Master Lock combination padlocks have been known to be vulnerable to an attack that reduces their 64,000 possible combinations down to 100. I've devised a new attack for cracking any Master combo lock that simplifies the process and reduces the amount of work down to only 8 combinations.

Use this calculator in conjunction with the instructions below to find the 8 possible combinations for your Master combo lock.

Watch the video for the full details, deconstruction, and a sneak peak at my robotic combo lock-cracking device. Written steps can be found below.

## Finding the 'First Locked Position'

- Set the dial to 0.
- Apply full pressure upward on the shackle as if trying to open it.
- Rotate dial to the left (towards 10) hard until the dial gets locked.
- Notice how the dial is locked into a small groove. If you're directly between two digits such as 3 and 4, release the shackle and turn the dial left further until you're into the next locked groove. However, if the dial is between two half digits (e.g., 2.5 and 3.5), then enter the digit in-between (e.g., 3) into
**First Locked Position**in the calculator below.

## Finding the 'Second Locked Position'

- Do all of the above again until you find the second digit below 11 that is between two half digits (e.g., 5.5 and 6.5), and enter the whole number (e.g., 7) into
**Second Locked Position**in the calculator below.

## Finding the 'Resistant Location'

- Apply half as much pressure to the shackle so that you can turn the dial.
- Rotate dial to the right until you feel resistance. Rotate the dial to the right several more times to ensure you're feeling resistance at the same exact location.
- Enter this number into
**Resistant Location**. If the resistance begins at a half number, such as 14.5, enter 14.5.

## Inputting the Numbers into My Calculator

- Make sure all three numbers are entered into the calculator at the top of this page, then click
**Find Combos**. We now have 20 possible combos, but we'll reduce this further. Keep reading!

## Finding the Right 'Third Digit'

- Set the dial to the first possibility for the
**Third Digit**. - Apply full pressure upward on the shackle as if trying to open it.
- Turn the dial and note how much give there is.
- Loosen the shackle and set the dial to the second possibility for the
**Third Digit**. - Apply full pressure upward on the shackle as if trying to open it.
- If there is
*more*give on the second digit, click the second digit in the calculator above. Otherwise, click the first digit.

## Testing Out the 8 Combinations on Your Lock

- You are left with 8 possible combinations. Test them all until one works with the standard instructions below.

## Standard Instructions for Opening a Combination Lock

- Turn right three times. Stop at
**First Digit**. - Turn left one full turn passing 1st number and stop at
**Second Digit**. - Turn right and stop at
**Third Digit**. Pull shackle. Profit.

**Want to start making money as a white hat hacker?** Jump-start your white-hat hacking career with our 2020 Premium Ethical Hacking Certification Training Bundle from the new Null Byte Shop and get over 60 hours of training from ethical hacking professionals.

## 95 Comments

Yeah, How was he able to use the forms. I checked the editor and that feature wasn't available

# Sergeant

Was a one-time thing that @bryan coded in manually.

Ooh, so it's coming in nicely, then.

Samy is a friend of WonderHowTo, and a hell of clever guy (check out his YouTube channel for some of his other genius hacks). So, we wanted to provide a way to let you all subscribe to his newsletter so you won't miss any of his genius hacks. Hence the form.

Funny, considering the Samy Worm.

not working for me with a sphero by MasterLock.

Is Samy the one who appeared in that motherboard documentary series 'Phreaked out' ?

Hey Bravo Mike, yup, that was me!

Hey, any thoughts about cracking an alphabetical lock? The brand is still master, though. Any help is appreciated.

Nevermind

Not working for me at all. Tried a variety of different stopping points for the second step, because mine always stops between two whole numbers, until I get to 12.5 and 13.5 - Since that's not before 11, I feel like something is up.

Found this master lock in the parking lot of my old apartment complex like 2 years ago... have never been able to open it.

Charlie, interesting -- okay, what is your resistant location and the first two locations it stops between two half numbers (you mentioned 12.5 and 13.5, what's the next one?)

Hi Samy,

Same as others here, I have an older lock from maybe 5-6 years ago, serial on bottom reads 1211CF. Same trouble. The dial locks at 2-3, so I skip. The first locked position then is 5.5 and 6.5. Next, it locks between 9 and 9.8. Then the next locked position is 12.2 and 13.1. Next is 15.5 and 16.5. Kicker here is that I do know the combination on this lock, as it was never used and still has the sticker. Happy to work with you on this. Would like to help amend your code to make it universal if possible. Standing by.

