Lock Bypass 101 - When You Attack the Latch Instead of Picking the Lock

In the previous articles, we mostly talked about picking: manipulating the locking mechanism until it behaves as if the correct key was present. That is fun, technical, and very satisfying when the plug finally turns.

But physical security has an annoying truth:

Sometimes the fastest way through a lock is not through the pins.

That is what bypass is about. Instead of decoding or picking the mechanism, you attack another part of the system: the latch, the actuator, the shackle pawls, the door gap, the reset mechanism, or some other design shortcut that the lock manufacturer left available.

This article is an overview of common lock and padlock bypass families: knife bypass, comb picking, shimming, latch bypass tools, and the family I should have named directly: lock actuator attacks.

As always: only test this on locks you own, on practice hardware, or in an environment where you have explicit permission.

A useful overview of bypass-adjacent tools: core shims, comb picks, a lock knife, padlock shims and a plug spinner. Credits: Lukkojaska, CC BY-SA 4.0, via Wikimedia Commons.

Bypass vs Picking

Picking tries to make the lock cylinder do its normal job without the key.

Bypass tries to avoid that job entirely.

For example:

• Picking a padlock means manipulating the pins until the plug turns
• Bypassing a padlock may mean reaching the actuator directly
• Picking a door cylinder means setting the pins at the shear line
• Bypassing a door latch may mean retracting the latch without touching the cylinder

This distinction matters because a lock can be difficult to pick but still easy to bypass. The reverse is also true: a cheap cylinder may pick easily, while the surrounding hardware prevents simple bypass attacks.

Security is the whole system, not only the keyway.

Why Bypass Works

Bypass works when the lock exposes a shortcut between the outside world and the part that actually releases the lock.

Common causes:

1. Direct actuator access: a tool can reach the part moved by the plug
2. Spring-loaded latches: a latch can be pushed back without rotating the cylinder
3. Weak shackle locking: pawls can be moved from the shackle gap
4. Too much internal clearance: pins or mechanisms can be lifted past their normal range
5. Poor door fitment: gaps expose the latch
6. Missing secondary protections: no deadlatch, no latch guard, no ball-bearing pawls

A bypassable lock is not necessarily “bad” in every context. Sometimes it is just built for low cost, low risk, or convenience. The problem is when people rely on it for more security than it can realistically provide.

Knife Bypass

Knife bypass is usually discussed with cheaper padlocks. The idea is not to pick the pins. Instead, a thin bypass tool reaches into the lock and moves the actuator or release mechanism directly.

In a vulnerable padlock, the key normally turns the plug, and the plug moves a tailpiece or actuator that releases the shackle. If the design leaves that actuator reachable through the keyway or body gap, a thin tool can sometimes move it without setting any pins.

This is why the term can be confusing. It does not necessarily mean using a kitchen knife or forcing the lock. In locksport contexts, a “knife tool” is usually a thin bypass tool shaped to reach a specific internal part.

What It Teaches

Knife bypass teaches a very important lesson:

The cylinder can be perfectly fine, but the lock can still fail around it.

If the actuator is exposed, pin security becomes less relevant. Security pins, tight tolerances, and tricky keyways do not help much if a tool can ignore them.

Typical Targets

Knife bypass is more likely on:

• Cheap padlocks
• Some laminated padlocks
• Simple warded or low-security designs
• Locks with exposed or poorly shielded actuators

It is much less likely on better padlocks that isolate the actuator from the keyway or use designs specifically meant to resist bypass tools.

Defensive Notes

Look for padlocks advertised as bypass resistant. In practice, useful features include shielded actuators, ball-bearing locking, tighter internal layouts, and better body construction.

If a padlock is protecting anything important, do not judge it only by how hard the keyway looks.

Comb Picking

Comb picking is a weird one because it looks like picking, but it is really a bypass.

A comb pick has several tall teeth. On a vulnerable pin tumbler padlock, the comb can lift every pin stack higher than the normal shear line. If the lock body has enough vertical clearance above the pin chambers, the entire pin stack can be moved out of the way and the plug can rotate.

