Ted the To ol
Septemb er 1, 1991
Copyright 1987,1991 Theo dore T.Tool. All rightsreserved.
Permission to repro duce this do cument on a non-prot basis is granted provided that
this copyrightand distribution notice is included in full. The information in this bo oklet is
providedfor educational purposes only.
August 1991 revision.
1 It's Easy 4
2 How a Key Op ens a Lo ck 5
3 The Flatland Mo del 7
4 Basic Picking & The Binding Defect 9
5 The Pin Column Model 11
6 Basic Scrubbing 17
7 Advanced Lo ck Picking 21
7.1 MechanicalSkills : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 21
7.2 Zen and the Art of Lock Picking: : : : : : : : : : : : : : : : : : : : : : : : : 21
7.3 Analytic Thinking : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 22
8 Exercises 23
8.1 Exercise 1: Bouncing the pick : : : : : : : : : : : : : : : : : : : : : : : : : : 23
8.2 Exercise 2: Picking pressure : : : : : : : : : : : : : : : : : : : : : : : : : : : 24
8.3 Exercise 3: Picking Torque : : : : : : : : : : : : : : : : : : : : : : : : : : : : 24
8.4 Exercise 4: Identifying Set Pins : : : : : : : : : : : : : : : : : : : : : : : : : 25
8.5 Exercise 5: Projection : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 25
9.7 PinDiameter : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 32
9.8 BeveledHolesand Rounded pins : : : : : : : : : : : : : : : : : : : : : : : : 32
9.9 Mushro om DriverPins : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 34
9.10 Master Keys : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 36
9.11 Driveror SpacerEnters Keyway : : : : : : : : : : : : : : : : : : : : : : : : : 38
9.12 VibrationPicking : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 39
9.13 Disk Tumblers : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 40
10 Final Remarks 42
A To ols 43
A.1 Pick Shap es : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 43
A.2 Streetcleaner bristles : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 44
A.3 Bicyclesp okes : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 46
A.4 Brick Strap : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 47
B Legal Issues 48
It's Easy
The big secretof lo ck pickingis that it'seasy. Anyone can learn how topick lo cks.
The theory of lo ck picking is the theory of exploiting mechanical defects. There are a
fewbasic concepts and denitions butthe bulk ofthe material consistsof tricksfor op ening
lo ckswith particulardefects orcharacteristics. Theorganizationof this manualreectsthis
structure. The rst few chapters present the vo cabulary and basic information ab out lo cks
and lo ck picking. There is no way to learn lo ck pickingwithout practicing, so one chapter
presentsaset ofcarefully chosenexercises thatwill helpyoulearn the skillsof lockpicking.
The do cument ends with a catalog of the mechanical traits and defects found in locks and
thetechniquesusedtorecognizeandexploitthem. Therstapp endixdescrib eshowtomake
lo ckpicking tools. The other app endix presentssome of the legal issues of lo ckpicking.
The exercises are imp ortant. The only way to learn how to recognize and exploit the
defects in a lo ck isto practice. This meanspracticing many times onthe same lo ck aswell
aspracticing onmanydierentlocks. Anyone can learnhowtoopendeskand lingcabinet
lo cks, but the ability to op en most lo cks in under thirty seconds is a skill that requires
practice.
Before getting into the details of locks and picking, it is worth pointing out that lock
picking isjust one way to bypass a lo ck,though it do escause less damagethan brute force
techniques. In fact,it maybeeasier to bypassthe b oltmechanismthan to bypassthe lo ck.
It mayalso b e easier to bypasssome other part of the do oror evenavoid the do orentirely.
Remember: There isalways anotherway, usually a b etter one.
How a Key Opens a Lock
Thischapterpresentsthebasicworkingsofpintumblerlo cks,andthevocabularyusedinthe
rest ofthis bo oklet. Theterms used todescrib elocksand lockparts varyfrommanufacture
to manufacture and from city to city, soeven if youalready understand the basic workings
of locks, youshould lo ok at gure 2.1 for the vo cabulary.
Knowing how a lock works when it is op ened by a keyis only part of what youneed to
know. You also need to know how a lo ck resp onds to picking. Chapters 3 and 5 present
mo dels which will help youunderstanda lock's resp onseto picking.
Figure 2.1 intro duces the vocabulary of real locks. The key is inserted into the keyway
of the plug. The protrusions on the side of the keyway are called wards. Wards restrictthe
setof keysthat can be insertedintothe plug. The plugis acylinder whichcan rotatewhen
the proper key is fully inserted. The non-rotating part of the lo ck is called the hull. The
rstpin touchedbythekeyis calledpinone. Theremaining pinsare numberedincreasingly
toward the rear of the lo ck.
The prop er key lifts each pin pair until the gap b etween the key pin and the driver pin
reaches the sheer line. When all the pins are in this p osition, the plug can rotate and the
lo ck can be opened. An incorrect key will leave some of the pins protruding between the
hull and the plug, and these pins will preventthe plug fromrotating.
The Flatland Model
In order to b ecome go o d at picking lo cks, you will need a detailed understanding of how
lo cks works and what happ ens as it is picked. This document uses two mo dels to help you
understandthe b ehavioroflocks. This chapterpresentsamo del thathighlightsinteractions
b etween pin positions. Chapter 4 uses this mo del to explain how picking works. Chapter 9
will use this mo del to explaincomplicated mechanicaldefects.
The "atland" mo del of a lock is shown in Figure 3.1. This is not a cross section of a
real lo ck. It is a cross section of a very simple kind of lo ck. The purposeof this lock is to
keeptwo platesof metal fromsliding overeach other unless the properkey is present. The
lo ck is constructed by placing the two plates over each other and drilling holes which pass
through both plates. The gure shows a two hole lock. Two pins are placed in each hole
such that the gap b etween the pins does not line up with the gap b etween the plates. The
b ottom pin iscalled the key pin b ecause ittouchesthe key. The top pin is calledthe driver
pin. Often the driver and key pins are just called the driver and the pin. A protrusion on
the underside of the b ottom plate keeps the pins from falling out, and a spring above the
top plate pushes down on the driver pin.
