Many people use the key lock boxes manufactured by the Supra lock box company. This is a metal box, usually fixed to the wall by the front door, with 10 buttons on the front which you press to enter the secret combination.
Isn’t this an odd article for Bug Advisor?
This article began when we arived at our rental villa in Florida and realised that we’d forgotten the lock box code. I sat in the rental car, running the air con, wondering how many possible combinations would it take for me to open the box. After a long flight, my girlfriend just wanted me to call the management company and ask for the code – writing down a sequence of possible numbers didn’t make me very popular. So no bugs but travel was involved.
History
Oregon real estate agent, Delbert Williams, was annoyed by the amount of time it took to chase down keys of listed properties in the busy post-war real estate market of the early 1950s. His frustration compelled him to invent a secure key holder which combined a sand-casted metal container and a Yale bicycle lock.
The success of this product (which became the predecessor of the current day portable key box and eventually led to the development of the pushbutton lock) resulted in his forming Supra Products in 1955. Supra continued as a family managed company until 2002, when it was acquired by GE Security, a division of the General Electric Company.
Current Usage
Nowadays, the usage has extended to homeowners who want to keep a spare key somewhere different than under a doormat or flowerpot and holiday villa rentals.
Video
There is a video on how to open and close a lockbox on YouTube – not sure why a video was needed but if you’ve never seen one in action then now is your chance!
Setting the Combination
The inside of the lock box lid has a cover which, when opened, exposes 10 screws corresponding to the numbered buttons on the keypad. The screws have arrows on them. A combination is set (or reset) by changing the direction of the arrows for numbers in the combination.
How secure are these boxes?
Well you probably think that the four-digit combination can be any number from 0000 to 9999. If it really was 9999 combinations that would be pretty good, as anyone attempting to gain entry to the lockbox, then the property, would have to spend quite a while pressing buttons and pulling on the metal cover – the whole mechanism is quite clunky and even when you know the combination the cover doesn’t always come off.
Sadly the combination can’t be 0000 as the setting inside the lock box lid only allows for one number between 0 and 9 to form part of the combination. So the first possible number is 0123. I guess you’re thinking, well that’s still a lot of numbers to try, even though you can skip 0131 as it has two 1s in it.
Unfortunately there is another design flaw in these boxes: The setting inside the lock box lid doesn’t allow you to choose the order in which the numbers should be entered. That means that if you tried 0123 then there is no need to try 1230, 2301, 3210 etc.
I sat and worked out the possible combinations for a lock box and there are only 161. I won’t publish the list here as it might fall into the wrong hands.
9th August update – I now have a formula to work out combinations and wrote about this in a newer post here.
So what should you do?
I’d recommend changing your lockbox to something more secure. I haven’t researched better options, but if there was something with six rows of rotating combination wheels, where each number could be anything, then I’d buy that. At least then you really would have a range of 000000 to 999999.
And what will I do?
I’m going to write to the lock box company and tell them my findings. My guess is that they already know, but keep selling the boxes anyway.
BugAdvisor.com 
How secure are these boxes?
I counted 210 combinations – not that it makes a big difference in the scheme of things.
I still think it is 161. But even at 210 that wouldn’t take too long to open.
It is not 161. It is 210. It is (10 x 9 x 8 x 7) / (1 x 2 x 3 x 4). But actually there are more as you don’t have to use a 4-digit combination. You can use any number. So there are actually 1,023 combinations; although I doubt too many people would use a 1, 2, 7, 8, 9 or 10-digit combination. But that would still leave 792 useful combinations.
It is not 161. It is 210. It is (10 x 9 x 8 x 7) / (1 x 2 x 3 x 4). But actually there are more as you don’t have to use a 4-digit combination. You can use any number. So there are actually 1,023 combinations; although I doubt too many people would use a 1, 2, 7, 8, 9 or 10-digit combination. But that would still leaves 792 useful combinations.
You have no idea what your talking about, a 4 digit code that uses numbers from 0-9 would have 9,999 different combinations.
You obviously didn’t read the article properly- only one number can be set as part of the combination – so no 0000 nor 9999
The math is only a concern if you don’t wish to damage the lock box. Several months ago, I drove an hour to show one of our warehouses to a potential tenant. When I arrived, about 5 minutes early, I realized that I did not have the lock box combination and was going to be unable to get the potential tenant through the 70,000 square foot space. What a complete loser…
I got a portable drill out of my SUV, loaded a 3/8 drill bit and proceeded to drill downward (just above the Supra’s top center button) between the lift out face and the lock box itself. In about 20 seconds the lift out face with the 10 numerals on it was breached and fell out in my hand. I took out the door key and unlocked the warehouse.
