Single-Pin Picking

One of the truest forms of lockpicking is single-pin picking or SPP. This is a technique used to open pin tumbler locks, but can also be used for other types. It not so much a specific method as it is a general approach. The goal is to open the lock while knowing exactly what is happening inside at all times. By persuing SPP, a picker is striving toward this level of awareness and tries to eliminate elements of luck during the process. Sometimes SPP is combined with a technique called raking. Raking is basically scrubbing the pin in different ways to open the lock by a combination of skill and luck. Single-pin picking is generally slower than raking, but is possible on almost every pin tumbler lock out there. Generally, if the lock is not opening under SPP, it is entirely up to the picker to improve his/her skills.

How Pin Tumbler Locks Work

Pin Tumbler locks are simple devices consisting of a cylinder called a plug inside a housing called a shell. The idea is that the plug should only be able to turn inside the shell if the correct key is inserted. If no key or an incorrected is inserted in the keyway (an intricate slot shaped like the key's profile that runs the length of the plug), then elements of the lock will block the plug from turning. A correct key will interact with the elements in the lock to allow the plug to turn inside the shell. In normal everyday pin tumbler locks, the elements that block the plug's rotation are called pin stacks. They consist of a series (usually 4, 5, or 6) of holes called chambers drilled through the shell and into the plug. Inside each of these chambers is two cylindrical pins stacked on top of each other and under pressure from a spring (which is in the shell).

The key lifts these pin stacks so that the separation between the two pins in each chamber meets the edge of the plug and shell hole (where the plug resides). This split in the chamber is called the shear line. If a pin stack is not lifted high enough, then the driver pin/top pin (pin furthest from the keyway and touching the spring) will be half inside the shell's chamber and half-inside the plug's chamber. If a pin stack is lifted too far, then the key pin/bottom pin will be at this intersection. Both of the situations cause the plug to be blocked from turning. Only when all of the pin stacks are lifted perfectly so that the split between the drivers and key pins are right on the shear line will the plug turn and the lock open. Each of the valleys or cuts in the key correctly lifts a pin stack in its lock. You can quickly determine how many pins a lock has by counting its key's cuts.

The Problem: Tolerances

I will now explain why locks are not perfect and the biggest vulnerability that can be used to open them without the key. Lets imagine a typical 5 pin house lock with no extra security features. If there is no key inserted, all of the pin stacks are pressed down (toward the keyway) fully by their springs. If you insert a screwdriver and try to turn the plug, the 5 drivers will all block this from happening. Now if you insert a blank key (a full key that fits with no cuts in it), all of the pin stacks will be lifted as high as possible. If you try the screwdriver again now (or the blank itself), unless the lock happens to be pinned for a blank, all 5 key pins will block plug rotation. If locks were perfect, picking would not be possible. Every pin stack would block plug rotation equally and the plug could only turn if all of the pins are lifted simultaneously (i.e: with a key).

However, locks are not perfect and tolerance errors make the reality of lock operation slightly different than their design. Tolerance errors are an inescapable fact of manufacturing and it basically means that machining operations can never be perfectly peformed. These issues are also created or made worse by normal use. The longer a lock is in use or being picked, the sloppier the tolerances will get. Here are some of the issues that make picking possible: Chambers not all same diameter, chambers out of alignment, chambers drilled at different angles, plug has slight taper or twist, shell has slight taper or twist, pins different diameter, etc... All of these discrepancies are very small and are likely not noticable by the human eye, but they make a mechanical difference. They create a situation where only one pin stack is actually blocking plug rotation at a time. Sidenote: In reality, the elasticity of the metal may cause 2 pins to block at a time. The pin that is blocking rotation at a particular time is referred to as the binding pin.

Overview of Picking

So how can we exploit these tolerance errors to open a lock? We can set pins one at a time instead of all at once. Setting a pin is the act of lifting a pin stack to the shear line (correct height) in a way that causes it to stay there. Once a pin is set, we can move on the next. When we set all of the pins in the lock, it will open. The way to make the pins stay set after correct lifting is to apply tension. Tension is the lockpicking term for putting rotational pressure on the plug. The basic technique is to apply tension with a tool called a tension wrench and then use a lock pick to lift each pin one at a time until they set. The trick is to understand that you can only set the pin(s) that is binding at that time. You can't just choose any pin and lift it under tension to make it *click* (the sensation of a pin setting). Once you set a pin, another will bind (block plug rotation). Continue this process until the lock is open. The sequence in which the pins bind (and hence must be set) is called the binding order and is unique to each lock. For SPP, we are likely going to use some form of hook pick.