Same. First half numbered lock position is 2.5-3.5, second is 12.5-13.5, third is 22.5-23.5, resistance is 28

Same problem Samy. The first two locations that it stops between two half numbers is 4.5/5.5 and 14.5/15.5. There's also a 7.8/8.8 but I tried 8 as my second locked position and none of the combos worked with either third digit. Resistant location is 2.

Same problem here! Stops at 23.5 - 24.5 which means 24 for the second digit.

What's the math behind this? Or is it being kept secret to get people to use your calculator?

suspiciousfaceHi Trevor,

I'll be releasing an updated writeup and video with full details and explanation so that you won't need to use the calculator in the next week -- stay tuned!

Hi Trevor,

I'm trying this out and the numbers aren't matching w/ the combo that I know it works with. First stopping point is 2 & 2.9 which u explain isn't it. Second stop is 5.1 & 6, so thats not it ether. Third stop is 8.5 & 9.4, so I enter in 9 for First Digit. As I turn some more looking for the Second Digit, it's already passing 11. Next lock position is ether. 11.9 & 12.9 and 15.5 & 16.4. Suggestion?

Mine was the same, so I entered 6 and 9 and it worked. It was technically around 5.5, but it was closer to 6 than it was to five.

Worked flawlessly for one lock, but on another I cannot get the resistant number. I can only get the wheel to either spin smoothly, or be resistant every 3-5 digits.

Awesome! I took your formula and made a PHP class to interface on a cli: MasterCrack

Doesn't work for me. I know the combination and it gets the first and second numbers correct but not the third. The only options it gives for the third are 10 and 30 but the actual is 14. I know the first and second locked positions are correct and both are under 11 and the resistant location is either 4 or 4.5 but neither works

I don't think its fair to say you devised I

newattack. I posted a video that reduces this to 8 on youtube a few months ago, as well as updated an old blog post https://www.youtube.com/watch?v=xf5DOOvSW5ohttps://cytinus.wordpress.com/2013/01/28/hacking-master-dial-combination-locks/

Dope job on the web tool though. That's awesome.

I did not use the calculator above. It did just not work for my locks. Instead I used a combination of Samy's and your explanation.

I used Samy's method to find the first number ("resistant location" + 5) and the third number (integer notch with max. "play" centered around it). Then I calculated the magic number from the first number according to your explanation and based on that identified the 8 candidates for 2nd number..

Worked for me. Not sure of the age of the lock. It took me a few times to get the feel for the various positions, but easier than cutting the lock or chain. First locked was a 1 and that threw me a bit. Developing a feel for the resistant position was tricky at first too. Hey it Worked!!

Well, I think I found the first 2 numbers I need to input, but I cannot find the resistant position! I've tried readjusting the amount of "lift" on the shackle, to no avail. I either feel no resistance at all, a sort of rattle resistance on Everything or locked. Advice?

I'd love to know the math too.. I had to combine this with the "in 100 tries or less" method. The 3rd number was wrong, but easily found manually, the 1st number seems to be generated based on the resistance number, and even though it worked it wasn't the right number (only 1 digit off so maybe human error or glitch in the matrix) but regardless, 1 digit discrepancy still works in most cases. And my 2nd number was also only 1 digit off.. But I could generate the right digit using the "100" algorithm.. This all makes me REALLY want this formula, because I feel like with a little tweaks you can have a definitive 3rd, 1st, and maybe narrow down the 2nd. It all makes me wanna grab a few more locks from the store to test some theories and equations

If you used your formula, and compared your results with a well known matrix for master, one could perfect this

How can this work with a master lock with letters instead of numbers? I have 20 letters total on the dial.

Make this into an app on the android market? seems like it would be easy enough to do so, and having access to this without internet on a mobile device would be clutch

I only have one number between 0 and 11.

I got a 8 and a 11. So I wasn't able to use your formula.

Since it is a rotary dial I decide to try between 30 and 0 and I was able to get 35 and 38 with the resistance at 38.

I added 10 in modulus 40 to each number and input the number into the calculator.

The calculated result was then reconverted to get the correct dial number and on the second trial the lock opened.

My lock was 3,33 and 15

Amazing it works!

But you need to change your calculator formula if somebody like me doesn't have two numbers between 0 and 11 (exclusive).

I have a master combination lock with an external key port on the back I tried this multiple times with different calculations and still nothing.

I'm running in to some similar problems. My combination is 31-13-07

I have locked positions at 0, 7, 10. Does 0 count? You are not too clear on that point.

Next my resistance is at 12.5

The calculator does not produce a single correct number. Any ideas? Doing the old fashioned manner of reducing to 100 (or 80) combinations does produce all of my numbers.