If the key is absent,the plates cannot slide over eachother becausethe driverpins pass
through b oth plates. The correct key lifts the pin pairs to align the gap b etween the pins
with the gap b etween the plates. See Figure3.3. That is, the key lifts the key pin untilits
top reachesthe lock's sheer line. In this conguration, the platescan slide past eachother.
Figure 3.3 also illustrates one of the important features of real lo cks. There is always a
sliding allowance. That is, any parts which slide past each other must b e separated by a
gap. The gap b etween the top and b ottom plates allows a range of keys to op en the lo ck.
Notice that the rightkey pin in Figure3.3 is not raised ashigh asthe leftpin, yetthe lock
will still op en.
Figure3.2: (a) Flatland key raises pins
Basic Picking & The Binding Defect
Theatlandmodelhighlightsthe basicdefectthat enableslo ckpickingtowork. Thisdefect
makesit p ossibletoop en alo ckbylifting the pins oneata time,and thusyoudon't needa
key tolift allthe pins atthe same time. Figure 4.3 showshowthe pins of a lo ckcan b e set
oneatatime. The rststepof thepro cedure istoapply asheerforcetothelo ckbypushing
on the bottom plate. This force causes one ormore of the pins to be scissored b etweenthe
top and bottom plate. The most common defect in a lock is that only one pin will bind.
Figure 4.3a shows the left pin binding. Even though a pin is binding, it can b e pushed up
with a picking to ol, see Figure 4.3b. When the top of the key pin reaches the sheer line,
the b ottom plate will slide slightly. If the pick is removed, the driver pin will be held up
by the overlapping b ottom plate, and the key pin will drop down toits initial p osition, see
Figure 4.3c. The slight movement of the bottomplate causes a new pin tobind. The same
pro cedure can b eused tosetthe new pin.
Thus, the pro cedure for one pin at a time picking a lock is to apply a sheer force, nd
the pin whichisbinding the most,and push itup. When the topof the key pin reachesthe
sheer line, the moving portion of the lo ck will give slightly, and driver pin will be trapp ed
ab ovethe sheer line. This is calledsetting a pin.
Chapter 9 discusses the dierentdefects that causepins tobind one at atime.
1. Applya sheer force.
2. Find the pin that is bindingthe most.
3. Push that pin up untilyoufeel it setat the sheer line.
4. Goto step 2.
Table4.1: Figure5: Picking a lock one pin ata time.
Figure4.2: (b) Picklifts the binding pin
The Pin Column Model
Theatlandmodeloflockscanexplaineectsthatinvolvemorethanonepin,butadierent
mo del is needed to explain the detailed b ehavior of a single pin. See Figure 5.1. The pin-
columnmodelhighlightstherelationshipbetweenthetorqueappliedandtheamountofforce
neededto lift eachpin. It isessentialthat youunderstand this relationship.
In order to understand the "feel" of lock picking you need to know how the movement
of a pin is eect by the torque applied byyour torque wrench (tensioner) and the pressure
appliedbyyourpick. A goo dwaytorepresent this understandingisa graphthat showsthe
minimumpressureneededtomoveapin as afunctionof howfarthe pin has b een displaced
fromitsinitial p osition. The remainder ofthis chapterwill derive thatforcegraphfrom the
pin-column model.
Figure 5.2 shows a single pin position after torque has been applied to the plug. The
forces acting of the driver pin are the friction from the sides, the spring contactforce from
ab ove,and the contact forcefrom the key pin below. The amountof pressure youapply to
the pickdetermines the contact forcefromb elow.
The spring forceincreasesasthe pins are pushedintothe hull,but the increaseisslight,
so we will assume that the spring force is constant over the range of displacements we
are interested in. The pins will not move unless you apply enough pressure to overcome
the spring force. The binding friction is prop ortional to how hard the driver pin is b eing
scissoredbetweentheplugandthe hull,whichinthiscaseisproportionaltothetorque. The
more torque you apply to the plug, the harder it will b e to move the pins. To make a pin
move, you need to apply a pressure that is greater than the sum of the spring and friction
forces.
When theb ottomofthedriverpin reachesthesheerline,thesituationsuddenlychanges.
See Figure 5.3. The friction bindingforce drops tozero and the plug rotates slightly (until
some other pin binds). Now the only resistance to motion is the spring force. After the
top of the key pin crosses the gap b etween the plug and the hull, a new contactforcearises
fromthe key pin strikingthe hull. Thisforcecan b e quitelarge, andit causesa p eak inthe
amountof pressureneeded tomove apin.
Ifthe pins arepushedfurtherintothe hull,thekeypin acquiresabindingctionlikethe
driver pin had inthe initial situation. See Figure 5.4. Thus,the amountof pressureneeded
to move the pins before and after the sheer line is ab out the same. Increasing the torque
increasestherequired pressure. Atthe sheer line,the pressureincreasesdramatically dueto
the key pin hitting the hull. This analysis issummarized graphically in gure5.5.
Basic Scrubbing
At home youcan take your time picking a lo ck, but in the eld, speed is always essential.
This chapterpresents a lo ckpickingtechniquecalled scrubbing that can quickly op en most
lo cks.
The slow step inbasic picking (chapter 4)is lo catingthe pin whichisbinding the most.
Theforcediagram(Figure5.5)developedinchapter5suggestsafastwaytoselectthecorrect
pintolift. Assume thatallthepins couldbecharacterizedbythesameforcediagram. That
is, assume that they all bind at once and that they all encounter the same friction. Now
considerthe eect of runningthe pickoverallthe pins with apressurethat is greatenough
to overcome the spring and friction forces but not great enough to overcome the collision
forceof the keypin hittingthe hull. Any pressurethat isab ovethe at p ortion ofthe force
graph and below the top of the peak will work. As the pick passes over apin, the pin will
rise untilithits the hull, but itwill not enterthehull. See Figure5.3. Thecollisionforce at
the sheerline resists the pressureof thepick, sothe pickridesoverthepin withoutpressing
it into the hull. If the proper torque is b eing applied, the plug will rotate slightly. As the
pick leaves the pin, the key pin will fall backto its initial position, but the driver pin will
catch on the edge of the plug and stay ab ove the sheer line. See gure 6.1. In theory one
stroke of the pickoverthe pins will cause the lock to op en.
