How a Pin Tumbler Lock Knows Your Key

Push your house key into its lock and turn it, and the bolt slides back. Push in a neighbor's key of the same brand and it goes in just as smoothly, but it won't turn. The lock has no electronics and stores no code. Inside it, five small stacks of metal pins, each about 3 mm across, measure the edge of whatever key goes in.

This kind of lock is a pin tumbler lock. The idea of pins that drop into a bolt and have to be lifted by a key is oldWooden locks that work on the same principle are usually traced to ancient Egypt, about four thousand years ago.; the compact version with a small flat key came from Linus Yale Jr. in the 1860s, and it is still what's on most front doors. Here is one, cut in half from front to back. Drag to turn it around, and push the key in :

The block on the outside is the housing, fixed in the door. Through it runs a cylinder called the plug, with a slot for the key, the keyway. When the plug turns, the flat bar at its back end turns with it and works the bolt. Above the keyway sit the pins. Watch them jump as the key slides under them, and settle at different heights once it is all the way in.

Plug and housing

Taking the lock apart shows how the pins are arranged. Pull it apart with the slider, and point at the plug, a key pin, a driver pin, or a spring in this sentence, or in the figure, to pick it out:

Five holes are drilled straight down through the tower of the housing and on into the plug, in a row along it. Each hole holds a stack of three parts. At the bottom is a key pin, the one that touches the key; the five key pins have different lengths. Above it sits a driver pin, and on top a spring pushes the whole stack down.

With no key in the lock, the springs push every stack as far down as it goes, until the key pins rest on the bottoms of their holes. Each driver pin is then half in the housing and half in the plug. A driver pin caught across that boundary works like a bolt between the two parts: as long as one is there, the plug can't turn.

The plug itself is held in from behind by a clip or by the cam that works the bolt, and it fits the housing with just enough clearance to turn freely. Everything else about the lock is in those five stacks. A lock with more security has more stacks, or stranger ones, but the plan stays the same.

Reading the key

From here on most figures show a flat slice through the middle of the lock, seen from the side with the front on the left. Material the slice cuts through is hatched. The dashed brass line is where the plug's surface meets the housing. Push the key a third of the way, most of the way, and all the way in, and watch where the gaps between the key pins and the driver pins fall:

The edge of the key is a row of V-shaped cuts, one under each pin, each to its own depth. As the key slides in, the pointed tip of each key pin rides up the slopes and down into every cut that passes under it. Only with the key all the way in does each pin drop into its own cut, and then the top of every key pin lines up with the brass line. A brass dot marks each gap that has arrived.

The key also has to stop in exactly the right place. The cuts are measured from the shoulder, the step where the blade meets the bow, and the shoulder hits the front of the plug when the key is fully in. Push a key in a millimeter short and every pin lands on a slope instead of in its cut. That's why a key that turns perfectly can refuse to work when it isn't pushed all the way home.

That line is the shear line. The key pins are cut to lengths that make it work out: under a deep cut sits a long key pin, under a shallow cut a short one, so that at every hole

The key here uses the spacing and depths of Schlage, one of the most common lock brands in the United States: cuts 3.96 mm (0.156 inch) apart, and ten possible depths numbered 0 to 9, each 0.381 mm (0.015 inch) deeper than the lastThese are the dimensions given in locksmith references for Schlage's standard keys. Other brands use their own; Kwikset, the other common American brand, has seven depths 0.58 mm (0.023 inch) apart.. Depth 0 is the shallowest. This key is cut 3-6-2-7-4, read from the shoulder to the tip, which is how a locksmith writes a key down: its bitting.

The shear line

To see why the gaps have to land on that line, look at the lock from the front, sliced across one pin hole. The key pin in this hole is made for a cut of depth 4. Set the cut under it to 4, to 7, too deep, or to 1, too shallow, and try to turn the key:

At depth 4 the gap between the pins sits on the shear line. The plug turns and carries the key and the key pin with it, while the driver pin stays in the housing and rides on the plug's surface. Cut deeper than 4 and the key pin sits too low, so the driver pin reaches down into the plug. Cut shallower and the key pin pokes up into the housing. Either way one pin spans the line, drawn in red, and the plug is stuck. I've let the stuck plug rock by a degree so you can see it trying; in a real lock the play is smaller.

The magnifier shows how small the difference is. One step of depth is 0.38 mm, about the thickness of four sheets of paper. A gap a whole step off the line can't slip past it, but a gap a little off can, because the edges of the pins and holes are slightly beveled. That slack decides how precisely a key has to be cut.