Tension

Tension is the turning force which must be applied to the plug in order to make pins set. There are quite a few types of tension tools used in lockpicking, but the standard tension wrench is a strip of steel roughly 1/8th inch wide and 3-4 inches long with a 90 degree bend in it. A common variant has a twist in the handle for comfort. One of the most useful modifications is to add serrations on the working end which allows the tool is grip the keyway and prevents slipping. These types of tensioners are designed to fit the bottom of the keyway with the handle pointing off to the side. Resting a finger on the the handle provides the tension needed to pick. There is another popular type of wrench called flat tensioner which is designed to be used in the top of the keyway with the handle pointing up. In many cases, using flat tensioners frees up more space in the keyway for the pick to move around. Using a tensioner that fits the keyway nicely and snuggly can greatly help during picking.

There has been much written about the correct amount of tension to use. One thing is clear: controlling the amount of tension you are applying is very important in picking. A common idea is that you should use the lightest tension possible while still being able to set pins. Also, different lock will require different amounts of tension. When I start picking a lock, I like to find a binding pin by applying heavy tension. I then try to lift it while slowly letting off tension until I am able to lift the binding pin in a controlled manner. Some folks do the opposite and start with no tension and gradually increase it until they detect a binding pin. If every pin in the lock is springy and just comes right back down after being lifted, you are applying too little tension. If the binding pin is impossible to lift (its stuck), you are applying too much tension. Most people (especially beginners) have a tendency to go too heavy on the tension.

Lifting Pins

Next we'll talk about the act of individually lifting pins up in order to "set" them. Getting comfortable holding the pick is the first step in being able to feel your way around the inside of a lock. The most common "proper" way to do this is like a pencil with your index (or middle in my case) finger resting on the top of the pick's shaft. When you first start picking for long periods of time, the pad of this finger will get sore and may even bleed, but over time you'll develop a little callus there. After you've found a grip that is comfortable, its time to get a feel for the pins. Starting from the back of the lock and pulling outward while keeping a loose grip on the pick will allow its tip to ride over the pin tips. Try counting them without lifting anything; then try moving from pin to pin while keeping track of which one you're on. By practicing this sort of thing enough, you'll eventually be able to just choose a pin and know exactly how far into the lock it is. These depth perception and counting pin exercises alone will help a lot to cure what I call keyway chaos. When faced with a new type of lock, every beginner and many advanced lockpickers experience this phenomenon (the feeling of having no idea what is going on inside the lock). If you have tried these exercises for a while and are still experiencing this keyway chaos, try removing a few of the pin stacks and then add them back in later.

Once you have a good feel for where the pins are and what they feel like on the end of a pick, its time to try lifting some up. There are two popular ways to do this: levering and straight-lifting. Straight-lifting is what most newbies try first, but I find it is not the best for most situations. To straight-lift, simply position the pick tip under the center of the tip of the pin you wish to lift; then lift the pick up while keeping it horizontal. Levering involves positioning the pick tip under the target pin as well, but the method of lifting it up is different; you choose a point under the shaft of the pick and use it as a fulcrum to lever the pick tip up. This pivot point does not necessarily have to be a physical one and can exist anywhere as long as you lever the pick in that manner. Keyway warding can present a challenge while lifting pins (especially in very paracentric keyways). You can either try to snake the pick through the warding as you lift, or you can try to lever it off a ward. In the nastiest keyways, it is sometimes necessary to lever off one ward, keep the pin binding, remove the pick, and reinsert it higher in the keyway to continue the lift. These details that I've given here are merely my own experiences; in the end, if it feels comfortable and you're setting pins, you're doing it right :-)