In practice, at mostone or two pins will setduringa single strokeof the pick, soseveral
strokesare necessary. Basically,youusethe picktoscrubback andforthoverthepins while
youadjust the amount of torqueon theplug. The exercises inchapter8will teachyouhow
tochoose the correct torque and pressure.
Youwillnd that thepins ofalocktend tosetinaparticular order. Manyfactorseect
this order (see chapter9), but the primarycause is a misalignment b etween the centeraxis
of the plug and the axis on which the holes were drilled. See gure 6.2. If the axis of the
pin holesis skewedfromthe centerline of theplug, thenthe pins will setfrombacktofront
if the plug is turned one way, and from front to back if the plug is turned the other way.
Manylo cks havethis defect.
Scrubbing is fast b ecause you don't need to pay attention to individual pins. Youonly
need tond the correct torque and pressure. Figure 6.1 summarizes the steps of picking a
lo ckby scrubbing. The exerciseswill teach youhowto recognize when apin is setand how
to apply the correct forces. If a lo ck do esn't open quickly, then it probably has one of the
characteristics describ ed inchapter 9 and youwill haveto concentrateonindividual pins.
get a feel forthe stiness of the lo ck'ssprings.
2. Apply a light torque. Insert the pick without touching the pins. As you pull the
pick out, apply pressure to the pins. The pressure should b e slightly larger than the
minimumnecessary to overcomethe spring force.
3. Graduallyincrease the torque with each strokeof the pick untilpins b egin toset.
4. Keeping the torque xed, scrub back and forth over the pins that have not set. If
additional pins donot set, release the torque and start over with the torque found in
the last step.
5. Once the majority of the pins have b een set, increase the torque and scrub the pins
withaslightlylargerpressure. Thiswillsetanypins whichhavesetlowduetob eveled
edges, etc.
Table 6.1: Figure13: Basic scrubbing.
Advanced Lock Picking
Simplelo ckpickingisatradethatanyonecanlearn. However,advancedlo ckpickingisacraft
that requires mechanical sensitivity, physical dexterity, visual concentration and analytic
thinking. Ifyoustriveto excelat lo ckpicking, you will growin many ways.
7.1 Mechanical Skills
Learninghowtopull the pickoverthe pins issurprisingly dicult. The problemis that the
mechanicalskillsyoulearnedearlyinlifeinvolvedmaintainingaxedpositionorxedpath
foryourhandsindep endentof the amountof forcerequired. In lo ckpicking,youmustlearn
how to apply a xed force indep endent of the position of your hand. As you pull the pick
out of the lo ck you want toapply a xed pressureon the pins. The pickshould b ounce up
and downin the keyway according tothe resistance oered byeach pin.
To pick a lo ck you need feedback about the eects of your manipulations. To get the
feedback, you must train yourself to b e sensitive to the sound and feel of the pick passing
overthepins. Thisisamechanicalskillthatcanonlyb elearnedwithpractice. Theexercises
will help yourecognize the imp ortant information comingfrom yourngers.
7.2 Zen and the Art of Lock Picking
In order to excel at lo ck picking, you must train yourself to have a visually reconstructive
imagination. The idea is to use information fromall yoursenses to build a picture of what
is happ ening inside the lo ck as you pick it. Basically, you want to project your senses into
the lo ck to receive a full picture of how it is responding to your manipulations. Once you
havelearnedhow tobuildthis picture,it iseasyto cho ose manipulations that willopenthe
lo ck.
All your senses provide information about the lock. Touchand sound provide the most
information, but the other senses can reveal critical information. For example, your nose
can tellyouwhether alockhas b een lubricatedrecently. Asab eginner,youwillneed touse
at the lo ck. In fact, it isb etter to ignoreyour eyesand use yoursight tobuild an image of
the lock based onthe information youreceive from your ngersand ears.
The goal of this mental skill is to acquire a relaxed concentration on the lo ck. Don't
force the concentration. Try to ignore the sensations and thoughts that are not related to
the lock. Don'ttry tofo cus on the lo ck.
7.3 Analytic Thinking
Each lo ck has its own sp ecial characteristics which make picking harder or easier. If you
learn to recognize and exploit the "p ersonality traits" of lo cks, pickingwill gomuch faster.
Basically,you want to analyze the feedback youget from alo ck to diagnose its p ersonality
traits and then use your experience to decide on an approach to open the lo ck. Chapter 9
discussesa large number of common traits and ways toexploit or overcome them.
People underestimate the analytic skills involved in lock picking. They think that the
picking toolopens the lo ck. Tothem the torque wrench is a passive to olthat justputs the
lo ck under the desired stress. Let me prop ose another way to view the situation. The pick
is just running over the pins to get information ab out the lock. Based on an analysis that
information the torque is adjusted to make the pins set at the sheer line. It's the torque
wrenchthat opens the lo ck.
Varyingthe torqueas thepickmovesinandout ofthekeywayisageneraltrickthat can
b eused toget aroundseveralpickingproblems. Forexample, ifthe middlepins are set, but
the end pins are not, you can increase the torque as the pick movesover the middle pins.
Thiswill reducethechancesofdisturbingthe correctlysetpins. Ifsomepin doesn'tseemto
lift upfar enoughas the pickpasses overit,then try reducing the torque onthe next pass.
The skill of adjusting the torque while the pick is moving requires careful coordination
b etween your hands, but as you b ecome b etter at visualizing the pro cess of picking a lock,
youwill becomeb etter at this imp ortant skill.
Exercises
This chapter presents a series of exercises that will help you learn the basic skill of lo ck
picking. Some exercises teacha single skill, whileothers stress the co ordinationof skills.
When you do these exercises, fo cus on the skills, not on op ening the lock. If you focus
on op ening the lock, youwill get frustrated and your mind will stop learning. The goal of
eachexercise istolearn something ab outthe particular lo ckyouare holdingand something
ab out yourself. Ifa lock happ enstoopen, fo cus onthe memory ofwhat youweredoing and
what youfelt just b eforeit op ened.
These exercises should be practiced in short sessions. After about thirty minutes you
will nd that your ngers b ecome sore and your mind lo oses its ability to achieve relaxed
concentration.