The wrong key

Here is the side slice again with a key all the way in, and a small front view beside it that shows whether the plug can turn. This key is almost right. Drag the handle on any cut up or down to change its depth, or try the buttons:

All five pins have to be right. A key with one cut a single step off fails as completely as a key for a different lock: one red pin is enough to hold the plug. Real locks add a filter before the pins come into it. Their keyways aren't plain slots like the one drawn here but zigzag in cross-section, and only key blanks milled to the same profile go in at all.

Some makers go further and patent their keyway profiles, so that blanks are sold only to registered locksmiths and a hardware store can't copy the key. Copying itself is simple: a duplicating machine runs a follower along the edge of the original while a cutting wheel traces the same shape into a blank. A locksmith with only the code, 3-6-2-7-4, uses a code machine instead, set to each position and depth in turn, which is how a lost key can be replaced from a number stamped on the lock's paperwork.

How many keys there are

With ten depths at each of five positions there are 10⁵ = 100,000 ways to cut a key. Not all of them are allowed. A deep cut right beside a shallow one leaves a tall, thin ridge of brass between them, which bends and wears, and which a key pin has to climb every time the key goes in. Makers set a limit on how many steps two neighboring cuts may differ, the maximum adjacent cut, or MACS. Drag the cuts, and change the limit:

The limit for Schlage keys is 7As listed in locksmith references for Schlage's standard keys. For Kwikset's seven depths the limit is 4.: a 0 may sit next to a 7, but not next to an 8 or a 9. On the key above, the 9 beside the 1 leaves a ridge more than three millimeters tall and barely wider than a pin's point at its top. A key like that would bend the first time it was forced, and its pins would scrape over the ridge on the way in. Set the limit to no limit and every key is allowed again.

How much does the rule cost? Count the keys it leaves. Pick a brand, a number of pins, and a limit:

With Schlage's limit of 7, five pins allow 79,666 keys instead of 100,000. A sixth pin multiplies that by almost ten, to 753,754. Kwikset's seven depths and limit of 4 leave 10,483. Each extra pin is worth far more than a looser limit, which is why high-security cylinders often have six pins or more, and why the cheapest locks have four.

Real systems set aside more than the rule does. A locksmith planning a building avoids codes too close to ones already issued, so a key that's one step off at one pin doesn't open its neighbor's door with a little wear. And a large number of possible keys protects less than it sounds, because nobody opens a lock by trying keys. The rest of this page is about how locks are actually opened without the key, and what the lock makers do about it.

Why one pin binds first

Pins and holes are made precisely, but not perfectly. Each driver pin is about 0.04 mm narrower than its hole on each side, and the holes are drilled a few hundredths of a millimeter off a perfect line. Look down on the five holes from above, along the shear line. The gray circles are the housing's holes, the green ones the plug's, and the errors are drawn ten times larger than the holes. Turn the plug a little:

A turning force slides every green hole sideways by the same amount, and each pin can slip by only 0.08 mm before the two halves of its hole close on it. The hole that was already furthest off in the direction of the turn closes first. Its driver pin is pinched between the plug and the housing: it binds. The plug can't turn any further, so every other pin stays loose. Tighter drilling makes the errors smaller, but it can't make them equal, and some pin always binds first. Drill another plug and the order changes; it belongs to each lock.

These errors are small. A human hair is about 70 µm across, and the misalignments that set the binding order are a fraction of that. Making them smaller still costs money: tighter tolerances need slower machining and more inspection, and they make a lock fussier about worn keys and grit. High-security cylinders pay that cost anyway, because every micrometer of slack is something a picker can feel.

Picking

A lock pick does the key's job one pin at a time, and it works because of that order. The picker puts a light turning force on the plug with a thin bent bar in the keyway, a tension wrench. The plug turns by a hair and stops when the most offset hole pinches its driver pin. Picking guides are built around this one fact .

Under the side slice is the view from above, with the misalignment exaggerated many times over. The plug's holes are drawn in green and the housing's in gray. Choose a pin with the stepper and lift it with the slider, or drag a pin up:

Lifting a loose pin does nothing; it falls back when you let go. Lifting the binding pin until its gap reaches the shear line frees its driver pin. The plug turns a hair further, and the driver is left sitting on the plug's edge, unable to drop back. That pin is set, and a different pin now binds: the one in the next most offset hole. Set all five in that order and the plug turns, without a key ever touching the pins.

