unlikely.

If you do go with an Abloy, you can almost always get your locks same keyed at little to no cost. You’d probably want that if you get a new knob set along with a new deadbolt. One bit of warning, GET EXTRA KEYS. If you lock yourself out, your locksmith is going to alternate staring at the door and staring at you. He’s expressly NOT going to be able to fabricate keys for you. That’s kinda the whole point. Oh, bonus, Abloy keys are interchangeable on the same platform. You can get any number of deadbolts, door knobs and padlocks keyed to the same key with ease. It just has to be the same line of cylinder. Elite, Protec, whatever.

Now let’s jump into the ultra paranoid realm for a second. I’m not advocating any of these, as it’s seriously overkill for any home. First is shielding. Even the best locks are vulnerable to denial of service attacks. Usually juvenile delinquents that insert glue into a lock. To prevent denial of service attempts and even more drill resistance, you want to combine an Abloy and a Drumm Security Geminy Deadbolt Shield. With a high performance drill, you might drill through both in roughly… hour or two. Mind you, that’s with the best drill and bits. A regular handheld? I dunno, eight or nine hours if at all. For even more security, Abloy offers various levels of key protection. For an extra couple bucks (per key, not per lock), you can buy a different key profile. If you bought this, only the original vendor and the factory have the replacement keys. No other vendor or locksmith could reproduce your keys. The vendors and factory would only release new keys under very strict procedures. Defense in depth. You could install a door jamb reinforcement kit on a bedroom door, and a no-key latch-only deadbolt. If someone were to break in, you’d gain extra time to secure weaponry or dial 911. Also, it is possible to remove peepholes from a door and install one in the opposite direction.

That’s enough on doors. Now onto…


First rule. Film all accessible windows or glass. If it’s on the ground floor, definitely film. If it’s on the second floor… Strongly consider it. I strongly recommend ShatterGARD ( Other security films may or may not be just as good, thoroughly review before purchasing. I extremely strongly recommend getting it professionally installed. It’s really easy (slap on, mist with liquid, squeegee) but you really don’t want to blotch the job.

Here is a mildly cheesy video demo:

Windows are hard to give specific advice, because they greatly vary. Consider installing real locks on the windows. You can improvise on a temporary basis by cutting some wooden dowels to size to prevent the windows from being jimmied open while you’re gone. These are excellent:

You could get by with any hasp and a padlock if you wanted an ugly but efficient install. Line up the hasp, use a magic marker to fill in the holes, remove hasp, drill a thin pilot hole, line up hasp again, inject in some glue, drill in nice deep wood screws of good quality. Cyanoacrylate is great, but you need to move quickly and it’s very unforgiving of error.

Full length door windows = bad. Very bad. Immediately install a double cylinder deadbolt. Even a kwikset double cylinder deadbolt would a thousand times more secure than a single cylinder Abloy deadbolt in this case. You could film the door window and it’d be ok (but not good). Consider reinforcing the window frame. I’d recommend, if financially capable, eventually replace that door. Don’t even consider a door brace for the door with a full length window. If they can SEE the door brace, they’re going to go through the glass.


Work from the worst problems to the mildest. You do one bit at a time if you’re financially limited or pick and choose if you feel any of the above is overkill. Just always remember, physical security is only as strong as the weakest link.

Regardless of your cash level: Wooden dowel the windows when you’re gone, secure garage when you’re gone, immediately and without delay install double cylinder deadbolt if you have glass near the deadbolt. Security hinges are a must and dirt cheap.

Read More

A More Comprehensive Guide to Lockpicking

Legalities, Rationalities, etc

Don’t break the law. Lawyers are not cheap, and jail is not a pleasant place. Just buy a lock. It’s easier to work and it’s legal. If you’re low on cash, ask friends, family and coworkers for locks with no keys. You can easily fashion your own tools and such if need be.

Now, you might ask, why teach people to break the law? Trust me, I’m not. Some criminals could teach a master locksmith plenty of tricks that are completely unknown to the legitimate locksmithing trade. This is not speculation. I have known roughly a dozen guards from various high security prisons. With few tools (of a kind a guard is willing to hand to a convict), a prisoner could pop open a car or truck door in seconds on demand.