8.1 Exercise 1: Bouncing the pick
Thisexercise helpsyoulearn theskillof applyingaxedpressurewiththe pickindep endent
of how the pickmoves upand down inthe lo ck. Basically youwantto learn how tolet the
pickb ounce up and downaccording tothe resistance oered byeach pin.
How you hold the pick makes a dierence on how easy it is to apply a xed pressure.
Youwantto hold it in such a way that the pressurecomes from yourngers or your wrist.
Your elbow and shoulder do not have the dexterity required to pick lo cks. While you are
scrubbing a lo ck notice whichof yourjoints are xed, and which are allowedto move. The
movingjointsare providingthe pressure.
One waytoholdapickistouse twongerstoprovideapivotp ointwhileanothernger
leversthe picktoprovidethe pressure. Whichngersyouuse isamatterofpersonalchoice.
Anotherwaytoholdthe pickislikeholdingap encil. Withthis metho d,yourwristprovides
thepressure. Ifyourwristisprovidingthepressure,yourshoulderand elb owshouldprovide
the force tomovethe pick inand out of the lo ck. Do not use your wrist to b oth move the
pickand apply pressure.
A go odwaytoget used tothefeel ofthe pickb ouncingupand down inthekeywayisto
try scrubbing over the pins of an op en lo ck. The pins cannot b e pushed down, so the pick
them. Ifyoumovethe pickquickly,youcan heartherattle. Thissame rattlingfeelwill help
you recognize when a pin is set correctly. If a pin app ears to b e set but it do esn't rattle,
then itisfalseset. Falsesetpinscan bexedby pushingthem downfarther, orby releasing
torque and letting them p opback to their initialposition.
One last word of advice. Fo cus on the tip of the pick. Don't think about how you are
movingthe handle;think ab out howyouare movingthe tip of the pick.
8.2 Exercise 2: Picking pressure
This exercisewill teachyoutherangeof pressuresyouwill needtoapplywith apick. When
you are starting, just apply pressure when you are drawing the pickout of the lo ck. Once
youhavemastered that, tryapplying pressure when the pickismoving inward.
With the at side of your pick, push down on the rst pin of a lo ck. Don't apply any
torque to the lo ck. The amount of pressure you are applying should be just enough to
overcomethe springforce. This forcegivesyouanidea of minimumpressureyou willapply
with a pick.
The spring force increasesasyou push the pin down. See if youcan feel this increase.
Now see how it feels to push down the other pins as you pull the pick out of the lo ck.
Startout withb oth the pick and torquewrenchinthe lock,but don'tapply anytorque. As
youdrawthe pickout ofthe lo ck,apply enoughpressuretopush eachpinallthewaydown.
The pins shouldspring backasthe pickgoespast them. Notice the soundthat the pins
make as theyspring back. Notice the p opping feel as a pickgoes past each pin. Notice the
springy feel asthe pickpushesdown oneach new pin.
Tohelpyoufo cusonthese sensations,try counting thenumb erofpins inthelock. Do or
lo cksat MIT havesevenpins, padlocks usually have four.
Toget anidea of the maximum pressure,use the at side of yourpickto push downall
the pins in the lo ck. Sometimes you will need to apply this much pressure to a single pin.
If you encounter a new kind of lock, p erform this exercise to determine the stiness of its
springs.
8.3 Exercise 3: Picking Torque
the pins down, andtry applyingenoughtorque tomakethe pinsstaydownafter thepickis
removed. If yourtorque wrenchhas a twist in it, you maynot b e able to hold down more
than a fewpins.
If you use to o much torque and too much pressureyou can get into a situation like the
oneyoujustcreated. Thekeypinsarepushedto ofarintothehullandthetorqueissucient
tohold themthere.
The rangeofpickingtorquecanb efound bygraduallyincreasingthe torquewhilescrub-
bing the pins with the pick. Some ofthe pins will b ecome harder to push down. Gradually
increasethe torque untilsome ofthe pins set. These pins willloosetheir springiness. Keep-
ing the torque xed, use the pick to scrub the pins a few times to see if other pins will
set.
The most common mistake of b eginners is to use to o much torque. Use this exercise to
nd the minimum torque required topickthe lock.
8.4 Exercise 4: Identifying Set Pins
While you are picking a lock, try to identify which pins are set. You can tell a pin is set
b ecause it will have a slight give. That is, the pin can b e pushed down a short distance
with a lightpressure, but itbecomeshard to moveafterthat distance(see chapter6for an
explanation). Whenyouremovethe lightpressure,the pinspringsbackupslightly. Set pins
also rattle if youick them with the pick. Try listening for that sound.
Run thepickoverthepinsand trytodecidewhether thesetpinsare inthe frontorback
of the lock (or b oth). Tryidentifying exactlywhichpins are set. Rememb er that pin one is
the frontmost pin (i.e., the pin that a key touches rst). The most imp ortant skill of lo ck
picking isthe ability to recognize correctlyset pins. This exercise will teachyouthat skill.
Tryrepeatingthis exercise with the plugturningin theother direction. Ifthe frontpins
setwhentheplugisturnedone way,the backpins will setwhenthe plugisturnedthe other
way. See Figure6.2 for anexplanation.
One waytoverify howmanypins are setisto releasethe torque,and countthe clicksas
the pins snap backto their initial p osition. Try this. Try to notice the dierence in sound
b etweenthe snap ofa singlepin andthe snap oftwopins atonce. A pin thathas beenfalse
setwill also make asnapping sound.
Try this exercise with dierent amounts of torque and pressure. Youshould notice that
a larger torque requires a larger pressure to make pins set correctly. If the pressure is to o
high, the pins will b e jammed into the hull and staythere.
8.5 Exercise 5: Projection
As youare doing the exercises trybuilding a pictureinyour mind of what isgoingon. The
picture do es not have to b e visual, it could b e a rough understanding of whichpins are set
buildingistotrytorememberyoursensations andb eliefsab outalo ckjustb eforeitop ened.
When a lo ck op ens, don't think "that'sover", think "what happened".
This exercise requires alock that yound easy topick. It will help yourenethe visual
skills youneed to masterlock picking. Pickthe lo ck, and try to remember howthe process
felt. Rehearseinyourmindhoweverythingfeelswhenthelockispickedprop erly. Basically,
you want to create a movie that records the pro cess of picking the lo ck. Visualize the
motionofyourmusclesastheyapply thecorrectpressureandtorque,andfeelthe resistance
encounteredbythepick. Nowpickthelockagaintryingtomatchyouractionstothemovie.