Hmmm... possibly my 15 year old lock is built differently? If I use a resistant location of 26 the calculator produces good results, but I am sure my resistance is at 12.5

I found that the results of some tests depend on how I rotated the dial to set the starting point. Therefore I think that instructions starting with "Set the dial to" should indicate whether the position should be set by clockwise or ccw rotation of the dial.

Hi Samy, first of all, I got my lock open - so thanks! It did take me a few more than eight tries though so I thought I'd give some feedback in case you're interested or someone else finds it helpful.

Not a lot of luck with mine...

Resistance at 4 and 7 with less resistance at 27.

My first digit is actually 10...

The lock was originally purchased in 1980 or so.

I wonder if design changed at all?

You should make an Android and iOS app containing the instructions and videos, but most importantly the calculator. And maybe a written example showing the formula that the calculator uses. Or better yet, a 'Show Formula' button for the numbers entered. Thanks!

I have two locks the first one it worked great but my 2nd number is between 9.5 n 10.5 which one would I us3

This isn't working for me. My first lock up is between 1 and 2, next is between 4 and 5 then 8 and 9, then 10 and 11. I have none that go x.5 to y.5 between 0 and 11. I also can't find the resistance point. I get 3 or none.

I just tried a lock that I know the combination of and it doesn't work on that one either. My middle digit is 00 and none of the combinations give me 00 as an option. It also can't find the 3rd digit which is 33.

Took under 60 seconds for me to find the combo to an old lock I was going to throw away... Although I already knew ONE of the numbers, I wouldn't have believed it if I hadn't seen it with my own eyes.

I tried this several times with different master locks and it worked as outlined (I am used to using the 100 try method), but I came across a lock today that it would not work on. It's a master lock with a red dial and keyhole in the back. The numbers on the dial do not line up the same way they do on a standard master. I could not even do the 100 try method as I could not isolate the third digit. For this method however, I came close, but could not feel the Resistant Location. Thoughts anyone?

If anyone is interested, the numbers I got around the dial are:

3.5,6.5,9.5,13,16.5,19.5,23,26.5,29.5,33,36.5,39.5

I really can't get the "resistance number." Maybe the lock I'm trying to get into (an older lock that I thought I had lost and had replaced) is too old and beat up. Maybe I'm simply not dextrous enough to understand how much pressure to apply to the latch. I simply don't get it. Can anyone help me with this part of it? My hands or my brain or a combination of the two simply don't get it.

Took me less than 3 minutes to open the lock using this algorithm vs. other posted methods I tried. Thanks!

You're absolutely full of shit, this doesn't work what so ever! I've tried so many combos that my hands hurt. My lock doesn't stop anywhere before 15 and there's no resistance besides at 12 which doesn't give me a third number. Thanks for wasting my fucking time.

When something doesn't work on a how-to, your probably at fault. Worked like a charm for me!

That's a load of nonsense. How do you conclude that "if something doesn't work on a how-to" it's probably the fault of the user? Do you see the dozens of people who have said it isn't working?

It's not working for me, either. But I don't suspect Samy is going to reimburse us all for the lost time. It's nice that he's doing this kind of thing -- he's a good hacker. I like his little programmed device, too. But if he hasn't checked with strong confidence, he shouldn't release it. He needs to do more work before publishing unreliable reports, and it's irresponsible to publish something like this without checking on all of the problems and making revisions. He appears to have started trying a year ago, then he gave up. Instead of unpublishing this, he's left it up for thousands to try and fail at.

Discovered a lock I haven't seen in years, of course, combo was long gone. I tried the technique, fully believing it was full of crap. The first and last numbers did NOT seem familiar....but I started trying middle numbers from the list, and lo and behold, the 4th number worked and the lock popped open.

I totally felt like I did the whole instructions thing wrong because nothing really felt for sure like it was truly resistant, but anyway...worked for me and I have my pretty purple master lock back without having to buy another!

I found an old lock that I used to use. I needed it for something and I forgot the combination. I didn't want to go out and but a new one so instead I used this website and I helped me out a bunch. I got my combo in 5 minutes super easy. Anyone wanting to know if it works , it works perfectly.

My master lock only goes to #39, but the Calculator goes past 40

what to do?

woooooohooooo!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

It Works!!!

Thank You!!!

Took me quite a while to figure it out. I remembered the first number, but was having trouble with the other two. I knew that they were supposed to be close to each other. So that definitely helped.

Samy, this worked for me like a charm on my standard-issue master padlock. Unfortunately, I have another padlock that has letters instead of numbers. Any thoughts on how to crack this one? Any help would be appreciated.