I am a security geek. Any information security professional will tell you, it’s nice to have an expensive firewall, good patch regiment, good policies, and all that. But does that help you if someone steals your physical server? I’ve seen data center doors opened with a Blockbuster card, and I’m not being sarcastic. Most locks suck. They really suck. Computer security has made huge progress over the last ten years, due to full and open disclosure. Rather than suppressing vulneralities, systems were put into place to collect security issues, get manufacturers to fix the issues, and publish the fix. There is always a worry that publishing a fix will tip bad guys to how to exploit a vulnerability. Regardless of how the bad guys are tipped off, a vulnerability exists whether it’s publically known or not. Most of the time, it is virtually impossible to know if the bad guys know about a vulnerability unless they publically expose their finding.

The lock industry and the locksmith industry often do not believe their customers have a right to know what they are getting for their money. A lot of folks think differently. Regardless of knowledge, a lock is either secure or it is not. Knowledge doesn’t change the physics of a lock. If you’re reading this, go ask a random stranger nearby how secure their locks are. If they don’t answer, “Could be opened in a few seconds, with no damage or apparent evidence”, they are not well informed. They should be.

Besides, criminals tend to bypass locks. They break a window and enter, or smash the door in. A sledgehammer on the door knob works too. If you put a Club on your steering column, they’ll cut into the steering wheel with snips, a hacksaw or whatnot and remove the club with ease. If you want to make your house relatively secure, put anti-shatter security film on your windows, use decent locks, reinforce your door jam, put motion lights around the property, etc. Get an alarm or a dog.

How to Pick Locks

Warded Padlocks

Cheapest type of lock. They work by allowing ‘any key’ that touches the latch to open the lock. Different obstacles are placed in the way to block any ‘unauthorized’ key. So you just have to avoid said obstacles (which are known as wards). Buy a $10 ward key set from any lockpick set. It’ll open any old ward padlock, and the cheapest modern warded padlocks.

The modern warded padlocks are slightly better. Most of them are specifically designed to block that generic $10 ward key set. Still pretty easy to defeat. Take your key. Count the number of things sticking out. Make that many copies of the original key. On each copy, shave off all but one of the bumps. One of said mutilated keys will open every example of that locks, it’s usually the key with the last possible bump furthest from the handle.

Shimming is not “lockpicking”, it’s a bypass. A bypass is a method of opening a lock by going around the actual locking mechanism. A shim is a flexible but slightly stiff piece of metal. It’s very simple to make. Get a Coke can. Cut out a rectangular piece one inch by half an inch. Cut a two V’s on one of the long sides, fold the end pieces over to reinforce the ‘handle’. You should have a V sticking out with a flattened end sticking out of a somewhat reinforced handle. Slide the V side of the shim on the inside of shackle into the padlock. Preferably on the side of the shackle that comes out of the padlock when opened. This trips the latch and opens the padlock.

Professionally made shims are available for sale online. They’re significantly more expensive than a mutilated soda can, so it might be work to buy a six pack and experiment. Even the best made shims won’t last more than half a dozen attempts. On the other hand, some padlocks can be opened by professional shims with relative ease and by the average homemade shim with great difficulty. Try both and see what works for you.

Combination Padlocks

The quickest way to open a combination padlock is to shim it. See above.

There is a HUGE variety of combination padlocks. The industry standard is the Master Lock silver padlock with the black and white dial. They’ve significantly improved over the years. I will give credit where credit is due, Master Lock has greatly improved their security over the years.

This trick worked when I was back in high school, it will probably work on any Master padlock made in the late 80’s to the early 90’s.

To get the first number, pull on the shackle, turning the dial to the left until it stops moving. Add five. To get the second number, reset the lock (spin it a bunch of times), enter the first number, turn to the right past the first number, now start pulling on the shackle as you continue to turn. Eventually it will stop and lock up. While locked up, pull on the shackle and try to turn. If it’s loose, keep going. If it’s very stiff, that’s the second number. For the last number… Enter in the first two combinations, then slowly turn the dial while pulling on the shackle. Eventually it will unlock. Remember, this only works on older Master Locks.