Byrepeatingthisexercise,youarelearninghowtoformulatedetailedcommandsforyour
musclesand how to interpretfeedback from your senses. The mental rehearsal teaches you
how to build a visual understanding of the lock and how to recognize the major steps of
picking it.
Recognizing and Exploiting
Personality Traits
Real locks have a wide range of mechanical features and defects that help and hinder lock
picking. If a lock do esn't resp ond to scrubbing, then it probably has one of the traits
discussed in this chapter. To op en the lo ck, you must diagnose the trait and apply the
recommended technique. The exercises will help youdevelop the mechanicalsensitivity and
dexterity necessaryto recognize and exploit the dierenttraits.
9.1 Which Way To Turn
It can b e very frustrating to sp end a long time picking a lo ck and then discover that you
turnedthe plugthewrongway. Ifyouturnaplug thewrongwayitwillrotate freelyuntilit
hitsastop,oruntilitrotates180degreesand thedriversenterthekeyway(see section9.11).
Section 9.11 also explains how to turn the plug more than 180 degrees if that is necessary
to fully retract the b olt. When the plug is turned in the correct direction, you should feel
anextra resistance when the plug cam engages the bolt spring.
The directiontoturn theplug dep endsonthe b oltmechanism,not onthelock,but here
are somegeneralrules. Cheap padlo ckswill op enif the plug isturnedineitherdirection, so
you can chose the direction whichis bestfor the torque wrench. All padlo cks made by the
Master companycan b e op enedineither direction. Padlo cks madebyYale will onlyop en if
the plug isturnedclo ckwise. Thedouble plugYale cylinder lo cksgenerallyop en by turning
the b ottom of the keyway (i.e., the at edge of the key) away from the nearest doorframe.
Singleplugcylinderlocksalso followthisrule. SeeFigure9.1. Lo cksbuiltintothedoorknob
usually open clo ckwise. Desk and ling cabinet lo cksalso tend to op en clockwise.
When youencounter a new kind of lo ck mechanism,try turning the plug in b oth direc-
tions. In the correct direction, the plug will b e stopp ed by the pins, so the stop will feel
mushy when you use heavy torque. In the wrong direction the plug will b e stopp ed by a
metal tab, so the stop will feel solid.
The companion question to whichway to turn a lo ck is how far to turn it. Desk and ling
cabinet lo cks generally open with less than a quarter turn (90 degrees) of the plug. When
op ening adesk lock try toavoidhaving the plug lo ck inthe op en p osition. Lo cks builtinto
do orknobs also tend to op en with less than a quarter turn. Lo cks which are separatefrom
the do orknob tend to require a half turn to op en. Deadb olt lo ck mechanisms can require
almost afull turn toopen.
Turninga lock more than 180 degreesis adicult because the driversenter the bottom
of the keyway. See section 9.11.
9.3 Gravity
Picking a lo ckthat has the springs atthe top is dierent than pickingone with the springs
at the b ottom. It should b e obvious how to tell the two apart. The nice feature of a lock
with the springs atthe b ottom isthat gravity holds the keypins downonce theyset. With
the setpins out of the way,itis easytond and manipulate the remaining unset pins. It is
also straight forward to test for the slight give of a correctly set pin. When the springs are
on top, gravity will pull the key pins downafter the driver pin catches atthe sheerline. In
this case,youcan identifythe setpins bynoticing that the keypinis easytoliftand thatit
do es not feel springy. Set pins also rattle as you draw the pickoverthem because they are
not being pusheddownby the driver pin.
9.4 Pins Not Setting
If youscrub a lo ck and pins are not setting even when youvary the torque, then some pin
has falseset and itis keeping the rest of the pins from setting. Consider a lo ck whose pins
prefer toset frombackto front. Ifthe backmostpin false sets high orlow(see Figure 9.2),
then the plug cannot rotate enough toallow the other pins to bind. It is hard to recognize
that abackpin has false setb ecausethe springiness ofthe frontpins makesithard tosense
the small give of a correctly set backpin. The main symptom of this situation is that the
other pins will not set unless avery large torque isapplied.
When you encounter this situation, release the torque and start over by concentrating
on the back pins. Try a light torque and mo derate pressure, or heavy torque and heavy
pressure. Try to feel for the click that happ ens when a pin reaches the sheer line and the
plug rotates slightly. The clickwill be easier tofeel if youuse a sti torque wrench.
9.5 Elastic Deformation
The interesting eventsof lo ck pickinghapp enoverdistances measured inthousandths of an
inch. Over such short distances, metals b ehave like springs. Very little force is necessary
spring backtoits originalp osition.
Deformation can b e used to your advantage if you wantto force several pins to bind at
once. For example, picking a lock with pins that prefer to set from front to back is slow
b ecause the pins set one at a time. This is particularly true if you only apply pressure as
the pickisdrawn out of the lo ck. Each pass of the pickwill onlysetthe frontmostpin that
is binding. Numerouspasses are required to set allthe pins. If the preferencefor setting is
not verystrong(i.e., the axisof the plugholes isonlyslightly skewedfromthe plug's center
line), then you can cause additional pins to bind by applying extra torque. Basically, the
torque putsa twistinthe plugthat causesthe frontofthe plug tob edeected further than
the backof theplug. Withlighttorque,the backof theplug staysinitsinitialposition,but
with medium to heavytorque, the frontpin columnsbend enough to allow the backof the
plug to rotate and thus cause the back pins tobind. With the extratorque, a single stroke
ofthe pickcansetseveralpins,andthe lo ckcanb eopenedquickly. To omuchtorquecauses
itsown problems.
Whenthetorqueislarge,thefrontpinsandplugholescanb edeformedenoughtoprevent
the pins fromsetting correctly. In particular, the rst pin tends tofalse setlow. Figure 9.2
shows how excess torque can deform the b ottom of the driverpin and prevent the key pin
from reaching the sheer line. This situation can be recognized by the lack of give in the
rst pin. Correctly set pins feel springy if they are pressed down slightly. A falsely set pin
lacksthisspringiness. The solutionis topress downhardonthe rst pin. Youmaywantto
reduce the torque slightly, but if you reduce torque toomuch then other pins will unset as
the rst pin isb eing depressed.