Frankly, I was shocked at how easy the lock box was to get open…unfortunately both the lock box and the cover plate were destroyed in the process. They will only keep the “honest” people out. I currently have several of the Supra boxes in our offices but we do not remember the combinations. We simply use them as paper weights…
I think there are 79 combinations. This is because 1 + 2 + 3 + 4 is the same as 1 + 3 + 4 + 2, etc. No matter the order of the numbers!
Your right, the numbers are overlaping. See the colums 🙂
0123 1023 2013 2301 3102
0132 1032 2031 2310 3120
0312 1203 2103 3012 3201
0321 1230 2130 3021 3210
One number elemitates twenty
See the latest article here https://bugadvisor.com/2019/08/24/its-easy-to-hack-a-key-lock-box-theyre-not-as-secure-as-you-might-think/
Hello!… I too have one of those GE Bo codexes with a forgotten code… Could you please help me?
THANK YOU!
Wilson – well to help you I’d have to send you the list of 161 possible combinations. But as I said in my post, I don’t really want to do that.
wilson… I can not find my combination… can you send me your list of 161 possibilities and I’ll try it! hdcourtney@gmail.com
Please send me a picture of you lockbox paul@feagan.com
CAN YOU SEND ME THE CHOICES OF SUPRA KEYBOX COMBINATIONS, PLEASE?
Please send me a picture of your lockbox with the door already open.
Hello bugadvisor, I have a supra box at my front door been locked probably for years.
I recently started renting this place and it is anoying having that box there I cannot open and use it. I do not like to try cutting off the box because I might damage the door. Could you please send to mee the list of combinations or give me a clue how to work out myself? I will appreciate very much. Thanks. Pete
Hi Peter, much as I would like to send you the list of possible combinations, I can’t do that as the information could fall into the wrong hands.
As this is your own front door and you already have the keys, it shouldn’t take long for you to enter as many combinations as you need to gain access to the box.
Just remove the door’s lockset. Then look to see if the handle/knob can be removed. If not, buy another lockset and re-key it.
are you guys retarded? There are NOT 161 combinations, there are 9,999 combinations.
No 0000 nor 9999 as only one number can be set
I still haven’t been able to find a complete list of actual numbers to try
Howard Courtney
On Wed, Mar 15, 2017 at 2:21 PM, bugadvisor.com wrote:
> bugadvisor commented: “No 0000 nor 9999 as only one number can be set” >
I can send you a list – just email me a picture of your lock box by an open door
I use 5 numbers when I set my combination so I’m thinking mine is more secure. How many possible combinations is it for 5 numbers?
Michelle
I’ll try and work out the combinations and let you know. But my instinct at the moment is that 5 numbers might even be less secure than 4. For example, if you chose any 10 number combination, the only number you would need to open the box would be 0 1 2 3 4 5 6 7 8 9 0.
For a 5 number combination, the first valid number is 0 1 2 3 4 5
For 5-digits there are 252 combinations. (10 x 9 x 8 x 7 x 6) / (1 x 2 x 3 x 4 x 5)
Michelle – well I had a quick count and I think only 122 combinations so less secure than 4 numbers (161 combinations). But I’ll need to check properly at the weekend in case I missed any combinations. The only good news is that the boxes are more secure if people don’t know how many numbers they need to enter. So if I’m trying to get into a box, I’d need to enter 161 combinations of 4 digits, then 122 combinations of 5 digits plus other combinations of other digits that I haven’t worked out yet!
why you need to count? there is a simple formula which gives you the exact number of combinations
Pete
I’m counting because I don’t know the simple formula and didn’t try and create one!
Feel free to share the formula as long as it only provides the possible combinations for 4, 5 etc entries, rather than a list of entries.
You can also email me on paul@bugadvisor.com
Paul
…I’d need to enter 161 combinations of 4 digits, then 122 combinations of 5 digit…
Unnecessary. Another design flaw is that the button to open the box doesn’t also clear it. Assuming most people will choose combinations of 3-5 digits, you can try three combinations in one sequence without having to start over – reducing the overall effort required to cycle through all combinations.
e.g. If the combo was 1-2-3-4-5, you could enter 1-2-3, try to open it, then press 4, try to open it, and then press 5 and it would still open the lock. That’s three combinations with only having to press 5 buttons, instead of 3+4+5=12 buttons if the open latch also cleared it.