So trying this with a generic store brand (Ace hardware) and not succeeding...Seems the first locked position is actually around 0 (can jimmy between 0 and 1). On another site there's a thing about finding 12 locked position going counterclockwise..first off, I assume mine means the first is .5??? Second...I've tried multiple different approaches to this and cannot crack this brand. Is it different for generic?

I tried this on 3 master locks. One I borrowed from my brother and the other two I bought new. Your system didn't work at 1 o'clock in the morning when I first tried it. But it worked great the next morning when i wasn't so tired. thanks.

omg....THIS WAS FANTASTIC THANK YOU SO MUCH!!!!!

Sammy I am truly amazed by how smart you are . I looked into your other stuff like phreaked out and your other articles . I want to start learning about these things . I'm somewhat tech savy but nothing like your status . I'm not asking to learn how to hack because I know it's not as simple as that . It's a bit more specific it looks like . Where do I start ? How long did it take you to be as wise as you are with all your stuff ? I mean, you built your own freakin machine and for that I envy you . Any tips , guides, or words of wisdom would be greatly appreciated!

Thanks for this bro!

--But most of all Samy is my hero

help my dad put a master combinaion lock on the freezer what do i do i do not know any of the numbers or possabilities on the lock i do not even know the formula to it

It didn't work for mine. I did unlock it, but only because I knew the second two. I forgot the first one...The last two were not even options and I did it correctly.

Didn't work for me. I found the first locked position at 2.5-3.5, the second 4.5-5.5, a third at 8.0-9.0. The resistance point is around 36.9. When I input the numbers into your calculator, the combinations don't work.

Is it possible that I have had determined the locked points inaccurately? Is there any other tricks that I can try?

Thanks

Hello Samy! It didn't work for me. My 1st lock position is 4, 2nd- 7 and resistance # is 29. Hope to hear from you. Thanks!

Having a really hard time trying to find the third number. There's resistance between a bunch of numbers so I'm getting nowhere.

Thanks! This totally works! I've been trying to figure out the combination of my lock that I got long time ago for about four years. I tried few methods, but this method worked perfectly!! OHhh this feels so good to finally find out the combination!!

ive tried differend things and its not giving me a third number? what do i do?

This isn't working for me. I know the combination to my lock, and it's getting the first and second number correct, but not the third.

I have 2 locks I found in a storage box that I had lost the combination to. My first try with this hack worked immediately. The second lock, was a bit more challenging. I thought 0 was one of my locked numbers, but no! I also missed the .5 on my resistance number. This gave me a 40 as a possible third number. Ha! Impossible on this lock.

I just kept at it until I had the accurate numbers to input in the calculator.

So my advice, if you don't get a solution, is go back to square one and start over. Try adding .5 to your third number. (Ex. 13.5)

Good luck folks!

You site gives me 4 third digit, so I tried them all and one worked.

After an hour of going through the process, I finally got frustrated enough to rip off the back of my padlock and align the pins by eye. Bet this would have worked if my last number weren't 0. But, alas, it was, and as far as I can tell, there's no way to get '0' as the final digit through the algorithm

Worked great on the first lock. On the second lock I had to combine it with the 100 tries algorithm as the resistance point returns an incorrect number. I feel resistance at 20 - must have done this 50 times, but the first number is a 6 (so resistance should have been at 1). I feel absolutely no resistance anywhere near 1.

While finding the resistance point is most difficult (mine had two and was off by 2 places). This method helped me find the true combo and eliminate too many options. I used this technique with another technique to eliminate possibilities and resolve which was the true resistance point. I now have a working combo lock again after 12 years of being stuck on my gym bag.

I find that with the type of combination lock on the video the best method to use is to simply hold the lock in one hand with your finger in the loop and push the loop outwards as hard as you can. Turn the dial until you feel the loop pop, then turn the dial the other way, then the original way, 3 pops and it's done. This technique works for virtually all combination locks. I do find the concept interesting, but why settle for eight tries when you can do it in one or two!

This worked except that my second locked position was 17, and it was really about 16.3-17.2 so it was kind of hard to figure that out. My first locked position was actually 0 but that didn't work maybe because my resistance was also 0, or maybe just because 0 isn't allowed I don't know. So I then had to move on to the next two numbers, 10 and 17.

Worked, no problems either was pretty straight forward.

It only gives me the first digit

My lock doesn't fit the algorithm at all... the sticking points are 9 and 16, input as 6 and 9, and the resistant point is 9. the combo is 4-10-16. not at all what the tool said. serial 911004.