It is also possibleto deform thetop ofthe key pin. The keypin is scissoredbetween the
plug and the hulland staysxed. When this happ ens, the pin is said to b e falsesethigh.
9.6 Loose Plug
The plug is held intothe hullby b eing wider atthe frontand by havinga cam on the back
that is bigger than the hole drilled into the hull. If the cam is not properly installed, the
plug can move in and out of the lo ck slightly. On the outward stroke of the pick, the plug
will move forward, and if youapply pressure onthe inward stroke, the plug will b e pushed
back.
The problem with alo oseplugis thatthe driver pinstend tosetonthe backof the plug
holes rather than on the sides of the holes. When you push the plug in, the drivers will
Whenthepairofpins inaparticularcolumnhavedierentdiameters,that columnwillreact
strangely tothe pressure of the pick.
ThetophalfofFigure9.3showsapincolumnwithadriverpinthathasalargerdiameter
thanthekeypin. Asthepinsarelifted,thepickingpressureisresistedbythebindingfriction
andthe springforce. Oncethedriverclearsthesheer line,the plugrotates(untilsomeother
pinbinds)andtheonlyresistancetomotionisthespringforce. Ifthekeypinissmallenough
and the plug did not rotate very far, the key pin can enter the hull without colliding with
the edgeof thehull. Someotherpin isbinding, soagainthe onlyresistance tomotionisthe
spring force. This relationship is graphed in the b ottom half of the Figure. Basically, the
pins feel normal at rst, but then the lo ck clicksand the pin b ecomes springy. The narrow
keypincan b epushedallthewayintothe hullwithoutlo osingitsspringiness,but whenthe
picking pressure is released, the key pin will fall back to its initial p osition while the large
driver catchesonthe edge ofthe plug hole.
The problem with a large driver pin is that the key pin tends to get stuck in the hull
when some otherpin sets. Imaginethat a neighboringpin sets and the plug rotatesenough
tobindthenarrowkeypin. Ifthepickwaspressingdownonthenarrowkeypin atthe same
time asitwaspressing downon thepin that set, thenthe narrowkeypin will b ein thehull
and it will get stuckthere when the plug rotates.
The behaviorof a large keypin isleft asan exercise for the reader.
9.8 Beveled Holes and Rounded pins
Some lo ck manufacturers (e.g., Yale) bevel the edges of the plug holes and/or round o
the ends of the key pins. This tends to reduce the wear on the lock and it can both help
and hinder lo ck picking. Youcan recognize a lo ck with these features by the large give in
set pins. See Figure9.4. That is, the distance b etween the height at which the driver pin
catchesontheedgeoftheplugholeandthe heightatwhichthekeypin hitsthehullislarger
(sometimes as large as a sixteenth of an inch) when the plug holes are beveled or the pins
are rounded. While the keypin is movingb etween those twoheights,the onlyresistance to
motionwillbetheforceofthespring. Therewon'tb eanybindingfriction. Thiscorresponds
tothe dip inthe forcegraph shown in Figure5.5.
A lo ck with b eveled plug holes requires more scrubbing to op en than a lo ck without
b eveled holes b ecause the driver pins set on the b evel instead of setting on the top of the
can slide and the rightdriver may bind onits b evel.
Ifyouencounteralo ckwithb eveledplug holes,and allthe pins app eartob esetbut the
lo ck is not op ening, you should reduce torque and continue scrubbing over the pins. The
reducedtorque will make iteasiertopush the driverso the b evels. Ifpins unset when you
reduce the torque, try increasing the torque and the picking pressure. The problem with
increasing the force isthat you mayjamsome key pins into the hull.
Figure 9.6: (b) Driverjams onbevel
the lipof the driver has caughtat the sheer line. See the b ottom of Figure9.7. Mushroom
and sp o ol drivers are often found inRusswin lo cks, and lo cks that have several spacers for
master keying.
You can identify the p ositions with mushro om drivers by applying a light torque and
pushing up on each pin. The pins with mushroom drivers will exhibit a tendency to bring
the plug back to the fully lo cked position. Bypushing the key pin up you are pushing the
at top of the key pin against the tilted b ottom of the mushroom driver. This causes the
driver tostraighten up whichin turn causes the plug tounrotate. Youcan use this motion
toidentify the columnsthat have mushro omdrivers. Push thosepins uptosheer line; even
if you lose some of the other pins inthe pro cess they will b e easier to re-pickthan the pins
with mushroom drivers. Eventuallyall the pins will becorrectly set atthe sheer line.
One waytoidentifyallthepositionswithmushroomdriversistousethe atofyourpick
topush allthe pins upab out halfway. This shouldput most of the driversin theircockable
p osition and youcan feel for them.
Topickalo ckwithmodieddrivers,use alightertorque andheavierpressure. Youwant
to error on the side of pushing the key pins to o far into the hull. In fact, another way to
pickthese lo cksistouse the at sideofyour picktopushthe pins upalltheway,and apply
very heavytorque tohold them there. Usea scrubbing action tovibrate the key pins while
youslowly reducethe torque. Reducing the torque reducesthe bindingfrictionon the pins.
The vibration and spring forcecause the key pins toslide down to the sheer line.
The key to picking lo cks with modied drivers is recognizing incorrectly set pins. A
mushroom driver set on its lip will not have the springy give of a correctly set driver.
Practicerecognizing the dierence.
9.10 Master Keys
Many applications require keys that open only a single lock and keys that op en a group
of lo cks. The keys that op en a single lock are called change keys and the keys that op en
multiple lo cks are called master keys. To allowboth the changekey and the master key to
op enthesamelo ck,alocksmithaddsanextrapin calledaspacertosomeofthepincolumns.
