We've tested a lot of bad locks. Most of them are just... disappointing. Cheap metal, sloppy tolerances, a cylinder that a beginner picker cracks in under a minute. That's the baseline of the budget security industry and at this point, we expect it. What we didn't expect — even after years of doing this — was the particular flavor of dread that came from opening a specific category of locks. Not the cheap ones that look cheap. The ones that look like they're doing their job. The ones with reassuring branding and confident packaging and little logos that say things like "CERTIFIED" without explaining what exactly was certified, or when, or by whom.
These are those locks. Seven of them. Some are padlocks. One is a safe. One is a deadbolt cylinder that has been installed on more American front doors than any other lock in history. We're going to walk through each one, explain exactly how they fail, and tell you where they're still being sold right now. Because they are. Every single one of them.
The scary part isn't that these locks exist. It's that you probably have one.
The Master Lock No. 3 is one of the most recognized padlocks in the world. Laminated steel body. Hardened shackle. A brand name that's been synonymous with "security" since your grandfather was in school. The packaging calls it ideal for "industrial applications." It comes with dual ball bearings for pry resistance. It looks and feels like a real lock.
It opens with a hammer. Not as a metaphor. Literally, physically, a small brass hammer — or a screwdriver handle — tapped against the body causes the locking dogs inside to vibrate free of the shackle. In a viral demonstration that has been viewed millions of times, locksport expert Bosnian Bill opened a brand-new No. 3 in seconds using nothing but a light impact on the lock body. His commentary at the end: "How easy is that? What a wonderful piece of American lock engineering." He then advised viewers to "stay away from Master Lock." Master Lock responded by threatening to sue him. The lock remains for sale.
Beyond the hammer bypass, the No. 3 features a 4-pin cylinder with no security pins — meaning it rakes open trivially for anyone with even a basic pick set. The shims made from a cut-up soda can work too. And if you don't feel like any of that, the shackle is 7mm diameter hardened steel — which sounds impressive until you put it next to a $20 pair of bolt cutters.
"Master Lock No. 3s have long been known by the locksport community to be easy to rake open, shim, or attack in a number of ways."
— Adrian Crenshaw, Security Researcher- Percussion bypass — hammer or handle tap, shackle pops in seconds
- 4-pin cylinder with no security pins — rakes open for beginners
- Shimming vulnerable — soda-can shim defeats the locking dogs
- Bolt-cutter vulnerable — 7mm shackle offers minimal cut resistance
Let's be precise here because Kwikset makes a range of products and not all of them are disasters. Their traditional pin-tumbler cylinders are mediocre but functional. It's the SmartKey system — the one with the tiny rectangular hole next to the keyway that lets you "rekey in seconds" — that is the subject of this entry. And the SmartKey is in an enormous number of American homes.
The SmartKey was created to address key bumping, which was getting bad press coverage in the mid-2000s. Kwikset solved the bumping problem. What they created in its place was arguably worse. The SmartKey uses aluminum wafers instead of brass pins. Aluminum is softer and breaks more easily. The rekeying mechanism — the thing that makes it "smart" — requires a sliding sidebar design that introduces a different class of vulnerabilities entirely. Security researchers presented findings at DEF CON showing the lock could be "opened, bypassed, or decoded in seconds" through design flaws that exist specifically because of how the rekeying mechanism works.
The "forcing" attack is the most concerning: a thief inserts a key blank, uses a screwdriver to force it deeper, then hammers and turns — the sidebar mechanism fails catastrophically and the door opens. No picks required. No special tools. A key blank, a screwdriver, and a hammer. The attacker leaves no external signs of entry. You come home and your door is locked. You use your key. You go inside. You might not realize someone was already there.
- Forcing attack — key blank + screwdriver + hammer, door opens silently
- Aluminum wafers — softer than brass, more prone to breakage and manipulation
- Sidebar bypass — design flaw in rekeying mechanism enables covert entry
- No external evidence — lock still works with original key after forced entry
Defiant is one of the most interesting cases in the lock industry because almost nothing about it is what it appears to be. There's no real Defiant company — it's a Home Depot house brand, manufactured by a Taiwanese company called Taiwan Fu Hsing, and it has no website of its own. You won't find a Wikipedia page. You'll find almost no independent information about it at all. What you will find is that it's one of the three lock brands carried by Home Depot, which makes it one of the best-selling deadbolts in America. Millions of homes have one on their front door right now.
