How Bump Keys Work
(And How to Stop Them)

Most burglars aren't subtle. They kick in a door, smash a window, or pry a frame until something gives. It's loud, fast, and almost always leaves behind obvious evidence of forced entry.

Bump keys are different — and that's exactly what makes them worth understanding.

Lock bumping is a real technique used in real break-ins. It's not the dominant threat (more on that in a moment), but it belongs to a specific category of attack that standard security advice almost never addresses: the kind that leaves your lock intact, your door unmarked, and your insurance company skeptical that anything happened at all.

How Common Is It, Really?

Let's be straight about the numbers, because most articles on this topic aren't.

Forced entry — kicking doors, breaking windows, prying locks — accounts for the majority of residential break-ins. Lock manipulation of any kind, including picking, bumping, and shimming combined, shows up in roughly 1–2% of confirmed burglaries according to DOJ crime victimization data.

That's not a fringe threat. And that number is almost certainly undercounted. A successful bump attack leaves no damage, no scratch marks, no broken frame. When police respond to a burglary with no signs of forced entry, the report often gets written as "unknown method" or simply "possible unlocked door." The victim can't prove otherwise, and the statistic never gets recorded correctly.

What Is a Bump Key?

A bump key is a modified key filed down so every tooth sits at the maximum depth allowed for that keyway — what locksmiths call a "999 key," since most manufacturers use a depth scale where 9 is the deepest cut. Every position is filed to 9, giving the key a uniform sawtooth profile.

A bump key has to match the keyway family of the target lock. A Kwikset bump key only works in Kwikset cylinders. A Schlage bump key only works in Schlage cylinders. But most residential locks in North America use a handful of common keyways, and sets covering the most common profiles sell online for well under $20.

How the Attack Works

To understand bumping, you need a quick look at how a standard pin tumbler lock operates.

Inside the cylinder, there are a series of spring-loaded pin stacks — usually five or six. Each stack has two pins: a key pin at the bottom and a driver pin above it. When no key is inserted, the driver pins are pushed down by their springs, crossing the shear line (the gap between the plug and the housing) and blocking the plug from rotating. Insert the correct key and each cut lifts its pin stack to precisely the right height, aligning all the driver pins at the shear line simultaneously. The plug turns, the lock opens.

Bumping exploits a basic principle of physics. The bump key is inserted one position back from fully seated, then struck inward with a light tap — a screwdriver handle, a rubber mallet, even a finger will do — while slight rotational tension is maintained. The impact transfers kinetic energy up through the key pins into the driver pins, causing them to briefly jump above the shear line. In that fraction of a millisecond, if the tension is timed correctly, the plug rotates and the lock opens.

With practice, the whole thing takes seconds. It requires no feel for individual pin feedback, leaves almost no physical evidence, and can be executed on the front step of a house in the time it takes to look like you're just unlocking the door.

Why Your Grade 1 Lock Doesn't Cover This

Here's something the packaging at your hardware store won't tell you: ANSI/BHMA grade ratings don't test for bump resistance.

A Grade 1 deadbolt — the highest residential rating — is tested for physical strength: bolt durability, kick resistance, cycle count, strike plate integrity. It is not evaluated for resistance to lock manipulation attacks. You can have a Grade 1 deadbolt that bumps open in under ten seconds. The grade tells you how well it holds up to a boot, not a bump key.

This is a genuine gap in how locks are marketed and understood. If you want to dig deeper into what the ANSI grading system actually covers (and what it doesn't), we break it down in our ANSI lock grades explainer.

Do Security Pins Help?

This is where it gets nuanced — and where hands-on locksport experience is actually useful context.

Many mid-range and higher-end locks include security pins: spools, serrated pins, or mushroom pins. These are designed to complicate picking by creating false sets — moments where the pins feel like they've set correctly but haven't, requiring the picker to recognize and adjust.

Security pins do offer some bump resistance for the same reason. A spool pin landing in a false set position creates resistance that can prevent the plug from rotating cleanly during a bump attempt. Against an unskilled attacker, a lock with quality spool pins is meaningfully harder to bump than one without.

What Actually Stops It

To defeat bumping reliably, you need a lock that doesn't rely solely on a single shear line of spring-loaded pins. There are a few ways manufacturers solve this:

Sidebar Mechanisms

Locks like the Medeco M3, Medeco M4, and Mul-T-Lock MT5+ use a secondary sidebar that must engage independently before the plug can rotate. Even if a bump forces all driver pins above the shear line simultaneously, the sidebar won't release unless the key is correctly positioned at additional angles or depths that a bump key can't satisfy. You can't bumps two independent conditions at the same time.

Disc Detainer Locks

Locks like the Abloy Protec2 don't use spring-loaded pins at all — they use rotating discs that align only when the correct key is turned. There are no pins to jump. The technique is mechanically inapplicable. It's one of the main reasons the Abloy platform is considered among the most bump-resistant options available. We have a full deep-dive on the Abloy Protec2 if you want the complete breakdown.