If didn’t already know you can choose how many different numbers you want, between a 3 number combo and a 7 number combo. I would imagine this would leave you with several thousand different combos to try out before you found the right one
The number of combinations is 1024
that’s because each button can be either pressed or not, order doesn’t matter,
that’s 2 possibilities for each button
2*2*2*2…*2
=2^10
=1024
of course some of those (no buttons pressed, 1 button pressed etc) are not good combinations to use but it’s still about 1000 combinations
In the end none of that matters. These locks are vulnerable to manipulation exactly like the cheap combination luggage locks. If you know what you’re doing you can open them in a minute easy.
The three letter dial type locks are a lot more secure, I recommend those (They’re harder to manipulate)
Sorry, but 1024 is way out of line. The true number of combinations (order agnostic) is 210 for 4 and 6 digits, and 262 for 5 digits. How do I know this? The combination formula is (n!)/((n-r)! * (r!)) where n is the number of buttons you have (10) and r is the number of buttons needed to press. There’s also no point to hiding the list because many math websites that has the combination formula will also spit out a complete list of all combinations.
Thanks Aneirin that’s exactly the formula I was looking for. I’m still not sure how I only got to 161 when working out the list longhand, but the proof of the formula is easy when r= 1, i.e only one number to choose from:
10! = 3,628,800
(10 – 1)! = 362,880
(1!) = 1
so (10 – 1)! x (1!) = 362,880
and 3,628,800 / 362,880 = 10 key presses
I’m going to re-blog this with some explanations and figures based on your formula.
Say if I don’t know the value of r, is the total number of combinations 10 + 45 + 120 + 210 + 252 + 210 + 120 + 45 + 10?
No it is 10 + 45 + 120 + 210 + 252 + 210 + 120 + 45 + 10 + 1. The last 1 is for a 10-digit combination.
Reblogged this on and commented:
I’m re-blogging with new math
By the way, I just found time to try to unlock the Supra lock box on my front door.
I did unlock it in 4 minutes picking the numbers from the list I posted above. 🙂
And definitely there 210 Combinations only and the order of pressing the push-buttons are not important.
The formula is C= 10! / 4!(10-4)!
Cheers
Peter
Thanks Pete, the list you sent certainly looks correct and your formula matches the one I have in my update to this post https://bugadvisor.com/2013/08/09/key-lock-box-security-not-as-secure-as-you-might-think-update. I won’t publish the list of numbers in your previous comment as I don’t want to encourage people to break into houses using this knowledge.
I understand your reasoning for not having the list used for the wrong reason, but it is so easy to produce with a simple bit of programming, that it would probably help more people than it would hurt. Just my opinion… I would assume that most of the people asking are the owner of the lock. The list I have includes 210 4-digit combinations, but if all of the 1- and 2- and 3-digit combinations are included, it jumps to 385 unique possibilities. If you are trying to open your own lock, I suggest eliminating your own and your family’s birth-year or anniversary first, just in case it may save time 🙂
BTW, I have basic math skills and Excel. It took me less than 30 minutes to come up with all codes using Excel. I start with 1024 rows and 10 columns. For the first column, 512 rows have 1, the rest zero. For the second column, 128 rows have 1, 128 rows have zero. I copy these 256 rows to the bottom. For the third column, 64 rows have 1 and 64 rows with zero and I copy the 128 rows to the bottom. For the forth column, 32 rows have 1 and 32 rows have zero. I copy all 64 rows to the bottom. I do the same reduction in pattern for each column and by column 10 one row has 1 the other row has zero and I copy these two rows to the bottom. Copying the rows is simple as Excel repeats the pattern all the way down so it only takes a few seconds to do for each column. In column 11, I sum the first 10 columns to get the total digits. I insert a row at the top and label the first 10 columns 1, 2, 3, 4, 5, 6, 7, 8, 9, and 0. In columns 13-22 I start at row 2 and insert a formula. For cell N2 its =IF(B2=1,B$1,””), I copy this formula from cell N2 to W1025. For cell M2 the formula is =CONCATENATE(N2,O2,P2,Q2,R2,S2,T2,U2,V2,W2) and I copy this down to row 1025. That is all there is to it and I now have all the combinations. It is so easy to do and requires only the most basic math and intermediate Excel skills.
Yes it’s certainly possible and I already have the list of combinations. But I’m hoping someone with math and Excel skills wouldn’t use the numbers for nefarious purposes. I haven’t published the list in case it is misused – although I did put a poll on the ‘best of 2013’ page asking for votes on whether the numbers should be published.