That means the attacker does not need to set each pin. They exploit extra space in the lock body.

Comb picks are shaped to lift entire pin stacks past the normal operating range. Credits: Lukkojaska, CC BY-SA 4.0, via Wikimedia Commons.

Comb picking as a geometry problem: the pin stacks are pushed above the plug instead of being set at the shear line. Credits: GWirken, Pbroks13 and Lukkojaska, CC BY-SA 4.0, via Wikimedia Commons.

Why It Works

In a normal pin tumbler lock, the key pin and driver pin split must align at the shear line. With comb picking, the pin stacks are pushed so far upward that they stop blocking the plug entirely.

This requires a design mistake or at least a design compromise: too much empty room above the pins.

What It Feels Like

Comb picking often feels unfair because it can be very fast on locks that are vulnerable to it. That is the point. It is not subtle feedback reading. It is exploiting geometry.

Defensive Notes

Comb resistance comes from preventing the pin stacks from being lifted too far. Better locks limit vertical travel, use different chamber geometry, or simply do not leave enough room for the comb attack to work.

For practice, combs are a useful demonstration of why internal clearances matter. For real security, they are a reminder that “it has pins” is not the same as “it is secure”.

Padlock Shimming

Shimming attacks the shackle locking mechanism directly.

Many padlocks hold the shackle with spring-loaded pawls. If there is enough space between the shackle and the lock body, a thin piece of spring steel can sometimes push the pawl away from the shackle notch. If both sides need to release, two shims may be needed.

Again, the cylinder is irrelevant. You are not picking the lock. You are moving the part that keeps the shackle closed.

A manufacturer-side illustration of the shimming problem on locker-style padlocks. Credits: Master Lock.

Where Shimming Works

Shimming is more likely on:

• Cheap padlocks with spring-loaded pawls
• Older simple padlocks
• Locks with visible shackle gaps
• Locks without ball-bearing locking

It is less effective against padlocks that use ball bearings to lock the shackle. Ball bearings usually need the plug and actuator to rotate before they can retract, so a shim cannot simply push them aside like a spring pawl.

Defensive Notes

For padlocks, ball-bearing locking is a big upgrade. Also look for tight shackle tolerances and hardened bodies that do not leave generous access around the shackle.

If you can see a huge gap around the shackle, that is usually not a great sign.

Short manufacturer video showing the defensive idea behind an anti-shim latch design. Credits: Master Lock.

Loiding and Shove Knife Bypass

Door latch bypass is often called loiding. The classic mental image is someone using a thin flexible tool to push back a spring latch through the gap between a door and frame.

A commercial version of this idea is often called a shove knife or Shovit style tool.

This does not defeat a deadbolt. It targets spring latches, especially when the door fitment is poor or the latch is not protected.

A shove knife / Shovit-style latch bypass tool. Credits: SouthOrd / Lockpicks.com.

Spring Latch vs Deadbolt

This is the key distinction:

• A spring latch is designed to retract when it hits the strike plate as the door closes
• A deadbolt should not retract just because pressure is applied to its side

That is why relying only on a spring latch is weak for external doors. The latch was designed for convenience first.

Deadlatches

Many latch systems include a small secondary plunger called a deadlatch or anti-loiding plunger. When installed correctly, it prevents the main latch from being pushed back while the door is closed.

The important phrase is “installed correctly”.

If the strike plate alignment is bad, the deadlatch may not do its job. The lock may look fine but still behave like a simple spring latch.

Defensive Notes

Good defenses include:

• Use a real deadbolt for exterior doors
• Make sure the deadlatch is correctly positioned
• Keep door and frame gaps tight
• Use latch guards where appropriate
• Do not rely on privacy knobs for security

This is a door hardware problem as much as a lock problem.

Lock Actuator Attacks

Lock actuator attacks are the cleanest example of bypass logic: instead of picking the cylinder, you try to move the internal part that the cylinder would normally move.

