How to open a wordlock padlock without the combination

alright guys about a couple of brand-new

word locks to try to figure out an

exploit I figure gonna take a lot of

time but you know what

it didn't these things are so easy to

open up stick around and I'll show you

how to do it alright guys these things

are so easy to pick you're not gonna

believe it however they are painful

they're painful to your thumb and you'll

understand why in just a minute so just

rotate all of your wheels just to make

sure we're good and mixed up when you

begin though make sure that everything

is lined up perfectly on a letter don't

have one of them half like that because

I don't throw the whole system off just

line them up on any letter and start

from there now the pain begins and I'm

gonna hold it like this I'm gonna use my

thumb to press on that release lever and

A while back I got hold of a 5 letter Wordlock padlock, which is a combination padlock but has letters on the dials instead of numbers. It’s supposed to make it easier to remember your combination. As with all the combination locks I get my hands on, I start to try and work out how to crack the combination. The last two times we used a shim to crack the combination, first on the Abus lock from my school’s lockers and then on the other cheap lock we picked up from the hardware. They both had weaknesses that let you put a shim in next to the dial and feel for a groove which helped you decode it. If you want to see how, take a look at the two linked articles above or we have some videos in a playlist on our YouTube channel that shows the bypasses in action.

With this new combination padlock we used a new technique which doesn’t even need any tools, so anyone can try this technique at home. The technique ill show you works on a lot of different combination locks, especially combination bike locks which usually have the same type of mechanism.

As usual, there is a link to a video at the end of this article which talks about the lock, the technique and also a demo of the bypass, so if you’d rather watch than read, jump to the end!

How the Combination Lock Works

So here is the inside of the lock. How great is this combination? You get very limited letters you can use and each dial is different but I could still put my name. I think the lock was made for me! ????

Inside the lock you have the usual parts like the shackle. You also have the dials which turn gears underneath that you cant see in this picture. And finally, you have the core which runs through the centre. The core is the bit that moves to unlock the shackle which means you cant shim the shackle.

In the last video we showed you, the shackle went through the centre of the dials so when the dials were in the correct position the shackle slid up. In this lock you can see the shackle is actually to the side of the dials and the core is the bit that holds the shackle in place.

Here are the core and shackle removed.

The core is actually two pieces, one that slides inside the other. When unlocked the centrepiece can slide up which lets the shackle slide up and open.

If you look at the core you will see there are three vertical rows of little bumps (you can see this easier in the video). Two rows are on the outer core and one row is on the inner core. These are also arranged in 5 horizontal rows. One row for each of the letter dials. These bumps are what stops the core from sliding unless all the dials are in the right place.

Here is one of the gears. These fit over the core and then the dial fits over the gear.

Combination Lock Bypass Technique

Now that you understand how the lock works inside, you’re probably wondering how our bypass technique works? When you pull up on the shackle you are trying to pull the centre of the core up. This forces the bumps against the inside of the gears.

When you rotate a dial, when it gets to the right letter, the gear is aligned and the core slides a tiny bit upwards. This is enough so the dial can’t move anymore as its trapped, and the next gear gets all the tension. It’s the same as picking a pin tumbler lock where the core turns slightly and catches the picked pin and applies pressure to the next pin.

You just repeat until all gears are in line with the bumps, the core slides up and its open.

How to Perform the Bypass Technique

To perform this attack you need to put constant tension on the shackle. This puts tension on the gears inside which is very similar to the way you use a tension wrench when picking a pin tumbler lock.

You can pull up with your hands on the shackle but this gets tiring quickly so its way easier to attach it to something and just pull down. What we do is put another lock in our vice and hook the shackle through that lock. It’s like it’s locked onto something, like a gate or locker, and its easy to pull down and use a constant tension. Please excuse the starting combination on this lock. I swear it came like this from the shop ????

All you need to do is start with the last letter of the combination and move one by one up to the first. On this lock, you find that the last dial is the one that binds when you apply tension. Other locks could be the opposite or you might find you can’t tell the order until you start testing it, again like picking a pin tumbler.

Pulling down lightly on the lock, turn the dial. You will know when you find the right letter cause it will stick and you won’t be able to move it again. The insides actually move a bit when you get the right letter. The gear under the dial falls into the groove and the inner core can slide slightly which then causes the next dial to bind.

When you look at the parts inside you’ll see it doesn’t have any false gates. False gates are in some locks to trick you into locking up on the wrong letter and thinking you have the right code. We did find on this lock that sometimes it does catch on the wrong letter. Good thing is it seems to stick between 2 letters so you can tell its wrong. You just release tension a bit, move the dial onto the next letter, apply tension again and keep going. The most common place for it to lock up was on the final dial, the first letter of the combination. If it’s going to lock up that’s the best place for it to happen. You already know the other 4 letters so you can just turn the dial to each letter, pull-down and if it’s right the lock will open. You can see me doing this in the video to finish off bypassing the lock as it was locking up a bit.

As each dial sticks, move up to the next one. Eventually, you will get to the last one and OPEN! The lock will pop.

Pretty easy isn’t it? Here’s my latest video that goes through everything I’ve talked about above so probably easier to understand when you see it in action. I also give you a demo so you can see how to perform the technique yourself.

If you have any questions or just want to tell us about your techniques or how you go trying this, we would love to hear from you in the comments.

Until next time, have fun lock picking and we will be back soon with another lock bypass!

Boo

Boo has a passion for bypassing tamper evident devices, having first got her tiny 6 year old hands on them at BSides Canberra in 2017. When she isn't bypassing tamper evident devices or lock picking, she can be found writing code, programming her robot, performing gymnastics manoeuvres or taking other children down in the MMA dojo.

How do you unlock a Wordlock if you forgot the combination?