This page is about the locks themselves. Expect to learn about the technology of mechanical keyed locks and some tips about picking them. I
focus mostly on high security stuff these days so you'll probably see mostly that sort of thing. Random lock-geek exam:
Check out this picture and see how many locks you can identify.
Click the image to the left to see the Lock Mechanisms page. This page breaks down some of the elements of lock design that are common across several locks. I plan to discuss and show features like
sidebars, sliders, profile pins, keyways, etc... If you see some terminology while browsing this site that you don't recognize, try checking here.
Favorite Unpicked Locks
Evva MCS Animation in 3D
In an effort help myself and others understand how this beast of a lock works, I made this short animation in Blender.
You might have to pause it to read the text in a couple of places. Also, I didn't render it super high-res or with fancy
reflections, ambient-occlusion, etc.. These issues will be fixed soon and hopefully the next version will have a better
flow and look prettier. Its pretty neat now, though.
The "Magnetic Code System" is a magnetic lock made by Evva in Austria and Zeiss Ikon in Germany. The way I understand it is that the lock was
a joint project between the two companies and a university. It is most likely the most secure keyed mechanical lock in the world
and has some interesting features.
The bitting is determined by a series of magnets crimped into the sides of the key blade. These are magnetized
through-the-axis (rather than through-the-plane like most other disc magnets). The rotational orientation of these fields forms the
bitting of the key. There is also some active/passive pins on the key edges but they do not significantly contribute to the security and
are easily picked. The magnets in the key align with cooresponding magnetic rotors in the lock. This rotates the rotors to the correct
angle such that small gates on the rotors are pointing toward the rear of the plug.
This magnetic bitting is enforced by a unique sidebar assembly. The sidebars themselves have several square protrusions that normally
align which matching ribs on the inside surface of the shell. This means that trying to rotate the plug with the sidebars in their
default positions, the sidebars will hit the matching ribs in the shell. In order to clear these ribs and allow the plug to rotate, the
sidebars must be able to slide forward (toward the plug face) by about 1/8 of an inch. Now, sidebars moving forward when the plug is turned (as if by a key) is not a natural motion.
This action is created by profiled rings that slip
around the plug and are held in place by the profiled inner surface of the shell. These rings do not rotate with the plug; their only function is to
turn the rotary motion of the plug into a forward-sliding motion of the sidebars.
This odd forward-sliding sidebar system is kept aligned by plastic guide pieces. On the other side (toward the keyway) of these pieces, there
are metal strips that connect to the sidebars through holes in the guide piece.
Whenever the sidebar moves, these strips move as well. These
metal strips are the part of the sidebar assembly that actually interfaces with the magnetic rotors to enforce the bitting. Small prongs are punched
out of them and these sit between the rotors. If the rotors are correctly rotated, these prongs can enter the gates and allow the sidebar to slide
forward (and clear the ribs in the shell) allowing the lock to open.
The thumbnail on the left links the animations that I made. There are other resources for understanding this lock and I recommend checking
them out. Evva themselves have excellent 3d animations of their cylinders including one for MCS. Eric Schmiedl also has some great images of
an MCS cutaway. N2oah's MCS page has been around for years and has good photos as well. Don't be surprised if you come across
MCS photos that look different from one another. There have been several varations over the years but the fundamental mechanism is the same.
Assa Twin 6000 Picking Tips Video
I picked this one up from a locksmith in Arizona while driving to San Diego. Its a tough lock that features security pins and a wicked sidebar. Thus
far, I've picked it with all 5 serrated sidebar pins + 5 out of 6 normal double-spooled pinstacks installed. If you click the image to the left, you can
view a video I made about picking this thing. Although I haven't picked it fully pinned yet, I learned a lot so far. The video walks through picking it
with one normal pinstack and one sidebar pin installed. Also, if you have any tips for picking this thing, let me know. Almost there...patience.
Abloy Protec Animations in 3D
I spent some time in my favorite 3D modelling and animation program building a full model of the infamous Abloy Protec disc lock. No one has
picked this open to my knowledge (although a recent advance in the locksport community by tjweaver84 may change that). I did not fully understand
how this lock worked until making these animations. I think many other folks are in a similar kinda-get-it state in regard to understanding Protec.
Hopefully. these animations will help. They are AVIs compressed with DivX for quick downloading. I did not have my own Protec 330 padlock with
me for reference, so the shapes of parts may not be totally accurate. The reference for the disc shapes was Han Fey's Protec Paper. The reference for
most of the other parts were photos taken by tjweaver84 and others.
