I previously wrote about key lock boxes here. In that original post, I described how these lockboxes seem to work and how their limitations mean that there aren’t as many combinations as it may first seem.
At that time, I’d only considered setting four different numbers on the box. I now realise it is possible to set just one number or all ten. So, the number of combinations does increase as a potential lockbox hacker doesn’t know how many numbers to try. But what is the best number of numbers to enable on a lockbox? I actually thought that five numbers would be worse than four, but a comment on the previous post by Aneirin, with formula, now makes wonder whether five is the optimum. However, I think the formula provided by Aneirin doesn’t take into account that only one of each number can be chosen. The formula does account for numbers being entered in any order.
Aneirin provided this formula:
(n!)/((n-r)! * (r!)) = number of combinations
where
n is the number of buttons on the lockbox – which is normally 10
r is the n is the number of buttons you enable
For those of you who don’t already know, the ! means factorial. So for example 5! = 5x4x3x2x1 although * seems preferred than x, but both means multiplied by/times.
Because n = 10 that means 10! = 3,628,800.
Here’s a table of results of 3,628,800 divided by ((10-r)! * (r!)):
| R= | 10-r= | (n-r)! | r! | result of ((10-r)! * (r!)) | 3,628,800 divided by ((10-r)! * (r!)) |
| 1 | 9 | 362,880 | 1 | 362,880 | 10 |
| 2 | 8 | 40,320 | 2 | 80,640 | 45 |
| 3 | 7 | 5,040 | 6 | 30,240 | 120 |
| 4 | 6 | 720 | 24 | 17,280 | 210 |
| 5 | 5 | 120 | 120 | 14,400 | 252 |
| 6 | 4 | 24 | 720 | 17,280 | 210 |
| 7 | 3 | 6 | 5,040 | 30,240 | 120 |
| 8 | 2 | 2 | 40,320 | 80,640 | 45 |
| 9 | 1 | 1 | 362,880 | 362,880 | 10 |
The formula doesn’t seem to work when r=10 as my calculation came out as 3,628,800 and I know that can’t be true as if you set all ten buttons, you could just enter any combination of ten numbers and the box would open. Maybe Aneirin is still reading this and can explain why the math fails?
My calculation for a four number combination was 161 – the table above says 210, but as I said, I don’t think Aneirin has accounted for the fact that only one of each number can be chosen.
On the basis that a potential lockbox hacker doesn’t know how many numbers in the combination, that means the total number of combinations could now be 10+45+120+210+252+210+120+45+10 = 1012 – in reality I think most people set four numbers and I also still think the numbers are less than this.
I still think that these boxes are flawed in that;
only one of each number can be chosen, and
it doesn’t matter what order the numbers are entered.
BugAdvisor.com 
How did you calculate the 161 for four number combination ?
I originally did it by writing the numbers out longhand, so 0123, 0124, 0125 etc. But I think I missed some as, in my updated article, there is a math formula to work out the combinations and that says 210 (when you set 4 digit combination).
Before I get answers, I have no comment.
May I know how did you get 161 by writing 0123, 0124…?
Well I wrote out every possible number, first is 0123, then I counted how many I’d written and it came to that figure. But like I said I think I missed some and it’s really 210. You really need to read both of the posts on lock boxes.
I forgot my supra lock box code number. After I read your update post, formula, table results, and your answers, that helped me to open my lock box.
I think a good mathematician can open these lock boxes.
One of the readers on the other post noted that if any button/ number can either be included or excluded, then the number of combinations equals 2^10, which is 1024. Notice that when you used the combination formula (with the factorials), and added up the total number of possibilities for each number of buttons chosen, you got 1012, which is quite close to 1024.
Both methods of calculations appear to be correct for this limited situation and should give the same answer if we make all the same assumptions (e.g. can we pick only 1 number or no numbers?).
I have a 4-digit lockbox, where each digit can be set to any numeral between zero and 9. Each digit is on a separate dia, so order would seem to be important (e.g. 0123 is different than 3210). I’m wondering if there are any shortcuts that would reduce the number of possible combinations to something less than 10,000.
Do you know what I’m referring to? Do you have any ideas?
Hi Matthew
I’ve not seen the type of lockbox you have first hand. As there are four dials with ten digits then I would say that the total combinations is 10 x 10 x 10 x 10 = 10000.