You can try the following for all but the very newest Master Locks. Sometimes it works, sometimes it doesn’t.

Reset the lock (spin the dial a few times). Stop on zero. Apply steady, firm but not insane tension on the shackle. Turn the dial slowly clockwise, eventually it will seize up. Write down the number (it might be between two integers, if so add 0.5). Now start turning counterclockwise. It will again seize up. Write down the number. Add the two numbers, divide by 2, this is your seize point. Release the shackle, turn the dial clockwise one number past the seize point. Reapply tension, repeat the process. You should get 12 seize points. Be sure to write them down.

Once you have found all seize points, knock off any that are not integers. You should have five left. Four of the five will share the same last number. The one of the five that does not share the same last number is the third number of the comination. Divide the third number of the combination by 4, write down the remainder. Now, write down the remainder (and mark it AS the remainder), and start a sequence of adding 4 until you reach the limit of the dial. For example, if your remainder was 2, write down 2, 6, 10, 14, etc. Mark this sequence as possible first numbers of the combination.

Now, if your remainder is 0 or 1, add 2. If it was 2 or 3, substract 2. Start a new sequence, starting with the number you just got. Now continue the sequence by adding 4 to it until you reach the end of the dial. Mark this sequence as possible second numbers of the combination. Remove any numbers within two digits of the third number of the combination. Now, generate a list of all possible combinations from the sequences and the known third number. Should be a total of 80 possible combinations, which is why you want to try to shim the lock.

You can also put the third number of the combination into this website and it will generate a chart for you:

Wafer locks

Wafer locks are similiar to pin tumblers, except they are thin slabs of metal and much closer together. They’re very common in furniture type locks, usually in desks and filing cabinets.

Buy a try-out key set, also called a “jiggler set”. Insert try-out key, jiggle, turn the lock. Very straight forward. There are some specialized picks that can be used, but most often try-out keys are quicker and just as efficient.

One note. Often in office environments, the plug is removable by an extra pin at the end. This ‘master pin’ is the only thing actually holding the entire plug inside the enclosure. if those is the case: use a short hook pick, feel to the end of the wafers, press up, rotate the pick, the plug will come free. You can either flip the pick around and use the other end to open the lock, or (my favorite) insert a new plug to which you have the key.

Pin Tumbler Padlock

See the following entry. Pin tumbler padlocks are opened the same way as a pin tumbler cylinder door lock. These seem to be the most popular padlock for sale in most standard hardware stores and big box stores.

Pin tumbler cylinder

These are the most common locks, just about everywhere except the cheapest and most expensive locks.

See the introduction to lockpicking to get down the basics. Now onto slightly more advanced topics.

Raking. Every beginner does this more or less accidentally. If you are starting off, use only a hook pick to prevent this. A hook helps only raise one pin at a time. Raking does the opposite, you scrub the pins like you are brushing your teeth. But try to do this somewhat more slowly. Regardless of how you wish to rake, insert your rake pick to the rear of the lock and then apply torsion. There are two ways of raking.

First is fast and sloppy is to rake the pins back and forth a few times. If it doesn’t open, release the torsion and restart. The second, slowly rake holding the pick at an upward cant putting more pressure on the pins, but not to an excessive degree. Do this a few times, back to front. If it doesn’t open, slowly release some torsion until you hear the first click. Then repeat the slow back to front raking. You release the torsion because you are jamming pins above the shear line and by releasing some torsion, you are allowing those pins to release but not resetting all of the tumblers. Raking is very hit or miss unless you have a significant amount of practice on a particular type of lock. You might pop the lock much quicker than picking each tumbler individually, or it might take much longer.