Full - All parts in place, shell and plug translucent; gives an overview of mechanical operation.
Inside Discs - Gives a view of the discs looking into keyway, return bars also shown.
Outside Discs - Shows gates in discs lining up with sidebar.
Disc Controller - Demonstrates how the DC checks for dimples in the key, also shows profile plate.
Zero-Discs - These move the return bars into the anti-picking position.
Progress on Evva 3KS
I have not picked this fully-pinned yet and am working on it. It's pretty much the most advanced "laser track" wafer lock out there and has become my picking obsession. It looks
like a jungle-gym of metal posts inside the keyway and there are no springs to feel for. Its also a lot of fun to pick at. I've been removing and
reinserting various wafers and learning as much as possible about how to manipulate this thing and what to feel for. Soon, I'll start working
at it fully pinned. So far I have picked this lock with 10 out of 12 wafers with 5 on each sidebar. Quick tip: Be careful not to let your
tension wrench interfere with the sidebar legs at the front of the keyway. I plan on doing a picture-filled breakdown of this lock once I pick it,
but in the meantime N2oah has a good page that explains how the 3KS works.
Favorite Picked Locks
In this section I will be showing, breaking down, explaining, and offering tips about various locks that I have opened. This page will be presented
in a somewhat blog-like format. The more recent entries will be toward the top of the page.
Home Machined 7 Pin Cylinder
Here is a neat one; I built a working pin tumbler lock cylinder from scratch. I used my
lathe/mill/drill machine to turn some rough round aluminum
stock into a neat little lock. It has many flaws but is still fairly hard to pick open. The plug hole is tilted,
the pin spacing is off, and pin
chambers are a little off-axis. I have not built a tailpice for it yet, but thats coming soon. Also used some automotive feeler gauge to produce
the key. The pin chambers are tapped to allow grub screws to be used as spring covers (Medeco, this is a great design feature).
The keyway was cut straight
with a hacksaw and I stamped my initials on the plug face where the manufacturer logo would typically go. I learned a lot machining it and plan build more
as time permits. I also have an idea for a theoretically pick-proof lock that should be pretty simple to build. When I persue it, I'll update here. In any
case, this cylinder is coming with me to Defcon to try entering it in the points competition.
Keso Gemini Knockoff
This one is a rim lock found around here (Ethiopia) for "high security" gates. After multiple places telling me that these locks cannot be procured locally,
I stumbled upon one. The brand is ANLI but the box strangely reads "Cross Key"; I thought there would be cruciform cylinder inside, but when
the shopkeeper showed it, it was this. The key is checked on three sides by standard pin tumblers. There are 4 pins on each of the flat sides
and a single pin on top that checks the edge. It is admittedly more difficult than the standard single-row dimple locks around here, but a
half-diamond gets it open pretty quickly. There is no warding on this one like there is on the installed security gate locks I've seen, though. So I guess that
makes it a Chinese knockoff of a Chinese knockoff of a Keso Gemini (Kaba Gemini pins contact the key at a slight angle, Keso uses 90 degrees). I put the
lock in this section because it is, by far, the most secure pin tumbler lock sold in this region.
Went to a local hardware store and picked these cylinders up. The NTT is a plain-jane 5 pin lock that is one of the
sloppiest I've experienced. I has that Master #3 effect of being so sloppy that it makes it a little harder to pick than
expected. The "Vachette" dimple lock is a little better but not much. It is very likely that it is a fake;
the key is also stamped "Italy" on it (Vachette is French). I will grow this entry
as I buy and pick more of these local/imported locks. Hopefully I can get the
cruciform padlock open and add it here as well. Picked up a new "ZANI" brand
5 dimple-pin euro which gave me a bit more trouble than than other one. Also grabbed a disc detainer padlock by the name
I had a chance to ride around town in search of some locks today. Ended up visting two locksmiths/hardware stores
in search of anything resembling high-security cylinders. This was as close as I could come (all double-ended):
Geo, Domus, and GSM. I don't think they have any security pins and are 5 pin except for the Domus which is 4. They
don't SPP as readily as one would expect but crumble when faced with a Bogota and light pulsing/feathering tension.
They were all selling an Abus disc-tumbler knockoff padlock which I decided against buying. I may go back for it later and
also seek out some more high-quality stuff. I've seen Tri-Circle padlocks, Iseo, Kaba, and a few others around that I'd
like to find the shop for.