See Figure 9.8. The eect of the spacer is tocreate two gaps inthe pin columnthat could
b elined upwiththe sheer line. Usuallythe changekey alignsthe topof the spacerwith the
sheer line, and the master key aligns the b ottom of the spacer with the sheer line (the idea
is to preventp eople fromling downa change key toget a master key). In either case the
more common for the spacerto b e larger than the driver pin. Youcan recognize this byan
increasein friction whenthe spacerpasses through the sheer line. Since the spacer islarger
than the driverpin, itwill also catchbetter onthe plug. If youpushthe spacer furtherinto
the hull, youwill feel astrong clickwhen the b ottom of the spacerclears the sheer line.
Thin spacers can cause serious problems. If you apply heavy torque and the plug has
b eveledholes,thespacercantwistand jamatthesheerline. Itisalsop ossibleforthespacer
tofallinto thekeywayif the plugis rotated180degrees. See section9.11 for the solutionto
this problem.
the hull. You may need to use the torque wrenchto relieve any sheer force that is binding
the spacer or driver. If that do esn't worktry raking over the drivers with the p ointedside
of your pick. If aspacer fallsintothe keyway completely,the only optionis toremoveit. A
ho ok shap ed pieceof spring steelworks wellfor this, thoughab entpap erclip willworkjust
aswell unless the spacer b ecomes wedged.
9.12 Vibration Picking
Vibration picking works by creating a large gap b etween the key and driver pins. The
underlying principle isfamiliar toanyonewho has playedpo ol. When thequeue ball strikes
anotherball squarely, thequeue ball stopsand the other ball headso with the samespeed
and directionasthe queueball. Nowimagineadevice thatkicks thetips ofallthe keypins.
The keypins wouldtransfer theirmomentumto thedriver pins whichwould yupinto the
hull. If youareapplying a lighttorquewhen this happ ens, the plug willrotate when allthe
9.13 Disk Tumblers
The inexp ensivelocksfound ondesksuse metaldisks insteadofpins. Figure9.10shows the
basic workings of these lo cks. The disks have the same outline but dier in the placement
of the rectangular cut.
These lo cks are easy to pick with the right to ols. Because the disks are placed close
togetherahalf-roundpickworksb etterthanahalf-diamondpick(seeFigureA.1). Youmay
also need a torque wrenchwith anarrowerhead. Usemo derate toheavy torque.
Final Remarks
Lo ckpickingis acraft, not ascience. Thisdo cument presentsthe knowledgeand skillsthat
areessentialtolockpicking,butmoreimp ortantlyitprovidesyouwithmodelsandexercises
that will help youstudylocks onyour own. Toexcel atlockpicking,you mustpractice and
developastylewhichtsyoup ersonally. Rememb erthat the b esttechniqueis the one that
works b est foryou.
Tools
This appendix describ es the design and construction of lo ckpicking to ols.
A.1 Pick Shapes
Picks come in several shap es and sizes. Figure A.1 shows the most common shapes. The
handle and tang of a pick are the same for all picks. The handle must b e comfortable and
the tang mustbe thin enoughto avoid bumping pins unnecessarily. Ifthe tang is to o thin,
then it will act likea spring and youwill lo ose the feel of the tip interacting with the pins.
The shap e of the tip determines how easily the pick passes overthe pins and what kind of
feedback youget fromeach pin.
The designofatipisacompromiseb etweenease ofinsertion, easeofwithdrawalandfeel
of the interaction. The half diamond tip with shallow angles is easy to insert and remove,
soyou can apply pressurewhen the pickis movingineither direction. It can quicklypick a
lo ck that has little variation in the lengths of the key pins. If the lo ck requires a key that
has a deep cut b etween twoshallow cuts, the pickmay not beable to push the middle pin
downfar enough. The halfdiamond pick withsteep angles coulddeal with sucha lo ck,and
in general steep angles give you b etter feedback about the pins. Unfortunately, the steep
anglesmake ithardertomovethe pick inthe lo ck. Atip that has ashallowfrontangle and
a steep backangle workswellfor Yale lo cks.
The halfround tip works well indisk tumbler lo cks. See section 9.13. The full diamond
and full roundtips are useful for lo cksthat havepins at the top and bottom of the keyway.
The rake tip is designed for picking pins one by one. It can also be used to rake over
the pins, butthe pressurecan onlyb e appliedasthe pickiswithdrawn. The raketip allows
youtocarefully feeleachpinand apply varyingamountsofpressure. Someraketipsare at
or dented on the top to makes it easier to align the pick on the pin. The primary benet
of pickingpins one at atime is that youavoid scratchingthe pins. Scrubbing scratches the
tips of the pins and thekeyway,and itspreads metaldust throughoutthe lock. Ifyouwant
toavoid leavingtraces, youmust avoid scrubbing.
The snaketip canbeusedforscrubbingorpicking. Whenscrubbing,themultiplebumps
pin household lo cks. When a snake tip is used for picking, it can set two or three pins at
once. Basically,the snakepickacts like asegment of akey whichcan be adjustedby lifting
and lowering the tip, by tilting it back and forth, and by using either to top or b ottom of
the tip. Youshoulduse moderatetoheavytorque with asnakepicktoallowseveral pinsto
bind atthesame time. Thisstyleof pickingisfasterthan usingarakeand itleavesaslittle
evidence.
A.2 Street cleaner bristles
The spring steel bristles used on street cleaners make excellent to ols for lo ck picking. The
bristleshavetherightthicknessandwidth,andtheyareeasytogrindintothedesiredshap e.
The resulting to ols are springy and strong. Section A.3 describ es how to make tools that
are less springy.
The rst step in making tools is to sand o any rust on the bristles. Course grit sand
pap er works ne as do esa steel wool cleaning pad (not copp er wool). Ifthe edges or tip of
the bristle are worn down, use a le to make themsquare.
A torque wrench has a head and a handle as shown in gure A.2. The head is usually
1/2 to3/4 of aninch long and the handle varies from 2to4 inches long. The head and the
handle are separated by a bend that is about 80 degrees. The head must be long enough
to reach over any protrusions (such as a grip-pro of collar) and rmly engage the plug. A
long handleallowsdelicatecontroloverthetorque, but ifitis to olong,itwill bumpagainst
the do orframe. The handle, head and b end angle can b e made quite small if you want to
make to ols that are easy toconceal (e.g., in a pen, ashlight, or b eltbuckle). Some torque
wrencheshavea90degreetwistinthehandle. The twistmakesiteasytocontrolthe torque
bycontrollinghowfarthe handlehas b een deected fromits rest p osition. The handle acts
as aspring which sets the torque. The disadvantage of this methodof setting the torque is
that you get less feedback ab out the rotation of the plug. To pick dicult locks you will
need to learnhowtoapply asteady torque viaa sti handled torque wrench.
