Key Bumping: Pin Tumbler Exploit and Defenses

Definition

Bumping is a form of lockpicking in the broad LIST sense: manipulating tumblers through the keyway without the designed key. It belongs with other impact methods. Locksmith Ledger's 2006 coverage noted that "mechanical and electric pick guns use this same principle." The difference is the delivery. A pick gun is a separate tool; a bump key is a key cut for impact rather than for the lock's combination.

Why Pin Tumblers Are Vulnerable in Principle

A pin tumbler lock depends on stacks of separate pins. The plug turns only when the gap in every stack lines up with the shear line. Because those pins can move independently, an impulse delivered through them can, in principle, open a brief gap at the shear line. That is a property of the pin-stack form, not of any particular brand. Manufacturers answer it by designs that stop that gap from forming, or that add a second locking element such as a sidebar. See pin tumbler locks for how the parts work. That is as far as this article goes on mechanism.

History of Disclosure

The idea is older than the mid-2000s publicity.

• Early patent. US Patent 1,667,223, "Lock device," was filed by Hiram R. Simpson on September 28, 1926, and published on April 24, 1928. It describes a slug key with substantially uniform notches and means for imparting reciprocatory motion and torque, for use when keys are lost, "preferably without mutilating the lock." Older trade references sometimes give "1926" as the patent's date; that is the filing year.
• Trade knowledge. Barry Wels and Rop Gonggrijp of TOOOL, writing in January 2005, stated that bumping, "sometimes also called 'Rapping,' has been a known technique for at least the past 50 years," and that a bump key is described in Marc Weber Tobias's reference work Locks, Safes, and Security.
• 2005–2006 publicity. TOOOL published Bumping Locks (last revision January 26, 2005). Bruce Schneier's March 2005 blog post "Flaw in Pin-Tumbler Locks" covered the Wels and Gonggrijp paper and the resulting public discussion. TOOOL's publications page states that the paper "led to TOOOL testing Dutch locks for the Dutch consumer organisation 'Consumentenbond'." An English translation of the Consumentenbond magazine report (issue 04/2006) says that of 60 locks carrying the Dutch Police Seal of Approval (PKVW), 47 could be opened with a bump key in the test, including locks expected to resist the method. The same report notes that the Centre for Crime Prevention and Security (CCV) planned to stop recommending locks for the Police Seal if they could be opened that way.

Pin and Ward cites those sources for history and public-test results only. Method sections of the research paper and of any how-to material are not used here.

Standards Response

Standards bodies and national schemes treat bumping as one of the attacks a cylinder may have to resist.

• UL 437 (Key Locks). Summaries of the standard, including Tobias and Fiddler's 2007 DEF CON presentation, list timed covert-entry tests for picking and impressioning. Manufacturers sometimes cite UL 437 paragraphs when claiming bump resistance.
• ANSI/BHMA A156.30 (High Security Cylinders). The 2014 edition includes pick-resistance requirements with detainers that have "false notches, mushroom shapes or other constructions," and cautions that tests "are performed under laboratory conditions."
• EN 1303:2026 (Europe). The 2026 edition adds "requirements and evaluation methods for manipulation," defined as an unauthorized attempt to open a cylinder by non-destructive techniques.
• TS 007 (United Kingdom). The Door and Hardware Federation's TS 007 scheme addresses cylinder resistance to forced and covert attacks including bumping. Trade explanations of the Kitemark state that 3-star Kitemarked cylinders are tested against drilling, picking, bumping, snapping, and plug extraction, and that a 1-star cylinder may be paired with a 2-star handle or surround to reach the same overall rating.

A rating describes a defined test. It is not a guarantee against every method in every installation.

Manufacturer Claims (Attributed)

Manufacturers market bump resistance under their own product claims. Examples Pin and Ward has verified from primary manufacturer pages:

• Kwikset SmartKey. Kwikset's SmartKey product page lists "Bump Proof" among its features. Its press-kit FAQ states that SmartKey products include technology "that help protect against… lock picking and lock bumping," and that BumpGuard protection is intended to pass UL 437 paragraph 11.6.
• Medeco. Medeco's catalog materials describe the security of a locking system as depending on "protection against attacks such as picking, drilling, bumping, and forcing," alongside key control.

These are manufacturer statements, not independent lab results reported by Pin and Ward. Specifiers should check the current edition of the cited standard and the product's listing.

Ethics and Law

TOOOL's preface to the 2005 paper argued for publishing so that "those that depend on the security of locks… need to be able to continuously re-evaluate their security having full knowledge of any threats," and noted that "the perfect lock does not exist." Locksport clubs require permission. TOOOL Netherlands says its most important rule is "to only open locks that you have permission for to open from the owner."

Possession of a bump key with criminal intent is itself an offense in some places. California Penal Code § 466 lists a "bump key" among instruments whose possession with intent to break or enter is a misdemeanor. Laws vary. This article gives no legal advice.

Related Topics

• Pick gun
• Lockpicking
• Security pins
• Sidebar locks
• High-security locks
• Pin tumbler locks
• Forensic locksmithing
• UL 437

Sources