TOOOL Euros at Defcon
The guys from TOOOL USA were kind enough to bring along some Euro cylinders to Defcon 16 and let me have a go at them. Most of them were part of a contest that
lasts throughout the year in which competitors try to get the best time of each lock. The cylinders are passed from one TOOOL chapter to
another and the members try to get blistering times (you can tell they've been picked hundreds of times by the look of em too). I didn't go
for speed but managed to pick Fichet, Pfaffenhain, Winkhaus, Abus, Iseo, CAS, Buva, and a few others in about half an hour. I took pictures as
I went and strung them together in the picture to left (be sure to click it for the full-size version). I'd like to get hold of more of these sorts of
locks; they have a good solid feel to them and the higher-quality ones can make for a difficult and fun picking time. This year's contest locks' best times
can be found here.
I was finally able to pick a Mul-T-Lock at The Last Hope conference in New York. Matt Fiddler allowed me to borrow his H&M MTL picking
tool and a cylinder. It took some effort to calibrate the tool and get used to it, but once I did; I was able to pick a Mul-T-Lock Classic! A big
thank you goes to Matt for helping me hit this milestone. Mul-T-Lock (almost all models including this one) are a type of dimple lock that
utilizes what are called "telescoping pins". This means there is another tiny pin stack inside each of the 5 pin stacks. I refer to these as
"inner" and "outer" respectively. I also own a cutaway of this lock produced by a great guy named
Locknewbie21 and have picked it many times. I still, however, have not opened a non-cutaway MTL with "normal" tools yet.
Assa Twin V-10
Got this one one from Eyes_Only in trade for a tool. I was quite excited to get it open the same day, but it is no joke. Those pin stacks
are a pain and forced me to visualize and pay attention to false sets like no other lock I've dealt with. The sidebar is also difficult due
mainly to the serrations and its ability to get picks stuck (like most dimple locks). The cylinder features 6 pin stacks all with double
spooled security drivers. The sidebar interfaces with 5 serrated sidepins who's heights are set by a bitting on the side of the key
(similar to Schlage Primus but without a rotation component). Click the image to the left for a
Medeco Classic with ARX
Wow this one has been on my Not Picked List for far too long. It features 6 non-biaxial pin stacks
and a sidebar. The aspect of this lock that really got me was the ARX pins. I have developed a decoding and picking tool for Medeco
over the last several months and have had a lot of success with it. These special extra picking-resistant ARX key pins are immune to
this tool/technique and thus I had to explore further in order to defeat them. This style of pin is typically found only in Medeco cylinders
used in the most secure applications (mostly government) although anyone can specify them while ordering. Well, I finally picked the
thing and thus completed my conquest of Medeco's main lineup of cylinder technologies. I figured it would be a pushover compared to
its big brothers (the Biaxial and m3); I couldn't have been more wrong. The image on the left links to a
This was part of a trade with ilmr of lp101. It is a double euro lock made by Evva that boasts some pretty neat features. The first thing
you notice is the distinctive key. It has oval-shaped profile cuts on its right side that align with a custom sidebar in the lock. This forms
a passive sidebar system that ensures a key with the correct side profile is used. In most systems of this type, one could easily mill
down the side of a blank to bypass this key control feature. However the DPS has a nasty surprise for any would-be exploiters;
a movable plastic insert in the sidebar. This element can freely move radially inward and outward and when the correct side profiled key
is inserted, it presses it out. If this does not happen when the lock is opened and turned counter-clockwise to about the 120 degree
mark, the 3rd driver pin in the bible will spring downward forcing the movable element inward; effectively trapping itself and practically
locking up the plug permanently! You can read about this lock in Han Fey's article Cutaway
Cylinders and Their Locking Technique where he refers to this mechanism as the "Evva DPI" (I suspect DPI and DPS are two names
for the same cylinder). This lock was quite a challenge to pick due to the nasty keyway and spools. A very similar cylinder is the
Zeiss Ikon Sperr-Rippenprofil (click for picking video). This one uses passive and active pins rather than sidebars and
doesn't trap nearly as craftily.
I ordered this one a while back after picking the Biaxial. This is it. This is Medeco's new baby and I finally opened it. By checking out
my breakdown you can see some good details about this particular lock including the bitting.
It features 6 pins; of which 4 are mushroom security drivers. It also features a sidebar and the key pins are biaxial and have false
rotational gates. The big feature that Medeco added with the m3 was a "slider" which must be move forward by a step on the key.
This element is primarily used for key control and is relatively easily defeated. This is one of my favorite locks to pick. Here is a
video of me opening it (without Medecoder).