Pin States

Now that we know the basic steps involved in picking, you may be asking yourself: How do I find a binding pin? This is a very important skill in picking and will likely take more practice than anything else (except perhaps tension control). While picking, you should be moving from pin to pin one at a time identfiying what the state of that pin stack is. This builds a mental picture of the lock. Pins that feel springy when pressed up (under tension of course), are unset pins and also are not binding. These should be ignored for the time being, but not forgotten about. You now know that those pins will have to be dealt with later. Other pins will feel completely loose (no resistance which is hard to feel for) and non-springy up to a certain lift height. Once you try to press it higher than that, it will feel like it has hit a wall. These are indications of a set pin, but be careful; it might be a false set. We will discuss false sets and the security pins that produce them later. Your goal is to bring every pin in the lock to this set state. The state we are searching for is binding. You can recognize this state because when you lift a binding pin, you will feel resistance/stickiness. This is the friction of the shear line pressing on the top pin as it being pressed up. The resistance you feel will be proportional to the amount of tension applied. This same feeling will also happen if you have gone too far and overlifted a pin. However, if you are careful and stop lifting a binding pin when it *clicks*, the pin will no be overset.

Security Driver Pins

There are a lot of ways that lock manufacturers can make their cylinders harder to pick. By far, the most common are security pins. These are typically replacement pins that are substituted in for some of the driver pins that are designed to make picking and other attacks more difficult. Different types will impact picking difficulty to various degrees. Some security pins, like the shallow spools in Master locks, will only require a little paying attention to defeat. Others, like the nasty spools found in the Assa Twin 6000, will make picking seem impossible.

The most common type of security pin is called a Spool and is shaped like an empty spool of thread. When this pin is binding and being lifted, it will behave normally until the middle section reaches the shear line (unless it begins that way). At that point it will cause a false set which means that the plug will be allowed to rotate slightly and a "click" will be felt. If very light tension is used this false set can be skipped over, but that is quite difficult. I prefer to allow these false sets to happen and then identify them. You can recognize a false set on a spool pin by continuing to lift the pin up. If the plug begins to counter-rotate (turn in the direction opposite the applied tension) before clicking again (and making the plug rotate back over in the correct direction), you can be resonably sure that the pin was a falsely set spool but is now properly set. On the other hand, if further lifting only produces counter-rotation but no extra "click", the pin was not a spool and you can release some tension to correct the overset you caused by testing it. Now the next time you set that pin, you can be sure its a real set.

Another type of security pin is the Serrated pin which has multiple "rings" that can cause false sets. These can be handled in the same way as spools, but are typically much more difficult and a certain amount of guess-work and instinct is useful in distinguishing false from real sets. A more rare type of security pin that Medeco loves to use is a Mushroom pin. These are shaped like their name implies with the big "cap" end toward the keyway. The effect of lifting these pins under tension is that they will rock over/turn slightly-sideways in the pin chamber. This action combined with the shape of the cap causes the plug plug rotation and false set to sort of "lock" in place. Typically, you can handle these the same way as spools in most cases, but some can stop the best pickers in their tracks. If you encounter a security pin that is completely "stuck" in a false set, there is always a last resort. You can physically rotate the plug in the direction opposite tension a small bit while lifting until the pin slips out of the false set.

Practicing

Getting better at SPP is a process that takes time and lots of trying. More important than time is focus. By this, I mean that when you are picking it should not be a passive thing. Your attention should be focused on the lock and constantly analyzing. You should be asking yourself about the state of the current pin, how many pins are set, which ones feel like security pins, what types of security pins, etc... Try picking in an order different than the first apparent binding order and see what happens. A very effective method of learning is what most of us call the digital_blue method. This is a practice method made popular by the admin of Lockpicking101.com that involves picking partially-pinned locks and working up. My favorite way to do this is to remove all of the pins but 1 or 2 and then pick those, scramble them up, and pick them again. Once you feel that any 2 pin combination is "easy", add a third pin and repeat the process. Eventually you will be able to pick the fully-pinned version by following this method. If you are having trouble at the 5-pin mark, try going back to 4 for a bit. You can also try putting the 5 in a different subset of pin chambers; this may help you discover that the tool you are using cannot reach the last chamber without upsetting a pin in the middle, for example.