In many padlocks and simple lock bodies, the key turns the plug. The plug then moves a cam, tailpiece, actuator, locking dog, pawl release, or similar internal part. That part is what actually frees the shackle or latch. The cylinder is only the authorized interface to reach it.

An actuator attack asks a very blunt question:

Can I touch or move the release part without solving the cylinder?

If the answer is yes, the pinning may not matter much.

Why the Shape Looks Weird

Actuator bypass tools often look like little curved, bent, hooked, or flattened pieces of metal because the tool is shaped around the path into the lock body. The shape is not aesthetic. It is there to reach around warding, through the keyway, past the plug, or into the gap where the actuator sits.

This is the “little curved stuff” in context: a shaped actuator bypass tool, not a generic pick. Traveler hooks are real tools too, but they belong more naturally to latch bypass / loiding on doors. Lock actuator tools are more about reaching the internal release mechanism of a lock or padlock.

A commercial padlock actuator bypass tool. The important idea is the shape: it is meant to reach the release path, not manipulate the pins. Credits: Peterson Manufacturing.

Manufacturer video showing the category of actuator bypass tool discussed here. Credits: Peterson Manufacturing.

Typical Targets

Actuator attacks are more likely on:

• Cheap padlocks with exposed internal release parts
• Some older laminated padlocks
• Warded locks where the actuator can be reached with a simple tool
• Low-security cam locks
• Some cabinet, mailbox, or utility locks
• Poorly shielded lock bodies where the plug does not isolate the actuator

They are less likely against locks that physically separate the keyway from the actuator, use shielding plates, restrict tool paths, or require a more complex movement than “push this part sideways”.

What It Teaches

Actuator attacks are a good reminder that a lock is a chain of events:

1. The key interacts with the cylinder
2. The cylinder rotates
3. The actuator moves
4. The locking element retracts
5. The shackle, latch, or cam opens

Picking attacks step 1 and 2. Actuator attacks skip straight to step 3.

That is why a lock can have decent pinning and still be bad in practice. If the actuator is reachable, the attacker can ignore the part the manufacturer spent effort making pick-resistant.

Defensive Notes

Defenses focus on making the actuator unreachable or useless to touch directly:

• Shield the actuator from the keyway
• Avoid designs with direct tool paths from the outside
• Use ball-bearing shackle locking in padlocks
• Prefer bypass-resistant padlock designs
• Avoid cheap warded or novelty locks for serious use
• Check whether public bypass tests exist for the exact model
• Remember that a restrictive keyway is not enough if the actuator is exposed

If a curved bypass tool can reach the actuator, the real problem is not the tool. The real problem is that the lock exposes the part that actually opens it.

Warded Lock Bypass

Warded locks are common on very cheap padlocks, decorative locks, and old-style low-security hardware.

They do not use pin stacks like a pin tumbler lock. Instead, internal obstructions called wards block keys that do not have the right shape. A warded pick or skeleton-style key bypasses the wards by using a minimal shape that reaches the actuator.

This is another classic bypass: you are not decoding a precise bitting pattern. You are reaching the part that opens the lock while avoiding the wards.

Defensive Notes

Do not use warded padlocks for serious security. They are fine for props, luggage-level use, or very low-risk situations, but they are not comparable to a decent pin tumbler padlock.

Combination Lock Bypass and Decoding

Some combination locks can be bypassed or decoded without knowing the combination. This can involve feeling gate positions, exploiting reset mechanisms, decoding wheel packs, or attacking tolerances in the mechanism.

This category is broad, and it varies a lot by lock design. Some combination locks are toys. Some are serious mechanical systems. The difference is not always obvious from the outside.

The key idea is the same:

If the mechanism leaks information or exposes a reset/release path, the numbers may not matter as much as you think.

Defensive Notes

For important use, avoid cheap combination padlocks. Prefer reputable designs, shielded mechanisms, and models with known resistance to decoding and shimming.

Also remember that shared combinations are an operational problem. If ten people know the code, the lock may fail socially long before it fails mechanically.

