I previously wrote about key lock boxes here. In that original post, I described how these lockboxes seem to work and how their limitations mean that there aren’t as many combinations as it may first seem.

At that time, I’d only considered setting four different numbers on the box. I now realise it is possible to set just one number or all ten. So, the number of combinations does increase as a potential lockbox hacker doesn’t know how many numbers to try. But what is the best number of numbers to enable on a lockbox? I actually thought that five numbers would be worse than four, but a comment on the previous post by Aneirin, with formula, now makes wonder whether five is the optimum. However, I think the formula provided by Aneirin doesn’t take into account that only one of each number can be chosen. The formula does account for numbers being entered in any order.

Aneirin provided this formula:

(n!)/((n-r)! * (r!)) = number of combinations

where

*n* is the number of buttons on the lockbox – which is normally 10

*r* is the n is the number of buttons you enable

For those of you who don’t already know, the ! means factorial. So for example 5! = 5x4x3x2x1 although * seems preferred than x, but both means multiplied by/times.

Because n = 10 that means 10! = 3,628,800.

Here’s a table of results of 3,628,800 divided by ((10-r)! * (r!)):

R= |
10-r= |
(n-r)! |
r! |
result of ((10-r)! * (r!)) |
3,628,800 divided by ((10-r)! * (r!)) |

1 | 9 | 362,880 | 1 | 362,880 | 10 |

2 | 8 | 40,320 | 2 | 80,640 | 45 |

3 | 7 | 5,040 | 6 | 30,240 | 120 |

4 | 6 | 720 | 24 | 17,280 | 210 |

5 | 5 | 120 | 120 | 14,400 | 252 |

6 | 4 | 24 | 720 | 17,280 | 210 |

7 | 3 | 6 | 5,040 | 30,240 | 120 |

8 | 2 | 2 | 40,320 | 80,640 | 45 |

9 | 1 | 1 | 362,880 | 362,880 | 10 |

The formula doesn’t seem to work when r=10 as my calculation came out as 3,628,800 and I know that can’t be true as if you set all ten buttons, you could just enter any combination of ten numbers and the box would open. Maybe Aneirin is still reading this and can explain why the math fails?

My calculation for a four number combination was 161 – the table above says 210, but as I said, I don’t think Aneirin has accounted for the fact that only one of each number can be chosen.

On the basis that a potential lockbox hacker doesn’t know how many numbers in the combination, that means the total number of combinations could now be 10+45+120+210+252+210+120+45+10 = 1012 – in reality I think most people set four numbers and I also still think the numbers are less than this.

I still think that these boxes are flawed in that;

only one of each number can be chosen, and

it doesn’t matter what order the numbers are entered.

Pingback: Key Lock box Security – not as secure as you might think |

Grace

said:How did you calculate the 161 for four number combination ?

bugadvisor

said:I originally did it by writing the numbers out longhand, so 0123, 0124, 0125 etc. But I think I missed some as, in my updated article, there is a math formula to work out the combinations and that says 210 (when you set 4 digit combination).

Grace

said:Before I get answers, I have no comment.

Grace

said:May I know how did you get 161 by writing 0123, 0124…?

bugadvisor

said:Well I wrote out every possible number, first is 0123, then I counted how many I’d written and it came to that figure. But like I said I think I missed some and it’s really 210. You really need to read both of the posts on lock boxes.

Grace

said:I forgot my supra lock box code number. After I read your update post, formula, table results, and your answers, that helped me to open my lock box.

Grace

said:I think a good mathematician can open these lock boxes.

Matthew

said:One of the readers on the other post noted that if any button/ number can either be included or excluded, then the number of combinations equals 2^10, which is 1024. Notice that when you used the combination formula (with the factorials), and added up the total number of possibilities for each number of buttons chosen, you got 1012, which is quite close to 1024.

Both methods of calculations appear to be correct for this limited situation and should give the same answer if we make all the same assumptions (e.g. can we pick only 1 number or no numbers?).