The cylinder is a direct clone of a standard Kwikset pin-tumbler — same keyway, same tolerances, same lack of security pins. That last point matters: a security pin is a specially shaped pin that makes picking significantly harder by creating a false set. The Defiant has some spool pins, which is better than nothing, but the overall construction is so light and the tolerances so sloppy that a locksmith's tests found it could be compromised by raking, pick gun, or forced entry in under two minutes.
Here's the part that genuinely bothers us. The packaging says "LIFETIME WARRANTY." In large letters. That sounds like confidence. When you read the actual warranty, you discover that it explicitly disclaims any warranty of "merchantability and fitness for a particular purpose." In plain language: it might not work for the purpose of being a lock. That sentence is in the warranty for a product sold as a security device. The security industry has been laughing at Defiant for years — but millions of homeowners aren't in on the joke.
- Kwikset clone cylinder — same weak tolerances, same picking vulnerabilities
- Compromised in under 2 minutes by experienced tester using standard tools
- Warranty explicitly disclaims "fitness for purpose" of being a lock
- No independent security information — no website, no third-party testing visible
SentrySafe is, by their own description, the world's leading safe manufacturer. Their fire safes are sold everywhere and trusted by millions of people to protect firearms, documents, cash, and irreplaceable items. The SFW123FTC model specifically is designed to resist fire and withstand burglary attempts. It has a keypad. It has a deadbolt mechanism. It has a weight and heft that signals security.
A master locksmith named Terry Whin-Yates opened one in under five seconds using a rare-earth magnet. The video of him doing it went on to accumulate over 8 million views. The flaw is in the solenoid — the electromagnetic component that locks and unlocks the safe when the correct code is entered. SentrySafe's engineers designed the solenoid to resist vibration attacks, which was smart. They forgot about magnetic attacks, which was not. A neodymium magnet placed against the door activates the solenoid from outside, retracts the bolt, and the door swings open. No code. No tools beyond the magnet. Under five seconds.
It gets worse. A separate researcher later discovered that the communication between the external keypad and the internal locking board uses an unencrypted serial connection. He built a device — housed inside a pen — that sends a reset signal followed by an unlock command. Every SentrySafe and Master Lock electronic safe using the same architecture opens instantly. The company was notified. They did not respond. The safes continued to be sold.
"We did it silently, instantly, and without any evidence of entry."
— Marc Tobias, Security Researcher, on the SentrySafe magnet bypass- Magnet bypass — neodymium magnet activates solenoid through door in under 5 seconds
- Serial protocol exploit — unencrypted keypad communication allows code injection
- Pen-sized bypass device — researcher built tool that opens every affected model instantly
- No external evidence — door relocks normally, safe shows no sign of entry
- Company notified — did not respond, product continued to be sold
The appeal of a combination padlock is obvious. No keys to lose. Easy to use. The Master Lock 175 takes this a step further with four independent wheels instead of a traditional dial — you set your own code and open it by aligning the wheels to your number. It's sold as a step up from basic combination locks, marketed toward luggage, lockers, and gates. It has a satisfying heft. The shackle looks solid.
A standard hook lock pick — the kind that comes in every beginner's set and costs about four dollars — inserted alongside the wheel stack and manipulated while depressing the shackle opens this lock without ever knowing the combination. The technique requires no skill beyond understanding which direction to push. No special tool. No training. Under thirty seconds for someone who has seen it done once. The wheels spin freely, the pick finds the gate in each disc, and the shackle releases. The lock shows no sign of having been opened.
This is not a theoretical vulnerability. It is a documented, widely-demonstrated bypass that has been shown on video hundreds of times. Yet the lock continues to be sold as a security product. There is no warning on the packaging. The listing doesn't mention it. Thousands of people are using these on gym lockers, sheds, and gates right now.