A thief might try and reduce that number slightly by working on the basis that many people use birthdays – so first dial 0, 1 or 2, second dial 1-9, third dial 0 or 1 and fourth dial 0-9.
Or someone could just try every number in under eight hours – probably less as the actual combination probably doesn’t begin with 9.
Paul
Excellent analysis of the problem !
From your analysis t’m confident that the correct total number combinations are 1024.
Looking further, the sum of 10+45+120+210+252+210+120+45+10 = 1022 not 1012 as indicated above.
There are two combinations not represented in the sums. They are all buttons and shipped condition of no buttons cases. This brings the total combinations calculated using combinations and permutations to 1024 also.
As such the two different ways of arriving at the answer have come up with the same total number.
These boxes require a minimum of 3 buttons in the code. 1024 would be correct if any combination were allowed since each button has one of two possibilities and 2^10 == 1024. but we have to exclude 2-button, 1-button, and 0-button possibilities. there are 10 choose 2 = 90 2 button possibilities, 10 choose 1 = 10 1-button possibilities, and 10 choose 0 = 1 0-button possibility. so the actual number of possibilities is 1024-90-10-1 = 923.
doh sorry 1024-45-10-1=968
You can actually enter a combination of up to 10 numbers. being 1234567890 but that would defeat the purpose. So there are a lot more possibilities. I had my lock box with 6 numbers.
Yes, the 1024 total combinations includes using all the combinations of 0 to 10 keys. Because no number can be used twice and the order of numbers doesn’t matter there is only 1024 possible combinations even though there are are 10 keys.
If the number of keys in the combination are known then brute forcing the combinations gets even easier.
The maximum number of combinations knowing the number of keys in the combinations is when there are 5 keys in the combination with 252 possible combinations. A 6 or 4 key combinations have 210 possible combinations while a 7 or 3 key combinations have only 120 possible combinations. 8 or 2 key combinations have only 45 possible combinations and the 1 or 9 key combinations only have 10 possible combinations.
Looks like your table of calculations is correct, I was dubious at first that the # of combinations was so small.
I wrote some code to enumerate the possibilities here: https://medium.com/random-posts/7956250d8578
This has the outputs for if the # of digits in the pin are 4, 5, 6. Also has the code to output it so if you want the others you can modify that.
Thanks Jeff
I’m still a bit nervous about putting all the possible combinations into the public domain. But even without your code, it was possible for anyone to sit down and slowly work out the combinations.
At least any potential thief won’t know if the PIN is set to 4, 5 or 6 numbers.
Paul
Hi I lost my GE security supra division lock box no. Yes u r right there would be 210 combination. Possible u can email me the list so I can open my lock box. You can ask me any quotations to make sure.
Can you remember how many numbers you set? Was it 4?
it’s really easy to come up with the list on your own. start with 0 as your first digit. for the second, third, fourth digits, use the rule that the digit in position X cannot be the same as, or smaller than, the digit in position X-1. So your first combination has to be 0123. The next: 0124, then 0125… 0129. Then 0134, 0135, 0136…0139. Then 0145 … 0149, etc etc until you end up with 0189. Then start with 02… and work your way up using the same rule. Eventually you’ll get to 6 in the first position and that only gives you 6789 and you’re done!
When I needed to open a box I didn’t even make a list, I just went through them in that order, remembering the one I had just tried, and mentally creating the next number. It’s almost as simple as counting from 1 to whatever. You just have to remember that every digit has to be larger than the digit to its left (as if you were spelling them out in your head for example).
Just bought a house that was inherited from a deceased relative. No one know the code. Would you send me your possibles. I am guessing it is a 4 digit code but know one knows. Thanks
Send me some more information at paul@feagan.com as I’d need to be sure you weren’t just trying to break into somewhere
No problem. Email forthcoming.
Sorry I got your email just haven’t had time to reply – tomorrow
It worked!
Just bought a repo house and it had an old punch number box. i would love to hav the list, i would sick my son on it to see if he could open it.
Send me an email at paul@feagan.com with some more details and I’ll send you a list.
ive just moved into a new house and we have the same lock box as you do and i was wondering if you could send me all the possible codes for it please
Please send me an email with some more details about yourself and i’ll try and help. Paul@feagan.com
Need help with lock box code. Just drive to AZ and room mate out of town and no keys.