I have a 4-digit lockbox, where each digit can be set to any numeral between zero and 9. Each digit is on a separate dia, so order would seem to be important (e.g. 0123 is different than 3210). I’m wondering if there are any shortcuts that would reduce the number of possible combinations to something less than 10,000.

Do you know what I’m referring to? Do you have any ideas?

bugadvisor

said:Hi Matthew

I’ve not seen the type of lockbox you have first hand. As there are four dials with ten digits then I would say that the total combinations is 10 x 10 x 10 x 10 = 10000.

A thief might try and reduce that number slightly by working on the basis that many people use birthdays – so first dial 0, 1 or 2, second dial 1-9, third dial 0 or 1 and fourth dial 0-9.

Or someone could just try every number in under eight hours – probably less as the actual combination probably doesn’t begin with 9.

Paul

Richard

said:Excellent analysis of the problem !

From your analysis t’m confident that the correct total number combinations are 1024.

Looking further, the sum of 10+45+120+210+252+210+120+45+10 = 1022 not 1012 as indicated above.

There are two combinations not represented in the sums. They are all buttons and shipped condition of no buttons cases. This brings the total combinations calculated using combinations and permutations to 1024 also.

As such the two different ways of arriving at the answer have come up with the same total number.

Jesus

said:You can actually enter a combination of up to 10 numbers. being 1234567890 but that would defeat the purpose. So there are a lot more possibilities. I had my lock box with 6 numbers.

Richard

said:Yes, the 1024 total combinations includes using all the combinations of 0 to 10 keys. Because no number can be used twice and the order of numbers doesn’t matter there is only 1024 possible combinations even though there are are 10 keys.

If the number of keys in the combination are known then brute forcing the combinations gets even easier.

The maximum number of combinations knowing the number of keys in the combinations is when there are 5 keys in the combination with 252 possible combinations. A 6 or 4 key combinations have 210 possible combinations while a 7 or 3 key combinations have only 120 possible combinations. 8 or 2 key combinations have only 45 possible combinations and the 1 or 9 key combinations only have 10 possible combinations.

Jeff

said:Looks like your table of calculations is correct, I was dubious at first that the # of combinations was so small.

I wrote some code to enumerate the possibilities here: https://medium.com/random-posts/7956250d8578

This has the outputs for if the # of digits in the pin are 4, 5, 6. Also has the code to output it so if you want the others you can modify that.

bugadvisor

said:Thanks Jeff

I’m still a bit nervous about putting all the possible combinations into the public domain. But even without your code, it was possible for anyone to sit down and slowly work out the combinations.

At least any potential thief won’t know if the PIN is set to 4, 5 or 6 numbers.

Paul

Pingback: The Best (well what I think is the best) of 2013 |

jaywant shinde

said:Hi I lost my GE security supra division lock box no. Yes u r right there would be 210 combination. Possible u can email me the list so I can open my lock box. You can ask me any quotations to make sure.

bugadvisor

said:Can you remember how many numbers you set? Was it 4?

Principessa

said:it’s really easy to come up with the list on your own. start with 0 as your first digit. for the second, third, fourth digits, use the rule that the digit in position X cannot be the same as, or smaller than, the digit in position X-1. So your first combination has to be 0123. The next: 0124, then 0125… 0129. Then 0134, 0135, 0136…0139. Then 0145 … 0149, etc etc until you end up with 0189. Then start with 02… and work your way up using the same rule. Eventually you’ll get to 6 in the first position and that only gives you 6789 and you’re done!

When I needed to open a box I didn’t even make a list, I just went through them in that order, remembering the one I had just tried, and mentally creating the next number. It’s almost as simple as counting from 1 to whatever. You just have to remember that every digit has to be larger than the digit to its left (as if you were spelling them out in your head for example).

