Decoding: Reading a Lock's Combination Without Its Key — a Conceptual Overview

What Decoding Is

The Lock Industry Standards and Training (LIST) Council's Professional Locksmith Dictionary defines "decode" as "to determine a key combination by physical measurement of a key and/or cylinder parts." The combination in question is the key's bitting, which the same dictionary defines as "the number(s) which represent(s) the dimensions of the key" or "the actual cut(s) or combination of a key." Reading the cuts of an existing key to find its bitting is therefore decoding too, in the dictionary sense.

ANSI/BHMA A156.30, the American standard for high-security cylinders, treats decoding as a distinct threat. It describes resistance to decoding as protection "from identifying the dimensions of the correct key by inspecting the detainers (or pins) through the keyway or other openings in the cylinder face."

How Decoding Differs from Picking and Impressioning

The three terms are often run together, but they aim at different results:

• Picking operates the lock. LIST defines it as manipulating tumblers "through the keyway, without obvious damage, by means other than the specifically designed key." Picking does not by itself produce a key. See lockpicking.
• Decoding produces information: the combination. A key can then be cut from it.
• Impressioning produces a key directly. LIST describes the impression technique as fitting a key to a locked cylinder from marks the tumblers leave on a blank. See impressioning.

A156.30 reflects the same split. Its pick-resistance and decoding-resistance requirements are written separately.

Legitimate Contexts

Originating a key when none exists. Locksmith Ledger notes that when all keys are gone, a locksmith may read a lock's tumblers to originate a new key, and that the lock can then be serviced or rekeyed. "Originating" means making a key from the combination rather than copying another key. See key cutting.

The Fanberg case. A 1982 federal appeals decision shows how this work plays out in practice. In Chicago Lock Co. v. Fanberg, 676 F.2d 400 (9th Cir. 1982), the court described how owners of Chicago Lock's "Ace" tubular locks who lost a key could either order a duplicate from the company or have a locksmith work out the tumbler configuration and cut a new key. Locksmiths recorded each key code alongside the lock's serial number so they would not have to repeat the work. Beginning in 1975, locksmith Victor Fanberg collected those serial-to-code records from other locksmiths and, with his father, published them as a two-volume book. Chicago Lock sued. The Ninth Circuit ruled for the Fanbergs. It reasoned that a lock owner's reverse engineering of their own lock is allowed under trade secret law, and that the Fanbergs had not obtained the codes by improper means. The court also said that locksmiths owe their customers a duty not to disclose those customers' key codes. See tubular locks.

Looking up a code. Many keys and locks carry a code number that lets an authorized locksmith or the manufacturer produce a key without measuring anything. LIST distinguishes two kinds:

• A direct code is "a designation assigned to a particular key which includes the actual combination of the key."
• A blind code is "a designation, unrelated to the bitting, assigned to a particular key combination for future reference when additional keys or cylinders may be needed."

A blind code is useful only to someone who holds the matching record. Locksmith Ledger describes code machines that cut keys to factory depth and spacing from a code series, letting a locksmith produce a key "equal to an original factory-cut key."

Why Manufacturers Use Blind Codes and Key Control

LIST defines key control as "any method or procedure which limits unauthorized acquisition of a key and/or controls distribution of authorized keys," and as "a systematic organization of keys and key records." Decoding and code lookup are both ways around key control, so the standards address them directly.

ANSI/BHMA A156.30-2014 bars direct coding on high-security keys: "Direct coding in the form of mechanical bitting or electrified combinations, or electrified credential serial numbers shall not be used on credentials." It also bars visual key control markings on high-security cylinders. Its key blank requirements, in levels, range from blanks available only from the manufacturer, to blanks "protected by law," to factory-cut keys supplied only after authorization.

Code secrecy alone has limits. In Fanberg, Chicago Lock sold duplicate Ace keys only to the owner of record, kept its serial-to-code correlations "indefinitely and in secrecy," did not sell tubular blanks, and stamped its keys "Do Not Duplicate." Locksmiths' own records were still compiled into a published book. Locksmith Ledger's history of the trade similarly notes that automakers gradually removed key code numbers from vehicle locks as a security step. See restricted keyways.

Schlage's key systems guide frames the two sides this way: administrative security "is about key control. It relates to the barriers you put in place to prevent unwanted duplication," while physical security "is based on design features that determine the cylinder's resistance to bypass through picking, bumping or drilling."

Design Responses Described in Standards and Manufacturer Sources

The following responses are described by the standard or the manufacturer named. Pin and Ward has not tested them.

• A156.30 decoding resistance (2014 text). Its levels require, in order of addition, that no significant variations in detainer color or shape be visible through the keyway; components "designed to limit the effectiveness of probes, shims or other manual measuring or manipulation tools"; and components designed to limit "electronic measuring tools." Pin and Ward is not stating which letter level is highest until the current edition's text is checked.
• Medeco. Medeco's M4 catalog describes patent-pending key control "against unauthorized duplication of keys" and a movable element in the key that "deters against unauthorized 3D printed copies."
• Schlage. Schlage's guide describes patented keyways, including Everest 29 with patent protection it lists as running to 2029, and keyway exclusivity by geography or end user.

A156.30 cautions that its tests are performed under laboratory conditions and that results in actual use may differ. See high-security locks.

Related Topics

• Key bitting
• Key cutting
• Impressioning
• Tubular locks
• Key control
• Restricted keyways
• Lockpicking
• High-security locks

Sources