One comment, I started with column B, not column A. I copy / paste special valued columns L and M to a new sheet. I then sorted that new sheet by column A and then by column B. The basic math skill was to come up with a manual binary algorithm to come up with 1024 unique numbers as the total combinations was 2 to the power of 10.
I gave you the complete list to document the above method works. As for publishing the list, I think it will mainly be used by people who forgot their code as I have trouble with the idea that someone would spend the time punching in all those codes if the box is in an open area visible to others. I would absolutely not, under any circumstance, place that box where it is not in view of others at all times like the front of a house in a development because there are so few combinations and the list is so easy to produce.
As a side note, one of the links on your site, fun with numbers, already lists all 3, 4, and 5 digit combinations.
Thanks.
Yes I know the numbers are already in the public domain.
Also goofed explanation, its 512, 256, 128, 64, 32, ….. Not 512, 128, 64 for coping 1’s.
I had the opportunity to read up on all the posts including the updated posts. The formula in the updated post is correct and is consistent with the 1024 combinations I uploaded yesterday. The formula on the link shows the following which is 10+45+120+210+252+210+120+45+10 which = 1,022 combinations. In addition, you can select no number or all numbers which brings the total to 1,024.
One of the reasons this interested me is because my exterminator company keeps my gate key in this box. As its only a gate key, I am not too concerned. However, I started thinking how great it would be to keep a separate box for a spare house key.
I’ve used this box at various rentals I’ve stayed at and everyone appears to use 4 digit codes. With 210 combinations, there is a 50% chance of unlocking it after trying only 105 of them. Theoretically, 5 digits is the most secure in terms of combinations, but only by a small amount.
I don’t think most people would try to hack 6 digit numbers. Unless one has a list with them, 7 digits would be just too difficult but there are only 120 of those combinations. I think 6 is best if you use this box. The extra two digits would also slow down anyone trying to hack the box with a list of numbers.
I spent a few hours researching this problem today and found the box I will use. It is the Kiddie KeySafe P500. Amazon sells it although it is quite a bit more expensive. In addition to 1, 2, 3, 4, 5, 6, 7, 8, 9, and 0 it also has A and B. Those two extra buttons make a huge difference. The total combinations on this are 4,096 or 2 to the power of 12. The numbers in the mid range have nearly 1,000 combinations so you definitely do not want to forget it or your will be spending hours keying in all the combinations from a master list trying to open it. Way more secure.
As a side note, Kiddie is very upfront on the available combinations which I appreciate. On the 10 digit boxes for sale on Amazon, it clearly states over 1,000 combinations are available. On the 12 digit box, it clearly states 4,096 possible combinations.
It may be easy to crack the combination, but to a crackhead or the ordinary criminal, it looks like fort Knox. They do not waste time carefully not damaging your property. If they want in, they come in, they throw a brick through a window or sliding glass door, and they are in. They come in, day or night, and increasingly, when you are home. They are desperate. This is a cost of the top 1% possessing 40% of the wealth.
I agree that many would just smash their way in. I don’t agree that they have an excuse just because they need money. Have a read of this explanation of the tax system explained in beer: http://danieljmitchell.wordpress.com/2012/03/18/the-tax-system-explained-in-beer/
especially when they can’t figure out what it is
I believe Richard is right. 1024 combinations.
Why?
Because as he says, the setting is a 10 digit binary number (each button can be on or off). 2^10 = 1024.
0000000000,
0000000001,
0000000010,
0000000011,
0000000100,
0000000101,
0000000110,
0000000111,
0000001000,
etc .
(Assuming a code can be any length from 0 to 10 digits).
Order makes no difference. For example 0000000111, it makes no difference what order you press those last 3 digits, 0000000111 is still different from 0000000101.
To be honest you all wrong it doesnt matter what order you type the numbers.
That is what the article already says
Thanks for this
I’ve been looking at these & the more questions I ask the sellers, the more they try to dodge the question as to how many combinations there actually are. I knew I could work it out if I put my mind to it but what’s the point if someone else already has. 🙂
I was trying to work out if the rotary locks had more combinations, despite the fact most people know the old rotary 4 digit bike locks are really not that secure so to find out these 10 digit push button locks are almost 10 times easier to break into, is a major shock but with all of the avoidance I’ve been getting on the question, I’m really not that surprised.
I guess more searching is needed to find a more secure key lock.
Thanks for doing the math.