Matt

said:Just bought a house that was inherited from a deceased relative. No one know the code. Would you send me your possibles. I am guessing it is a 4 digit code but know one knows. Thanks

bugadvisor

said:Send me some more information at paul@feagan.com as I’d need to be sure you weren’t just trying to break into somewhere

Matt

said:No problem. Email forthcoming.

bugadvisor

said:Sorry I got your email just haven’t had time to reply – tomorrow

Matt

said:It worked!

john

said:Just bought a repo house and it had an old punch number box. i would love to hav the list, i would sick my son on it to see if he could open it.

bugadvisor

said:Send me an email at paul@feagan.com with some more details and I’ll send you a list.

bily highfield

said:ive just moved into a new house and we have the same lock box as you do and i was wondering if you could send me all the possible codes for it please

bugadvisor

said:Please send me an email with some more details about yourself and i’ll try and help. Paul@feagan.com

michelle

said:Need help with lock box code. Just drive to AZ and room mate out of town and no keys.

Chip McDaniel

said:I feel sad for the people who keep asking for the list. It’s such a simple math problem… But even if you don’t want to do the math, it would certainly help if you know how many numbers were used to create the code. If you don’t know, I would start with four digit code and try this approach: stand in front of the lock box and enter 0,1,2,3. If that doesn’t work try 0,1,2,4, then 0,1,2,5, until you get to 0,1,2,9, then increment the next to last digit, and use the next highest digit for the last digit (you don’t have to try the smaller digit in the fourth position because you’ve already tried those) so its: 0,1,3,4 – followed by 0,1,3,5 – 0,1,3,6… until you get to 9 in the last position, then increment the third digit again, and start with the next highest fourh digit: 0,1,4,5 and so on. This method will allow you to try the 210 possibilities without needing a list… and you can use the same technique for the other length combos also.

Principessa

said:i think it’s easier just to say, if you write out a four digit code, each digit has to be larger than the one to its left.

Pingback: A round up of 2014 |

Stephan

said:I’m late but thought you might want to know that 0! =1, not 0. I’m guessing your spreadsheet tried to divide by zero. So in the region=10 case you get 10!/10! Which equals 1.

Grace

said:I used this lock box to secure my room door with a chin, but I found intruders still could get inside of my private room without pin code. Intruders could open lock box with mechanical skills. But I really do know how did they open this lock box without pin code.

TagWolf

said:You can easily “pick” these by applying slight tension to the open button while feeling the release of each button. This can be done in about 10 seconds. These are worthless. The following youtube video demonstrates: https://www.youtube.com/watch?v=8bzolgrC6BA

Elgvenn

said:Hi.

The easy formula is x^n, where

x is the number of positions of each button, and n is number of buttons.

So for 10 buttons with two positions you get 1024 possibilities.

For 12 buttons you get 4096 positions.

richard scoble

said:Hi..I’ve got a 12 button (0-9 + A &B) kidde supra key safe I can’t open..do you have a list of combinations I could start working through please?

Thanks

bugadvisor

said:I think having an A and B button doubles the number of combinations (assuming 4 numbers set) from 161 to 322 as you’d need 0123A, 0123B etc. Please send me a picture of your box next to an already open door and I’ll email you the combinations – email paul@feagan.com.

bugadvisor

said:Actually thinking about this again, I guess the letter can be any part of the sequence, not just at the end. So that’s like having 12 numbers to choose from. That’s more secure and my list won’t work. It’s good to see that they’ve added these additional letters, although there is still the design flaw that means only one of each letter/number can be used in the sequence and the order doesn’t matter.

bob

said:Ha Ha! This is awesome. I have a box I used in 2003 that’s been laying around and not thrown away. Thanks to this post I just broke the code within 15 minutes. Still, need to replace it since it’s so easy to bypass the code. Interesting!

David

said:I just came across this post and was amused the discussion has been going on for three years. The solution to work this out is the same as to work out the odds for permutations in football pools.

