Bump Keys
What Is a Bump Key
Plain Language Definition
A bump key is a key blank cut to the maximum depth at every position along the blade — a profile sometimes called a 9-9-9-9 cut or a 999 key, referencing the deepest cut value on a standard key-cutting scale. Because every cut is at maximum depth, the key can be inserted into any lock that accepts that keyway, regardless of what combination the lock is actually set to. The operative word in “bump key” is the second one: the key must be struck, or bumped, to function.
The physical principle behind key bumping is called the Newton’s cradle effect within the pin stack. A standard pin-tumbler cylinder contains a series of spring-loaded pin pairs — a bottom key pin sitting in the plug and a top driver pin sitting above it, separated at rest by the shear line when the correct key is inserted. When a bump key is partially withdrawn one or two tooth-widths and then simultaneously pushed inward and struck on its bow with a mallet, screwdriver handle, or purpose-built bump hammer, kinetic energy transfers from the key blade to the key pins. The key pins jump upward, transferring momentum to the driver pins. For a fraction of a second — typically two to five milliseconds — all driver pins clear the shear line simultaneously. If rotational pressure (called tension or torque) is applied to the plug at precisely that moment, the cylinder rotates and the lock opens.
The technique requires no lock picks, no decoder tools, and no knowledge of the specific combination. A bump key for a Kwikset lock products KW1 keyway, for example, will work on any pin-tumbler lock that accepts the KW1 profile, covering the majority of residential entry hardware sold under that brand in the United States. Bump keys are inexpensive to produce, easy to carry, and leave little or no forensic evidence on a lock face, which makes them a concern for both property security and post-incident investigation.
Key bumping is distinct from lock picking, which involves manipulating individual pins to the shear line one at a time using a pick and tension wrench. Bumping is faster and requires less skill, though it is also noisier and somewhat less reliable against high-quality cylinders. Both techniques fall under the broader category of non-destructive entry, meaning a successful bump attack leaves the lock intact and operational, often with no visible sign of tampering.
Where It Is Used
Bump keys appear in several distinct contexts, some legitimate and some not.
Security research and professional testing. Locksmiths, security consultants, and penetration testers use bump keys as part of formal vulnerability assessments. A bump key test on a property’s existing hardware provides immediate, empirical evidence of whether the installed locks can be defeated quickly without forced entry. This information directly informs decisions about lock replacement, cylinder upgrades, or supplemental security measures. Professional bump key assessment is a recognized and legal activity when conducted with the property owner’s authorization.
Locksport and competitive lock sport. The locksport community — hobbyists who study lock mechanisms as a technical discipline — uses bump keys alongside picks, decoders, and other tools to understand how cylinders function. Participation in locksport is legal in most jurisdictions when practiced on locks the participant owns or has explicit permission to open.
Unauthorized entry. Law enforcement agencies in the United States and Canada have documented bump key use in residential burglaries and commercial break-ins. Because bumping leaves no visible damage to the lock face or door frame, victims and investigators sometimes misclassify the entry as an unlocked door or a key-related breach. Bump key attacks are most effective against standard residential pin-tumbler locks and least effective against high-security cylinders with anti-bump features, sidebar mechanisms, or security pins.
Legal status. The legality of possessing bump keys varies by jurisdiction. Several US states classify bump keys as burglary tools under possession statutes, meaning mere possession with intent to use unlawfully can constitute a criminal offense. In Canada, possession of instruments suitable for breaking and entering with intent is prohibited under the Criminal Code. Property owners, security professionals, and locksmiths working in this area should be familiar with the laws in their specific state or province. Low Rate Locksmith technicians operate under professional licensing requirements and carry tools including bump keys only in the context of authorized work.
Security and Service Considerations
Common Problems
The most significant problem associated with bump keys is silent, invisible vulnerability. A standard residential pin-tumbler lock — even a brand-new one installed correctly — is susceptible to bump key attacks unless the cylinder includes specific anti-bump engineering. The property owner has no way to tell by looking at the lock whether it can be bumped. This creates a gap between perceived security and actual security that is common in both residential and small commercial settings.
Misdiagnosis after a bump key entry. Because bumping leaves no scratches on the keyway face and no damage to the door or frame, it is frequently misidentified. Property owners or investigators may conclude the door was left unlocked, that a key was lost or copied, or that the lock malfunctioned. A forensic locksmith examination can sometimes identify microscopic evidence of bumping — minor tool marks, slight deformation of pin chambers — but the absence of visible damage is itself a clue worth noting when other explanations do not hold.