I wouldnt use supra lock boxes. We moved into our duplex earlier this year and it had a supra box on the front door. The owner didnt not know the combination to it and said to just leave it be, its safe there. Well 8 months later i was tired of looking at it and know theres a key to the door hanging there. Literally 10 minutes is what it took to break open the box and get the key out. Good job supra.
Can you send me the list? I know my code is only 4 digits but I forgot it. What proof do you need that I’m legit and not trying to hack into something that isn’t mine? Thanks!
Please send me an email at paul@feagan.com with some more details – the best proof is an open door with the lock box next to it – in a photo
No problem, just sent it to you! Thanks!
I open them in 15 seconds with large Channel Lock pliers. It takes longer to find my pliers than opening the box. As long as the box is mild steel, this works well. If it were something like cast iron or stainless, this would be difficult. The harder ones would need a saw or grinder. With battery powered tools so common, nothing is safe for long unless the components are made stronger than the ones I have seen.
I used this when I locked myself out yesterday, only took 20 minutes by brute forcing all the combinations, thanks!! Saved me breaking a window or something =)
The instructions to this lock says “use five to seven numbers in your combination”
I need to use some kind of lockbox on my doorknob occasionally. Given the flaws, what is the ‘best’ one on the market? Is there any decent reasonably priced one on Amazon?
My Dear Late Father passed on a great deal of wisdom to me; some of which I retained.
One comment was:
“Locks are to keep honest people honest”
Sounded weird at the time; but even the most
Sophisticated forms of security are continually
being challenged by dishonest, twisted, sick
Vermin who choose to violate, hurt and steal
from others who oppose this form of behavior;
and who have been taught, or learn the meaning of integrity.
“Lock On”
I have an aluminium supra-c lock box. But there is no dail or push buttons; only a round key opens this realitor box .on bottom of box thereis a tiny hole I can insert a rod and feel the lock. How can I open this lock?
I was hoping someone would be able to help – but nobody replied. I only know about the keypad boxes. Sorry.
Great article, and thanks for the valuable information. I respect that you don’t want to publish the list, but in case someone like me stumbles on to this and need the list, here’s a Perl code to find the list of numbers:
https://pastebin.com/X0EZYM85
It’s for 4 digits, if you need for others, just tune the number in the for loop and the sprintf.
So, as mentioned, there are 1024 possible combinations for the lock. For the case where the combination is known to be four digits (as typically used by realtors), that reduces to 126 combinations.
This article is nice. I purchased a condo with a lockbox already attached. Was thinking I’d need to drill it off. But now with just a few minutes, I can run through all the combos to open it as it’s likely just a 4 digit combo.
Ug, I made a mistake, the correct answer is 210 for a combo of length 4.
What are the possible codes?
I haven’t published them on BugAdvisor as I was worried they’d fall into unscrupulous hands. For those who have a lockbox and have forgotten the code, I usually ask them to send me a picture of the box alongside an open door.
0123, 0124, 0125, 0126, (remaining sequence deleted for security reasons)
Thanks John – I have all the number sequences for 4, 5 and 6 digits. I just don’t publish them as I wouldn’t want unscrupulous people using the code to gain entry. I do share the sequence with those who email paul@bugadvisor.com and can show they are bona fide.
What I could use is the sequence when the buttons A and B are added to a lock box.
Please Can You Possibly Send Me All The Combinations it could be ive got a Mager problem
Please email me a picture of the lockbox next to an open door. Thanks paul@bugadvisor.com
I have a medical alert that comes with a lockbox so paramedics don’t have to break down my door should I be unfortunately comatose. The rep who sold it to me said no one would see my code until they called the ambulance. But I just talk to another rep and I asked if she had my code on file, even though I realized she couldn’t see it. She said, “I have it right here,” and then she read it to me. I know I may sound paranoid, but what would stop a person (a thief, I guess) from using it? Am I missing some fundamental information about lock boxes?
Hi Carol – well your medical alert company should have better systems in place so that the code is only available when needed and only to those who need it. As for the lockbox, depending on the type it may also be easy to crack.
Thanks for the quick reply. I agree with you so I’m sending it back.
If things get that bad, they can break down the door.
Has anyone factored in the fact that whilst trying to find the correct sequence, hitting an incorrect button returns you to square one??
Just read your review and comments about using and hacking a Key box. You talk about the limited number of codes available within a 4 digit number, but these type of key boxes (button not dial combination) are able to utilise from 1 up to 10 digits in the combination, making your 161 codes far short of the actual available number usable.
The reason the number of combinations is less than you think is because they can be entered in any order. So if you set 1234 then 4231,2134,4321 etc will also open the box.