Locksmiths call this single-pin picking. It needs patience and a light hand, but no information about the key at all. All the information comes out of the lock itself, one pin at a time, as a click and a tiny turn of the plug.

What the picker feels is the difference between pins. A loose pin is springy and light; the binding pin is stiff, because it's pinched. When the binding pin sets, the plug gives a fraction of a degree, a click comes through the wrench, and the pin above the pick goes loose. Too much turning force and the binding pin is pinched so hard it won't move; too little and set pins drop back down when the plug relaxes. A quicker, rougher method, raking, scrubs a wavy pick back and forth across all the pins under light tension and relies on the binding order to let them set one after another by luck.

Security pins

The clue a picker relies on is that a set pin feels different from a binding one. Better locks blur that clue by changing the shape of the driver pins. Turn these around and pick one:

A spool pin has a narrow waist, like a cotton reel. A serrated pin has a row of shallow grooves. Both are the same height and weight as a standard driver, so they change nothing for the right key, which lifts the whole stack at once. They only matter to someone lifting the pins one at a time against a turning force.

Here is a front slice through one hole with a spool driver, as a picker lifts it. The plug is under a light turning force, so it turns as far as the pin at the shear line lets it. Lift the stack with the slider and watch the graph of how far the plug can turn:

With a standard driver the plug barely moves until the gap reaches the line, and then the pin sets with a click. With a spool, the plug suddenly turns several degrees as soon as the waist reaches the shear line. To the picker this feels exactly like a pin setting, or even like the lock giving up. It's called a false set. Lift a little further and the spool's lower rim catches on the edge of the plug's hole, which has now turned too far to let it past. To finish, the picker has to ease the turning force and let the plug turn back a little while lifting, which they feel as the plug pushing back against the wrench. Serrated pins catch at every groove, so each one gives a string of false clicks.

Locks sold as pick-resistant mix the shapes, usually with spools or serrated pins in most holes and a standard pin or two, so the picker can't learn one rhythm and repeat it. The right key never notices: it lifts every stack at once, and only the break between key pin and driver matters.

None of this makes a lock impossible to pick. It turns a minute's work into a long, uncertain one, and it defeats the quick, rough methods, like raking a pick back and forth, that only work when every pin behaves the same.

Bumping

There's a way to open many pin tumbler locks that doesn't lift the pins one at a time at all. Take a key that fits the keyway, cut every position to the deepest depth, push it in one notch short of all the way, and give its head a sharp tap while turning it lightly. Locks often open. This is called bumping, and it was widely publicized in the mid-2000s, though locksmiths knew it long before .

Here is one stack in slow motion, magnified, with a graph of the heights of the top of the key pin and the bottom of the driver pin over the next few thousandths of a second. Strike it at :

The strike hits the key pin from below, and the key pin passes the blow on to the driver pin. With two pins of about the same mass, nearly all the momentum moves into the driver, the same way the ball at the far end of a Newton's cradle flies off while the rest stay still. The driver flies up, the spring slows it, and it falls back a few thousandths of a second later. For that moment the key pin is still sitting low and the driver is up high, and the break between them is a wide gap that straddles the shear line. A plug under a light turning force turns into that moment and holds the drivers out.

The deepest cut at every position is the trick: whatever the lock's own key pins, the bump key leaves every gap below the line, and the strike throws each driver up past it. A pin that needs a shallow cut sits far below the line on a bump key, so its driver has to jump further; at the same strike its moment never comes. The numbers in this figure are illustrative, with a pin's weight of about a quarter of a gram and a spring I made up, but the timing is about right: the window is a millisecond or two.

A real lock has five stacks, and all five gaps have to straddle the line at the same moment. Scrub through the first few milliseconds after one strike:

The pins needing shallow cuts have the furthest to jump, so their moments are shortest and come latest. Too gentle a strike and the shallow pins never open; too hard and the drivers that open first are already falling back by the time the last one rises. That's why bumping takes a few tries and some feel for the tap. Defenses go after the momentum transfer. Security pins catch the plug during the bounce, tight tolerances shrink the moment, and some cylinders add a second check that a tap can't fool, like a sidebar that reads the sides of the key.

Master keys

A building manager can't carry a separate key for every door, so the locks in a building often also open with a master key. That works because some stacks get a fourth part: a thin master wafer between the key pin and the driver pin. A stack with a wafer has two gaps instead of one. Step through the keys and watch both gaps:

Your key and the master key differ at three holes, and each of those holes has a wafer exactly as thick as the difference between the two cuts. With your key in, the gap at one end of the wafer lands on the shear line; with the master key, the gap at the other end does. The neighbor's key belongs to another lock in the same building. Their lock lets the master key in too, but at two of our holes their cuts match neither gap.