I feel sad for the people who keep asking for the list. It’s such a simple math problem… But even if you don’t want to do the math, it would certainly help if you know how many numbers were used to create the code. If you don’t know, I would start with four digit code and try this approach: stand in front of the lock box and enter 0,1,2,3. If that doesn’t work try 0,1,2,4, then 0,1,2,5, until you get to 0,1,2,9, then increment the next to last digit, and use the next highest digit for the last digit (you don’t have to try the smaller digit in the fourth position because you’ve already tried those) so its: 0,1,3,4 – followed by 0,1,3,5 – 0,1,3,6… until you get to 9 in the last position, then increment the third digit again, and start with the next highest fourh digit: 0,1,4,5 and so on. This method will allow you to try the 210 possibilities without needing a list… and you can use the same technique for the other length combos also.
i think it’s easier just to say, if you write out a four digit code, each digit has to be larger than the one to its left.
I’m late but thought you might want to know that 0! =1, not 0. I’m guessing your spreadsheet tried to divide by zero. So in the region=10 case you get 10!/10! Which equals 1.
I used this lock box to secure my room door with a chin, but I found intruders still could get inside of my private room without pin code. Intruders could open lock box with mechanical skills. But I really do know how did they open this lock box without pin code.
You can easily “pick” these by applying slight tension to the open button while feeling the release of each button. This can be done in about 10 seconds. These are worthless. The following youtube video demonstrates: https://www.youtube.com/watch?v=8bzolgrC6BA
Hi.
The easy formula is x^n, where
x is the number of positions of each button, and n is number of buttons.
So for 10 buttons with two positions you get 1024 possibilities.
For 12 buttons you get 4096 positions.
Hi..I’ve got a 12 button (0-9 + A &B) kidde supra key safe I can’t open..do you have a list of combinations I could start working through please?
Thanks
I think having an A and B button doubles the number of combinations (assuming 4 numbers set) from 161 to 322 as you’d need 0123A, 0123B etc. Please send me a picture of your box next to an already open door and I’ll email you the combinations – email paul@feagan.com.
Actually thinking about this again, I guess the letter can be any part of the sequence, not just at the end. So that’s like having 12 numbers to choose from. That’s more secure and my list won’t work. It’s good to see that they’ve added these additional letters, although there is still the design flaw that means only one of each letter/number can be used in the sequence and the order doesn’t matter.
Ha Ha! This is awesome. I have a box I used in 2003 that’s been laying around and not thrown away. Thanks to this post I just broke the code within 15 minutes. Still, need to replace it since it’s so easy to bypass the code. Interesting!
I just came across this post and was amused the discussion has been going on for three years. The solution to work this out is the same as to work out the odds for permutations in football pools.
For a keysafe with ten buttons;
Set 2 buttons then (10×9) / 2 = 90 / 2 = 45 possible combinations
Set 3 buttons then (10x9x8) / (2×3) = 720 / 6 = 120
Set 4 buttons then (10x9x8x7) / (2x3x4) = 5040 / 24 = 210
Set 5 buttons then (10x9x8x7x6) / (2x3x4x5) = 30240 / 120 = 252
Set 6 buttons then (10x9x8x7x6x5) / (2x3x4x5x6) = 151200 / 600 = 252
Set 7 is the same as set 3
Set 8 is the same as set 2
So the best option is to set 5 buttons (or 6)
For a keysafe with 12 buttons
Set 6 buttons (12x11x10x9x8x7) / (2x3x4x5x6) = 665280 / 720 = 924
I definitely won’t be trusting my house keys to a ten button keysafe !
I forgot to allow that for a ten button keysafe a would be burglar would also need to know how many buttons were set up otherwise possible combos for 10 button lock would be 1265 which includes 10 combos for set 1 button and 1 combo for set 10 buttons
As for a 12 button lock – well I let someone else do the maths !!
And I just ran across an even simpler proof of the possible combinations that I’m embarrassed to say I didn’t think of before. Think of the ten buttons as 10 bits that can either be set to 0 or 1 — off or on. The number of possible combinations ranges from 0000000001 (one on) to 1111111111 (all on).
1111111111 binary converts to 1,023 decimal, the number of possible combinations. (And, for the record, a 12-button lock would convert to 4,095 combinations.)