Seems there have been some problems with this, you may want to check Samys youtube channel for an update. https://www.youtube.com/channel/UC4m2G6T18_JcjwxwtwKJijw

Wow, man....that actually worked. Great post. It only barely helped that I knew the last digit was 38 cause of the Fetty Wap song

WHERE IS THE CALCULATOR ITS NOT ON THE PAGE!!!!!!!

Should be fixed now!

The calculator doesn't appear on the page anymore.

A site update caused this issue, but it's fixed now.

Good luck on not getting caught brute forcing the combination.

Try this instead. Shim designs WILL vary.

Not responsible for what you do with this information.

Doesn't provide anything close to my combo. I haven't been able to figure out an old lock despite doing all the steps multiple times so I tried it on a lock that I know the combo for. The combo is 14-32-6 with the first two locked positions at 6 then 9. None of the possibilities come close to the combination. Then when I put in the resistance location which is quite obviously 31, there are still no combo options that come close.

For anyone who has struggled with this walk through, also watch this video - the first number is the "sticky" number +4 or 5 or 6, so the real trouble is which way to turn to find the sticky number - TURN COUNTERCLOCKWISE, if you don't want to lose your mind. So here's the link, youtube.com/watch?v=wdkf1Z_Bmfw

and everything else works. Create a list of ~ 4 possible starting numbers, 2 possible final numbers, and 8 middle numbers based off of your final number (remainder 4, +2). This is the surefire way to crack one of these locks. If this doesn't work, make sure that you find the first number by TURNING COUNTERCLOCKWISE!

To clarify, if you're "sticky" number is between two numbers, say, 6.5, then you want to see if 6+4, 6+5, 6+6, 7+4, 7+5, and 7+6 are your first number - this reduces to 10, 11, 12, or 13 as possible first numbers, hence creating a list of four possible starting numbers.

Typed a whole response, but this pos website gave some stupid Ajax error and poof it was all gone. Can't people code stuff anymore. For those that can't get it to work for their lock, there is a reason. The author got well out over his skis and assumed all master lock 1500's are the same.....news flash they aren't. This won't work for many like those with serial numbers starting with 909, 910 etc. The resistant number doesn't go in the first position for starters, and you dont add 5. The 3rd number is found by finding the anomaly to the 3 detents from 1 to 11 and adding 10 3 times and looking for the one that's off. The missing number is gained by brute force or finding other smaller resistant numbers.

As for Brute force, don't need to try all 40 numbers, every other number works fine (20x max), as masterlocks aren't precision instruments. As for clarification on finding the anomaly(3rd number) , you don't need a calculator....just do this. Go to zero, find the first detent (between 0-11), lets say it's exactly 2-3, add 10, go to 12-13, is it exactly between 12 and 13 like it was for 2-3, if so add 10 again (22-23) same question up to 33-34. Go to the next detent, maybe this is 4 3/4 to 5 3/4, add 10, is it between 14 3/4 and 15 3/4 on and on till you find something like 34 1/4 to 15 3/4, and there is your anomaly. Write it down, as that is your 3rd number of the combo. Beware, many are quite subtle. Another hint, look for other resistance number other than your predominate number as they will be likely candidates for success. In finding your missing number. Good luck

Your welcome

As for Brute force, don't need to try all 40 numbers, every other number works fine (20x max), as masterlocks aren't precision instruments. As for clarification on finding the anomaly(3rd number) , you don't need a calculator....just do this. Go to zero, find the first detent (between 0-11), lets say it's exactly 2-3, add 10, go to 12-13, is it exactly between 12 and 13 like it was for 2-3, if so add 10 again (22-23) same question up to 33-34. Go to the next detent, maybe this is 4 3/4 to 5 3/4, add 10, is it between 14 3/4 and 15 3/4 on and on till you find something like 34 1/4 to 15 3/4, and there is your anomaly. Write it down, as that is your 3rd number of the combo. Beware, many are quite subtle. Another hint, look for other resistance number other than your predominate number as they will be likely candidates for success. In finding your missing number. Good luck

Mister Lee, your method works for finding the last number, and is the simplest yet, thank you!

The 100 method also works, but takes a little longer

Strangely, I have a lock where pulling half way, the sticky number was consistently at 38, and the first number was not 3 as the formula on this page suggests (add 5 to the resistance number), it was the second number that was 3!

Anyway, the 100 method works (I got it on the 71st attempt in my case). It opened even though the first two numbers were off by one--which I verified by trying above and below the numbers that originally opened it. It seems that master locks are lenient by one number either way for each position.

The method on this page ended up with the first two numbers being reversed and the third number being wrong.

I have two locks, BOTH stop in between numbers on the first try.

the instructions are a bit vague on the first number.

can someone explain them better?

## Share Your Thoughts