- Hook pick bypass — insert, manipulate, shackle releases without knowing the code
- No skill required — anyone who has watched a demonstration can do it in 30 seconds
- No evidence of entry — lock resets, no marks, no trace
- Widely documented — hundreds of public videos demonstrating the exact bypass method
We're including this as a category rather than a single product because the specific brand name doesn't really matter. Walmart sells dozens of them. Amazon has hundreds of listings. They all have the same fundamental problem: a steel cable with a PVC coating and a combination or key mechanism at one end. They look like bike locks. They are marketed as bike locks. People buy them to lock their bikes.
A pair of wire cutters from the same store — cost: under $10 — cuts through the average cable lock in under three seconds. Not the heavy cable. The cable. The thing you think is protecting your bike. Cable of this diameter is not a security material. It is sold as one. Professional bike thieves carry small folding cable cutters in their pockets specifically because so many cyclists rely on these locks. In cities with high bike theft rates, security consultants have documented cases of bikes being stolen from cable locks in broad daylight — by someone who walked up, crouched, cut, and walked away in the time it takes to pay a parking meter.
The particular cruelty here is that a $40 U-lock from a reputable brand is categorically more secure than any $15 cable lock regardless of how heavy the cable looks. The coiled plastic is hiding a surprisingly thin core. Pick them up before you buy. If the total weight is under a pound, it's not a real lock.
- Wire cutters defeat any sub-15mm cable in under 3 seconds — $10 at the same store
- PVC coating conceals the actual thin cable core inside
- Weight test: under 1 lb = not a real lock, regardless of how it looks
- Combination mechanism also bypassed by shimming or decoding in seconds
The red Master Lock combination padlock is so deeply embedded in American culture that it almost functions as an icon. You had one in high school. Your kids have one now. People keep them on storage units, gym bags, sheds, and outdoor gates. They are sold in multi-packs. They are the default choice. They are recommended without question.
A standard 40-digit Master Lock combination has 64,000 possible combinations — which sounds secure until you learn that a mathematical technique exists to narrow those 64,000 possibilities down to roughly 80 by exploiting manufacturing tolerances in the lock's disc mechanism. A person who understands the technique can find the combination in a few minutes with no tools at all beyond their hands. Instructions for this process are freely available and have been for years. Additionally, these locks can be shimmed open with a piece of aluminum cut from a soda can — insert one shim on each side of the shackle, apply upward pressure, and the lock opens without the combination in seconds.
What makes this entry specifically unsettling is the scale. The No. 1 is given to locksport beginners as a "confidence lock" — a lock so easy to open that it builds a new picker's confidence and inspires them to continue. The community uses it as a training tool. Meanwhile, millions of people use the same lock on their gym lockers, storage units, and backyard sheds, trusting it to keep their things safe. The security industry's practice dummy is being used as real security by the general public. That gap in perception is exactly what makes this list possible.
- 64,000 combinations reduced to ~80 using manufacturing tolerance exploit — no tools
- Shimming attack — soda can aluminum, 2 shims, seconds to open without the code
- Used as "confidence lock" by locksport community — beginner's first opening
- Hammer bypass on the No. 3 variant — same family of vulnerabilities
So What Do You Actually Do?
The honest answer is: it depends on what you're protecting and from whom. If you're securing a gym locker against casual theft, a decent ABUS combination lock does the job. If you're securing a front door in a neighborhood that has experienced break-ins, you need an ANSI Grade 1 deadbolt from Schlage or better. If you're storing firearms, you need a UL-listed safe — not a big-box fire safe — with a relocking mechanism and a mechanical backup key that isn't exploited by a $20 magnet.
The locks on this list are not all equally bad. A No. 3 on a garden shed is very different from a Kwikset SmartKey on your front door. Context matters. But in every case, the lock is providing less security than the person using it believes — and that gap is the problem. You can only make good decisions with accurate information.
We'll keep testing. We'll keep telling you what we find. Even when the answer is uncomfortable. Especially then.