I just purchased one of these key vaults and discovered, to my dismay, that number order doesn’t matter and each number can only be used once in a given combination. I wrote a short program to generate all possible unique combinations, ranging in length from 1 number to 10, and came up with 1,023 possible unique combinations — roughly equivalent to a 3-barrel combination lock (999 possible combinations).
I was also amused to then find this post and so emailed my results to David for his edification. (Not sure the effort writing the code was worth the payoff but there it is. Now I know.)
Lovely elegant solution using binary James – and absolutely correct (I checked it out) and I’m quite p***** off with myself for not thinking of this so simple method !
I also realise I made a mistake in my calculations (didn’t check all was correct before posting did I ?)
Here is my correct account (without all the steps);
1= 10
2= 45
3=120
4=210
5=252
6=210 (where I f***** up !)
7=120
8= 45
9= 10
10= 1
Added all together to give the possible number of combos = 1023 – so I was in my method correct even if I worked it through wrong LOL
Just for fun; here is my method solution for 10 buttons;
10x9x8x7x6x5x4x3x2x1 / 1x2x3x4x5x6x7x8x9x10 which of course = 1 / 1 or shall we just say 1 !!!
For those who know nothing of writing code (my knowledge goes about as far as vintage ZX81 BASIC) here is an explanation of James’ method (no disrespect your coding skills James);
Doubling the numbers of 1 through to 10 gives;
1, 2, 4, 8, 16, 32, 64, 128, 256, 512 which if added all together yield 1023.
Extending that to a keysafe with 12 buttons:
1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048 which if all added together yield 4095.
Well done done James – I think you have finally put this baby to bed.
Just to finish off – I think a would burglar armed with a chisel and lump (club) hammer would have a SUPRA keysafe open in a few seconds with very little noise – just a couple of hefty smacks. so best hide your house keys under a brick LOL.
Thank to your articles, especial the updated one, I was able to unlock the Supra lock box on the 39 th trial – up to 3 digit code then (even the previous homeowner didn’t know the code for that Supra lock box)! Happy Thanksgiving!
Can you please send me the 161 – 4 digit combinations to my email, I bought brand new lockboxes and all of them are locked and I can’t open them. Thanks..
Sorry Shane – did I send these to you?
Combination Math (for all those people who keep asking “give me your list”):
(28+21+15+10+6+3+1) +
(21+15+10+6+3+1) +
(15+10+6+3+1) +
(10+6+3+1) +
(6+3+1) +
(3+1) +
(1)
Total non-overlapping four digit combinations (0-9) = 210
Work it out on a spreadsheet yourself – start with 0123, 0124, … then 0134,0135, … it will take you about ten minutes and you’ll learn something
=;^)
Thanks – some people comment with the actual list of numbers, which of course I already know but chose not to publish.
A quick python generator for multi-combos
import itertools
def combination(length,numbers =’0123456789′):
”’ Iterates numbers of length to return possible combinations”’
#combination(3,’ABCD’) –> ABC, ABD BAD,
combinations = []
iterations = itertools.combinations(numbers, length)
for each in iterations:
comb = “”.join(each)
combinations.append(comb)
return(combinations)
combination_four = combination(4)
print(combination_four)
print(‘\n’,’There were {} combinations’.format(len(combination_four)))
People ask me about boxes that have numbers 0-9 plus A and B keys. I’d be interested to know how many combinations there are with effectively 11 numbers – still the same rules; only one number/letter can be selected and order doesn’t matter.
In combinatorics, a branch of math, this function is called ‘choose’.
https://www.wolframalpha.com/input/?i=10+choose+4
Very interesting, thanks all who contributed
I still need clarity on some basics.
I have purchased a key lock box [not unpacked as yet in case i need to return it] with 3 dials 1 to 0
I understand that i should use all different numbers in my 3 number code
How many possible combinations are there
Could it be that it doesn’t matter what order ie 123 or 321?
Thanks JOhn
Hi John
If your box has dials then I think the number order does matter. So you have 999 possible combinations as you would expect.
The boxes with buttons have no order setting = so if you set 1,2,3 then you could enter 3,1,2 and it would still open.
Regards
Paul@bugadvisor.com
Do you have any tips for creating a list of numbers to check when trying the codes on this?
I just started a job where nobody knows the code to a lock box, and I would love to have a list of numbers to try, especially since it’s not the only lock box whose code is forgotten in the building.