Overreliance on deadbolts. Many people assume that a deadbolt provides substantially more security than a knob or lever lock. For bump key vulnerability, the distinction is less relevant than the cylinder type. A standard single-cylinder deadbolt using a common residential keyway and a basic pin-tumbler cylinder is just as susceptible to bump key attacks as a knob lock using the same cylinder. The deadbolt throw length protects against kick-in attacks; it does not protect against non-destructive entry through the cylinder.
Secondary locks and bump vulnerability. Lever-style entry handles, padlocks, cabinet locks, and many secondary door locks also use pin-tumbler cylinders and are susceptible to key bumping if they accept common keyways. Storage units, detached garages, and outbuildings are frequently overlooked during security assessments because they appear less valuable than a primary entry-door lock, yet they often contain tools, equipment, or interior access points that make them attractive targets.
Lack of awareness among property managers. Multi-unit residential properties and small commercial spaces often have standardized hardware purchased in bulk, meaning every unit in a building may share the same keyway and the same basic cylinder. A single bump key matched to that keyway provides potential access to every unit. This is a systemic risk that property managers may not consider when evaluating their maintenance budgets and security protocols.
Bump key availability. Bump keys for common residential keyways — KW1, SC1, and others — are available online for a few dollars and can be ordered without restriction in most jurisdictions. This low barrier to acquisition means the technique is accessible to a wide range of actors, not only experienced criminals. Security planning that assumes bump key attacks require specialized knowledge is outdated.
Related Locksmith Work
Several categories of professional locksmith work address bump key vulnerability directly or as part of broader security improvements.
Security pin installation. A locksmith can rekey an existing cylinder to include security pins — spool pins, serrated pins, or mushroom pins — that significantly resist bump key attacks. These pins create false sets that interrupt the brief alignment of driver pins at the shear line during a bump attempt, requiring much more precise manipulation to open. Security pin installation is cost-effective relative to full cylinder replacement and can be done on most standard residential hardware already installed in a door.
High-security cylinder replacement. Cylinders certified to standards such as ANSI/BHMA Grade 1, UL 437, or ABUS lock products SP series include anti-bump features engineered into the pin design, along with pick resistance, drill resistance, and in some cases key control. Replacing a standard cylinder with a high-security alternative is one of the most direct ways to eliminate bump key vulnerability. A locksmith assesses the existing hardware, recommends compatible cylinders, and performs the replacement without requiring a full door hardware change in most cases.
Bump key vulnerability assessment. A formal bump key assessment involves a locksmith testing the current hardware with appropriate bump keys to verify whether the cylinders are susceptible, then documenting the findings and recommending a prioritized remediation plan. This service is particularly valuable for property managers, small business owners, and homeowners who have recently purchased a property and want to understand the current state of their hardware before investing in upgrades.
Rekeying after suspected bump key entry. If a property owner suspects unauthorized entry occurred without visible forced entry, the appropriate response is to contact law enforcement for an incident report and then call a locksmith for an assessment and rekey or cylinder replacement. Rekeying alone does not eliminate bump key vulnerability — the new combination is still susceptible unless security pins are installed or the cylinder is upgraded — but it does address key-copy concerns that may exist alongside a bump key risk.
Smart lock and keypad conversion. Electronic access systems — keypad deadbolts, smart locks using Bluetooth or Z-Wave, and keyless entry systems — eliminate the bump key attack surface entirely for the entry points they cover, because there is no pin-tumbler cylinder for a bump key to exploit. A locksmith can assess whether existing door preparation is compatible with electronic hardware and perform the installation and programming. These systems introduce a different set of security considerations, including power dependency and network exposure, but they do remove bump key vulnerability as a factor.
Padlock and auxiliary lock upgrades. Storage areas, gates, and outbuildings often use padlocks that are highly susceptible to bump key attacks because they use simple cylinders in accessible form factors. A locksmith can recommend and install padlocks with anti-bump disc detainer mechanisms or high-security pin cylinders that significantly raise the difficulty of a bump key attack on these secondary access points.
When to Call a Locksmith
Call a locksmith if you have noticed signs of entry that do not include visible forced damage — a door that was locked but found open, missing items without broken windows or damaged frames, or a primary entry-door lock that feels different when you use your key. These situations warrant a professional assessment to determine whether bump key technique or another non-destructive entry method may have been used. Also call if you are a property manager or business owner who has never conducted a formal cylinder security review, if you have recently purchased or leased a property and want to verify the hardware is not vulnerable, or if you want to upgrade specific locks known to be susceptible before an incident occurs. Low Rate Locksmith provides 24/7 mobile locksmith work across the United States and Canada. Technicians arrive equipped to assess, rekey, and upgrade cylinders in a single visit. Call (833) 439-8636 any time to speak with a technician or schedule an assessment.
You may also find useful: Lockout Techniques, What Homeowners Should Know About UL 437 vs Standard Cylinder.