The width of the head of a torque wrench determines how well it will t the keyway.
Lo cks with narrow keyways (e.g., desk lo cks) need torque wrenches with narrow heads.
Beforeb endingthe bristle,le the headtothedesiredwidth. Ageneralpurposewrenchcan
b emadebynarrowingthe tip(ab out 1/4inch)ofthehead. Thetip tssmall keywayswhile
the rest of the head iswide enough tograb a normalkeyway.
The hard part of making atorque wrench isbendingthe bristle withoutcrackingit. To
the spring steel aroundit ab out 90degrees. This should seta p ermanent80 degreeb end in
the metal. Try to keep the axis of the b end p erpendicular to the handle. The screwdriver
shank ensures that the radius of curvature will not b e too small. Any rounded object will
work(e.g.,drill bit, needle nose pliers,or apencap). If youhavetroublewith this method,
trygrasping the bristlewithtwopliers separatedbyab out 1/2 inchandbend. This metho d
pro duces agentle curve thatwon't break the bristle.
A grinding wheel will greatly sp eed the job of making a pick. It takes a bit of practice
tolearn howmake smo othcuts with agrinding wheel,but ittakeslesstime topractice and
make two or three picks than it does to hand le a single pick. The rst step is to cut the
frontangle of the pick. Use the front of the wheelto dothis. Hold the bristleat 45degrees
to the wheel and move the bristle side to side as you grind away the metal. Grind slowly
to avoid overheating the metal, which makes it brittle. If the metal changescolor (to dark
blue), you have overheated it, and you should grind away the colored p ortion. Next, cut
the backangle of the tip using the corner of the wheel. Usually one corner is sharper than
the other, and youshould use that one. Holdthe pick atthe desired angle and slowly push
it into the corner of the wheel. The side of the stone should cut the back angle. Be sure
that the tip of the pickis supported. If the grinding wheelstage is not close enough to the
wheel tosupport the tip, use needlenose pliersto hold the tip. The cut should shouldpass
though ab out 2/3 of the width of the bristle. If the tip came out well, continue. Otherwise
break it oand try again. Youcan break thebristle byclamping it intoavise and b ending
itsharply.
The corner of the wheel is also used to grind the tang of the pick. Put a scratch mark
to indicate how far backthe tang should go. The tang should b e long enough to allow the
tip to pass over the backpin of a seven pin lo ck. Cut the tang by making several smooth
passes over the corner. Each pass starts at the tip and movesto the scratch mark. Try to
removeless than a 1/16th of an inchof metal with eachpass. I use two ngers tohold the
bristle on the stage at the prop er angle while my other hand pushes the handle of the pick
tomovethe tang along the corner. Usewhatever technique worksbestfor you.
Use a hand le to nish the pick. It should feel smo oth if yourun a nger nail overit.
Any roughness will add noise tothe feedbackyouwant toget from the lo ck.
The outer sheath of phone cable can b e used as a handle for the pick. Removethree or
four of the wires from a length of cable and push it overthe pick. Ifthe sheath won't stay
inplace, youcan put some epoxyon the handle beforepushing the sheath overit.
ame, and let it air co ol; this softens it. The burner of a gas stove can be used instead of
a torch. Grind it down into the shap e of a skinny screwdriver blade and bend it to ab out
80degrees. The bendshould b e lessthana rightangleb ecause some lockfacesare recessed
b ehind a plate (called an escutcheon) and you want the head of the wrench to b e able to
reach ab out half an inch into the plug. Temper (harden) the torque wrench by heating to
brightorangeand dunkingitintoice water. Youwillwind upwithavirtuallyindestructible
b entscrewdriver that will last for yearsunder brutal use.
Bicyclesp okesmakeexcellentpicks. Bendonetothe shap eyouwantand lethe sidesof
thebusinessendatsuchthatit'sstrongintheverticalandexyinthehorizontaldirection.
Trya right-anglehunk ab out an inch long for a handle. Forsmaller picks, whichyou need
forthose reallytiny keyways, ndanylarge-diameterspringand unbendit. Ifyou'recareful
youdon't have toplayanymetallurgical games.
A.4 Brick Strap
Forp erfectlyserviceablekeyblanksthat youcan'totherwisend atthestore, usethe metal
strap they wrap around bricks for shipping. It's wonderfully handy stu for just about
anything you want to manufacture. To get around side wards in the keyway, youcan b end
the strap lengthwise by clamping it in a vice and tapping on the protruding part to b end
the piece to the required angle.
Brick strap is very hard. It can ruin a grinding wheel or key cutting machine. A hand
le is the recommended to ol for millingbrickstrap.
Legal Issues
Contrarytowidespread myth,itis nota felonyto p ossess lockpicks. Eachstate has itsown
lawswithresp ecttosuchburglariousinstruments. Hereisthe Massachusettsversionquoted
inentiretyfrom the massachusetts generalco de:
Chapter 266 (crimesagainst property)
Section49. Burglariousinstruments;making; p ossession; use.
Who ever makes or mends, or b egins to make or mend, or knowingly has in
his p ossession, anengine, machine, to ol or implementadapted and designed for
cutting through, forcing or breaking open a building, room, vault, safe or other
dep ository,IN ORDERTO STEALTHEREFROMmoneyorother prop erty,or
to commit any other crime, knowing the same to b e adapted and designed for
the purp ose aforesaid, WITH INTENT TO USE OR EMPLOY OR ALLOW
the same tob e used oremployedforsuch purp ose, orwho ever knowinglyhas in
his p ossession amaster key designed to t more than one motor vehicle, WITH
INTENT,TO USE OREMPLOYTHESAME tosteal amotor vehicleorother
prop erty therefrom, shall b e punished by imprisonment in the state prison for
not more than ten years or bya ne of not more than one thousand dollars and
imprisonment injail for not more than twoand one half years.
Emphasis added.
In other words, mere p ossession means nothing. If they stop youfor sp eeding or some-