Magnetic Pin Systems

Some locks incorporate magnetic elements in their pin stacks that only respond correctly to a corresponding magnetic key. A standard bump key carries no magnetic component, so the driver pins don't behave predictably when struck.

UL 437 Certification

This is the benchmark worth looking for. UL 437 is a rating from Underwriters Laboratories covering resistance to picking, drilling, pulling, prying, and sawing — tested against the clock with specific hand and power tools. Locks carrying this rating have been independently verified across multiple attack vectors, manipulation attacks included.

One clarification worth making: UL 437 is a strong reference point, but it's not the official definition of "high security" in the US — that's BHMA/ANSI 156.30. When shopping seriously, cross-referencing both is the most thorough approach. Locks worth knowing in this category: Medeco Maxum, Medeco M4, Mul-T-Lock MT5+, Schlage Primus XP. Cylinder prices typically start around $150 and go up.

Budget-Friendly Options

Not every situation calls for a $200 cylinder. If you want meaningful bump resistance without going full high-security, a couple of consumer options are worth knowing:

Kwikset SmartKey (980 series) uses a sidebar-based rekeying mechanism that also provides better bump resistance than standard Kwikset pin tumbler locks. Not UL 437, but a real step up at a consumer price point.

Schlage B60N uses a more complex keyway than typical entry-level locks and comes with some security pins from the factory. Not bump-proof, but notably better than a basic big-box deadbolt.

For most homeowners, the realistic threat model is still dominated by opportunistic forced entry — and no bump-resistant lock helps if your door frame is weak. Pairing a better lock with a reinforced strike plate and door jamb hardware is almost always a smarter investment than an expensive cylinder alone. We cover that fully in our door frame reinforcement guide.

Recommended Locks

Affiliate links via Amazon — your purchase supports NoPryZone at no extra cost to you.  (Ad)

Budget Pick

Kwikset SmartKey 980 Deadbolt

Sidebar-based mechanism provides better bump resistance than standard Kwikset. Easy DIY rekey. Good entry-level upgrade.

View on Amazon

Mid Range

Schlage B60N Deadbolt

More complex keyway and factory security pins. Solid step up from basic big-box hardware at a reasonable price.

View on Amazon

Premium

Medeco Maxum Deadbolt

UL 437 certified. Sidebar + rotating pins provide genuine bump and pick resistance. The gold standard for residential high-security.

View on Amazon

The Insurance Problem Nobody Talks About

This is an angle most home security content skips over — but it's one of the most practical reasons to understand bump attacks.

Because a clean bump entry leaves no visible damage, homeowners often have no idea how their home was accessed. A locked door with no signs of forced entry frequently gets attributed to a forgotten lock, a lost key, or an unlocked window. That assumption has real consequences: many insurance policies require evidence of forced entry to approve a claim. If there's none, the claim gets denied or complicated — not because the break-in didn't happen, but because there's no physical proof of how it did.

This is also part of why bump attacks are systematically undercounted in crime statistics. Police write "unknown" or "unlocked door" on reports when there's nothing physically obvious — and the number never gets recorded correctly.

If you ever come home to signs that someone has been inside with no obvious forced entry, it's worth having a locksmith examine the cylinder. Microscopic witness marks from a bump key can sometimes be identified on close inspection — but only if someone is specifically looking for them.

Bump Key Defence: The Short Version

• Know what you have. A standard pin tumbler deadbolt from a hardware store with no sidebar mechanism is vulnerable to bumping.
• Upgrade if the risk fits your situation. Sidebar locks (Medeco, Mul-T-Lock, Abloy) are the real solution. UL 437 is the benchmark to look for.
• Security pins help, but aren't enough on their own. They raise difficulty — they don't close the underlying vulnerability.
• Don't neglect the door itself. A bump-resistant lock on a weak frame is still a weak entry point. Reinforced strike plates and door jamb armour matter just as much.
• Keyless locks eliminate bumping entirely — though they introduce different considerations around power failure and other attack vectors worth thinking through.
• Understand the insurance angle. Clean bump entries can complicate or invalidate claims. It's a real and underreported consequence of manipulation attacks.

Bottom Line

Bumping isn't the most common way homes get broken into. Kicked doors and broken windows are. But it belongs to a category of attack specifically designed to evade the evidence trail that both home security and insurance systems rely on — and that makes it worth understanding even when the raw numbers are small.

The locks on most North American front doors are vulnerable to it. The good news is that effective countermeasures are well understood, independently tested, and available at a range of price points. Knowing what to look for is most of the battle.

If you're thinking about a full door security audit, our Best Deadbolts 2026 guide covers the top picks across all price ranges with that lens applied.