This was the first full 6-pin Medeco that I picked. I went to a local lockie shop a while back and
got talking about locks. After buying a Mul-t-Lock
Interactive, mentioned that I was looking for old Medeco cylinders. After revealing that my intention was to pick them, the owner
gave me this one for free and said something like "don't think you'll ever open it". Well, about 2 weeks later, I had opened it for the first
time. This inspired me to keep going and attempt to find an easier way to open these locks; resulting in the creation of my Medecoder
tool. These locks feature 6 pin stacks and a sidebar. What makes Medeco so high-sec is that the pins must both lift to the shearline (like
a normal lock) and also rotate to one of 3 angles. The key cuts are actually made at angles so as to interface with chisel tips on the key
pins. When all of these pins are rotated properly, a blocking element called a "sidebar" is allowed to drop into grooves cut on the sides
of the pins. Once this sidebar is retracted (no longer blocking rotation of the plug) and the pin stacks are lifted so that the drivers are
no longer blocking the shearline, the plug will turn and the lock is open. Click the image to the left for a
breakdown of this lock. Also, if you're interested, here is a video of me
picking this lock before I fully developed the Medecoder.
DOM ix 10
Scored this one from Ebay. I thought for several days that I'd be forced to make special tools to pick it. I then disassembled it
and tried out different picks to see which ones worked the best (manipulate individual pins, provide feedback, minimal profile, etc...).
After deciding that my Peterson half-diamond would be best, I reassembled and
picked it in one try. I think it was mostly a confidence issue and looking at the problem from a different angle really helped.
This is what's known as a "dimple lock". The bitting is on the flat sides of the key rather than the edge and look like...well; dimples.
This one employs 9-pins, but could use 10 if a different plug was installed. Three of these pins are spools and many of them use a
small blade tip rather than the usual large round/pointed tips found in typical pin tumblers. mh of LP101 was able to identify this
particular model of DOM.
Corbin-Russwin Mortise Cylinder
I stopped by a local locksmith shop when on leave in Texas. They sold me this after some discussion about locks and picking.
It features 6 pins, 5 of which are spools and a paracentric keyway. It's a good solid intermediate-level lock; I have heard that
Sargent cylinders are about on par with these. So if you're looking for something middle-of-the-road or a bit harder than Schlage,
it might be worthwhile to look for these.
7-Pin Security Bag
I was browsing around in the aisles of Office Depot one day when I spotted this thing.
The product description
proclaims "high-security, 7-pin tumbler" and looked very intimidating. So I purchased it under the assumption that
it would provide weeks of frustration. I honestly expected it to be a real challenge. I managed to get it open that day and am pretty
consistent with it now. It doesn't seem to contain any security pins, but I do recommend using a euro hook or something similarly
sized. This will allow you to reach under all of those pin stacks in order to lift the one way in the back. This bag is made by
MMF Industries (yeah I had never heard of them either). I should also mention that it
makes a great little carrying bag for locks.
I decided to pick this one up after reading about how unique it is on LP101. It is similar
to a Master 140 in that its a 4 pin lock and typically contains 2 spool pins. What makes this lock strange is the tension required to
set pins. Usually, when picking a lock, you want to use a little tension as possible. Because of the weight of this discus shackle,
this cylinder requires a lot of tension to set pins. Myself and many others have found that you should really torque this thing while
picking. The spools are really shallow so you don't get very much plug counter-rotation when coming out of false sets. What is
experienced (under heavy tension) is a loud audible *click* upon a false set and another upon the real set. I recommend learning
these after you are comfortable picking most of the Masters, Kwiksets, and maybe Schlages. The R70 has the potential to teach
bad habits early on, but its still a fun lock to open.
This was the first model of lock which I picked. The Master #140 is a good lock for a beginner that is looking to step up a bit from
the really loosey-goosey locks out there (like Chinese knockoffs and Master #3s). It features four pins and two of them are typically
spools. The spools will cause a good bit of plug rotation when they false set. When this happens, lighten up tension slightly and keep
pressing the pin that false-set. If you start feeling or seeing the plug rotate in the direction opposite of the tension you are applying
(it will start trying to rotate counter-clockwise in this case), then you can be sure you are working on a
spool pin. After pressing the pin
up a bit, the plug will stop counter-rotating, keep lifting the pin. At this point the shearline is riding on the bottom ring of the spool.
A tiny bit of lifting later and you'll feel it set again and get some plug rotation. At this point the plug will turn and the lock will open. If not,
start checking the other pins for sets and false sets. Sometimes a single rake or two is all it takes to finish locks like these off once the
security pins have been handled.