Plug Spinner, Bump Key, Impressioning: Are These Bypass?

These are often discussed near bypass, but they are slightly different.

• Bump keys attack the pin stacks dynamically
• Impressioning creates a working key by reading marks
• Plug spinners rotate a picked plug quickly in the correct direction

They are useful to know about, but they are not the same as shimming or latch bypass. They still interact with the cylinder’s normal locking mechanism more directly.

For this article, I would keep them in the “entry techniques” bucket, not the pure bypass bucket.

How to Think Like a Defender

When evaluating a lock, do not ask only:

Can I pick this?

Ask:

1. Can the actuator be reached directly?
2. Can the shackle pawls be shimmed?
3. Can the latch be pushed back from the door gap?
4. Is there a working deadlatch?
5. Does the lock have ball-bearing shackle locking?
6. Is the strike plate aligned correctly?
7. Is the keyway the only meaningful attack surface?
8. Is the lock body stronger than the thing it is attached to?

That last one matters. A great padlock on a terrible hasp is still a terrible system.

Practice Setup

If you want to learn bypass responsibly, build a small practice setup.

Good practice targets:

• Cheap padlocks you own
• Transparent or cutaway demo locks
• Repinnable practice cylinders
• Spare door latch hardware mounted on a board
• Old hasps and strike plates mounted where you can inspect both sides

The goal is not to learn how to open random doors. The goal is to understand why certain hardware choices fail and how to recognize weak installations.

For doors, a mounted practice latch is much better than testing on a door people rely on. You can see what is happening, adjust the strike, test the deadlatch, and avoid breaking something important.

Common Mistakes

Thinking Picking Skill Equals Security Evaluation

Picking is only one attack path. A lock can be hard to pick and easy to bypass.

Ignoring Installation

Door hardware can be defeated by bad installation. A deadlatch that is not aligned correctly may as well not exist.

Trusting Weight

A heavy padlock is not automatically bypass resistant. Weight can mean stronger construction, but it can also just mean more metal around the same weak actuator.

Using the Wrong Lock for the Job

A warded padlock on a garden shed is one thing. The same padlock on expensive equipment is another.

Forgetting the Surroundings

The chain, hasp, screws, door frame, hinges, and strike plate are all part of the security system.

Defensive Checklist

For padlocks:

• Prefer ball-bearing locking
• Avoid warded locks for serious security
• Look for bypass-resistant actuator design
• Check shackle clearance
• Match the padlock to a strong hasp or chain
• Avoid very cheap combination padlocks for important use

For doors:

• Use a deadbolt, not only a spring latch
• Confirm the deadlatch works when the door is closed
• Keep the door gap controlled
• Use a latch guard if the latch is exposed
• Use long screws in strike plates where appropriate
• Make sure the frame is stronger than the lock

For both:

• Think in systems
• Assume the keyway is not the only attack surface
• Test only with permission

Legal and Ethical Considerations

Bypass techniques are powerful because they often ignore the part of the lock people pay attention to. That makes them useful for locksmiths, security testers, red teams, and locksport education. It also means they can be abused.

Only practice on your own hardware or with explicit authorization. Do not test bypass methods on locks in use unless you are prepared to repair or replace them. Do not carry tools without understanding your local laws.

And if you find a bypass issue in someone else’s installation, report it like a normal security finding: clearly, calmly, and with practical remediation.

Conclusion

Bypass is the part of physical security that feels unfair at first.

You spend time learning pins, shear lines, binding order, security pins, counter-rotation… and then a cheap padlock opens because the actuator was exposed. Or a door ignores its nice cylinder because the latch can be reached from the gap.

But that is exactly why bypass is worth learning.

It teaches you to stop looking at the lock as a small puzzle and start looking at the whole security system. The keyway matters. The latch matters. The shackle matters. The strike plate matters. The installation matters.

Good security is not “hard to pick”. Good security is “no easy path around the thing that is supposed to keep it closed”.

Note: This article is for educational purposes only. Always ensure you have legal permission before testing any lock or bypass technique.