Each hole with a wafer accepts either of two depths, and nothing makes the holes agree with each other, so any key that takes some cuts from your key and the rest from the master works as well. List every key that opens the lock, with your cuts in blue and the master's in purple:

With wafers in three holes, eight keys open the lock; with all five, thirty-two. Two of them were cut on purpose. The rest are accidents of the design, and a large master key system has to track them so that one tenant's key doesn't happen to be another lock's accidental key.

Big buildings stack these systems in levels. Each apartment has its own change key; a master opens every door on a floor; a grand master opens every floor. Each level needs more holes with wafers, each wafer adds another gap that can land on the shear line, and every extra gap gives a picker one more way to set that pin. Master keying is a trade of security for convenience, and the locksmiths who plan these systems spend most of their effort keeping the trade small.

There is a worse consequence, which Matt Blaze described in 2003 . Anyone with one key to a master-keyed lock, and access to that lock, can work out the master key. They don't need to take anything apart. Keep every cut of your own key but one, try each other depth at that position, and see which one turns. The one that turns, if any, is the master's cut there:

At each position there are at most nine depths to try, so the whole search takes at most 45 test keys, and here it takes fewer. Where the master's cut matches yours, no other depth turns, and that tells you the master's cut too. Since a cut can only be made deeper, a careful attacker can make all the tries at one position on a single blank, starting shallow. Blaze called this rights amplification; the only real defenses are keyways that tenants can't buy blanks for, and master systems that don't rely on the pins alone.

Other ways to read a key

Pin tumblers aren't the only way to check a key. Two other designs are common, and the same ideas, a break that has to line up and a part that blocks the turn until it does, show up in both. Pick a design and work the key:

A wafer lock uses flat plates instead of pin stacks. Each plate has a window the key passes through, and a spring pushes it so that it sticks out of the plug into a slot in the housing. The right cut lifts each plate until it sits wholly inside the plug. Wafer locks are cheap and compact, so they turn up on desks, cabinets, and older cars. With the plates riding directly on the key and loose tolerances, they are also easy to pick.

A disc detainer works by rotation instead of lifting. A stack of discs sits around the keyway, each with a notch in its rim. Turning the key turns each disc, and the cuts on the key decide how far. When every notch lines up under a bar along the stack, the sidebar, the bar drops into the notches and lets the core turn. There are no springs, so there's nothing to bump, and picking means turning each disc to an angle rather than lifting a pin to a height. The Finnish maker Abloy is the best-known user.

High-security pin tumbler locks keep the stacks and add a second check. Dimple locks cut the key's flat face instead of its edge and can fit more pins in more rows. Others give the key pins a second job, so a pin must not only rise to the right height but also turn to the right angle, set by cuts on the key that slant left or right, before a sidebar can drop. Every added check multiplies the work of picking, and none of them gets in the way of the right key.

All three designs ask the same question of a key: does every part that blocks the turn move out of the way at once? A pin tumbler asks it with five heights, each checked to within a fraction of a step, inside a cylinder about as wide as a thumb. It does that well enough to guard most of the doors in the world, and loosely enough that anyone with patience, or one key and a building's worth of curiosity, can find a way past.

The figures are simplified. The keyway is a plain slot, the plug has no retaining clip or cam, all the driver pins are the same length, and the clearances and hole errors in the binding and picking figures are exaggerated many times over so they can be seen. The bumping numbers come from a simple model with assumed pin masses and spring forces. The wafer and disc detainer figures are schematic.

References

1. Marc Weber Tobias, Locks, Safes, and Security: An International Police Reference, 2nd ed. (Charles C Thomas, 2000).
2. Ted the Tool, The MIT Guide to Lock Picking (1991).
3. Deviant Ollam, Practical Lock Picking: A Physical Penetration Tester's Training Guide (Syngress, 2010).
4. Deviant Ollam, Keys to the Kingdom: Impressioning, Privilege Escalation, Bumping, and Other Key-Based Attacks Against Physical Locks (Syngress, 2012).
5. Matt Blaze, “Rights Amplification in Master-Keyed Mechanical Locks”, IEEE Security & Privacy 1, no. 2 (2003): 24–32.

Further reading

• Pin tumbler lock on Wikipedia, for the history and the variations in use.
• Master key on Wikipedia, for how master key systems are planned.
• Lock bumping and lock picking on Wikipedia.