For a keysafe with ten buttons;

Set 2 buttons then (10×9) / 2 = 90 / 2 = 45 possible combinations

Set 3 buttons then (10x9x8) / (2×3) = 720 / 6 = 120

Set 4 buttons then (10x9x8x7) / (2x3x4) = 5040 / 24 = 210

Set 5 buttons then (10x9x8x7x6) / (2x3x4x5) = 30240 / 120 = 252

Set 6 buttons then (10x9x8x7x6x5) / (2x3x4x5x6) = 151200 / 600 = 252

Set 7 is the same as set 3

Set 8 is the same as set 2

So the best option is to set 5 buttons (or 6)

For a keysafe with 12 buttons

Set 6 buttons (12x11x10x9x8x7) / (2x3x4x5x6) = 665280 / 720 = 924

I definitely won’t be trusting my house keys to a ten button keysafe !

David

said:I forgot to allow that for a ten button keysafe a would be burglar would also need to know how many buttons were set up otherwise possible combos for 10 button lock would be 1265 which includes 10 combos for set 1 button and 1 combo for set 10 buttons

As for a 12 button lock – well I let someone else do the maths !!

James Marks

said:And I just ran across an even simpler proof of the possible combinations that I’m embarrassed to say I didn’t think of before. Think of the ten buttons as 10 bits that can either be set to 0 or 1 — off or on. The number of possible combinations ranges from 0000000001 (one on) to 1111111111 (all on).

1111111111 binary converts to 1,023 decimal, the number of possible combinations. (And, for the record, a 12-button lock would convert to 4,095 combinations.)

jamesmarks59

said:I just purchased one of these key vaults and discovered, to my dismay, that number order doesn’t matter and each number can only be used once in a given combination. I wrote a short program to generate all possible unique combinations, ranging in length from 1 number to 10, and came up with 1,023 possible unique combinations — roughly equivalent to a 3-barrel combination lock (999 possible combinations).

I was also amused to then find this post and so emailed my results to David for his edification. (Not sure the effort writing the code was worth the payoff but there it is. Now I know.)

David

said:Lovely elegant solution using binary James – and absolutely correct (I checked it out) and I’m quite p***** off with myself for not thinking of this so simple method !

I also realise I made a mistake in my calculations (didn’t check all was correct before posting did I ?)

Here is my correct account (without all the steps);

1= 10

2= 45

3=120

4=210

5=252

6=210 (where I f***** up !)

7=120

8= 45

9= 10

10= 1

Added all together to give the possible number of combos = 1023 – so I was in my method correct even if I worked it through wrong LOL

Just for fun; here is my method solution for 10 buttons;

10x9x8x7x6x5x4x3x2x1 / 1x2x3x4x5x6x7x8x9x10 which of course = 1 / 1 or shall we just say 1 !!!

For those who know nothing of writing code (my knowledge goes about as far as vintage ZX81 BASIC) here is an explanation of James’ method (no disrespect your coding skills James);

Doubling the numbers of 1 through to 10 gives;

1, 2, 4, 8, 16, 32, 64, 128, 256, 512 which if added all together yield 1023.

Extending that to a keysafe with 12 buttons:

1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048 which if all added together yield 4095.

Well done done James – I think you have finally put this baby to bed.

Just to finish off – I think a would burglar armed with a chisel and lump (club) hammer would have a SUPRA keysafe open in a few seconds with very little noise – just a couple of hefty smacks. so best hide your house keys under a brick LOL.

Chan

said:Thank to your articles, especial the updated one, I was able to unlock the Supra lock box on the 39 th trial – up to 3 digit code then (even the previous homeowner didn’t know the code for that Supra lock box)! Happy Thanksgiving!

Shane Modi

said:Can you please send me the 161 – 4 digit combinations to my email, I bought brand new lockboxes and all of them are locked and I can’t open them. Thanks..

bugadvisor

said:Sorry Shane – did I send these to you?