Bumping is the most advanced and easiest form of picking a lock. Ever seen those desktop toys with steel spheres are suspended by two wires each? Pick a sphere on either end, slam it into the other spheres, and the sphere on the oppose end goes flying, but the center spheres don’t move? It’s also how billiards works. Basic Newtonian physics. This applies everywhere, even in locks. Bumping borrows on this. Take a key (any key that fits), shave all points down to the minimum depth. You’ll have a row of low even triangles. Optionally and optimally, the first point (furthest from the handle) is slightly higher. But it doesn’t matter too much. Take your shaved key, insert it into a lock all the way, move it back one click, turn it slightly, whack it with a rubber mallet, plastic handle or whatnot. The lock, with practice, pop open.

Believe it or not, bumping works better and quicker on more expensive locks. It often doesn’t work on the cheapest garbage locks. Why? Tolerances. Tighter the tolerance, the better transfer of energy. So, if you have a lock with loose tolerances, it is easy to pick. If you have a lock with tight tolerances that is annoying to pick, it’ll most likely bump pretty easy. Even Medeco High Security locks used at places like the Pentagon, NSA, White House, etc are susceptible to bumping even when they are near impossible to pick. And boy were a lot of said customers happy when “Open in 30 Seconds” was released.

You can probably bump 60% of all pin tumbler locks with a homemade key run through a grinder and the handle of a screw driver. But professional bumping tools are dirt cheap. Buy a Brockhage for $20 and a set of bump keys for $30, and you’ll be able to open 90% of all pin tumbler locks in a few seconds.

A quick word about “lock guns”. They’re often advertised as being the most effective and quickest means of opening a lock. They’re expensive. They’re reliable too, the first time. They’ll open a lock, and maybe destroy it in the process. A lot of ‘professional locksmiths’ use them for opening people’s doors when they’re locked out. They look impressive, expensive and PROFESSIONAL. One in 20 times, they’ll wreck a lock. Sometimes less, sometimes more. Guess it’s hard to charge people an arm and a leg for using $20-50 worth of key bumping to safely open a lock when you can use a couple hundred dollar gizmo that might destroy it. But hey, if you destroy the lock, might get to sell the customer a new one! One that wasn’t so “cheaply” made that it just fell apart for no reason at all…



Unofficial MIT Guide to Lockpicking – Ted the Tool (Sept 1, 1991) – Other books and references existed long before the MIT Guide, but it’s arguably the most popular and should be creditted as a very diverse guide. Highly recommended, anyone interested in physical security should read this first.

CIA Lock Picking, Field Operative Training Manual – Author unknown? – Allegedly written by the CIA. Who knows, I doubt they’ll exactly claim credit for it. Pretty good condense, good material for disk tumbler locks.

TOOOL Bumping Guide – Barry Wels, Rop Gonggrijp (Jan 26, 2005) – Excellent, definitive guide on bumping locks

Locks, Safe and Security (aka LSS+) – Marc Weber Tobias, J.D. – $200 from, sounds expensive? No, not in the least. You’re getting 3700 pages of information. It covers everything from ancient Egyptian locks to modern locks. If you want to get into lockpicking, buy this eventually. Doesn’t have to be your first lockpick reference, but you really want this book.

Stores – Pretty good store that sells lots of good stuff. You might save a dollar or two elsewhere, but these folks have never screwed up a single order I’ve placed with them. Very fast delivery and a large selection of product. Search around online, they usually have discount codes. – Bargain brand, but still very functional. I recommend them for folks just starting out. I still use my first picks I got from them. – Peterson, higher price and quality – Southern Specialities Co – Decent quality, decent prices, high shipping costs – Direct sale store for Brockhage Locksmith Tools, sell Brockhage bump hammers, will not

sell bump key sets – Bump key sets

Lockpick set recommendations

If you are new and want to get into lockpicking, do not buy an expensive kit. Please don’t. Buy something simple. I really recommend making a kit by buying individual picks and torsion wrenches. Buy a couple different picks from different manufacturers, buy a whole mess of torsion wrenches, and pick which ones you like. But if you HAVE to buy one, go with either of the following, or the cheapest other kit you can find. I don’t recommend it, mind you, I’m just pointing them out at the least worst alternatives.

Southord PXS-05L – $16.50 – Four picks, one torsion wrench, one book

Southern Specialities BPS-6 – $9.95 – Four picks, one wrench, one book

Read More