A newbie’s guide to safes, both opening and using

Firstly, a disclaimer – I’m not a safe cracker. I just know quite a few people who do work on safes and probably know more than the average person.

On Reddit a few months ago, a post appeared from user dont_stop_me_smee showing pictures of a large vault in a friend’s rented property. This garnered a lot of attention, partly riding off the back of the much older “vault in disused casino” popularity. Needless to say, OP did not deliver, and the vault is still closed.

As a result of this post, a new subreddit was set up called “WhatsInThisThing“:

This subreddit is a place for anyone who has acquired a safe, piggy bank, briefcase, treasure chest, oak barrel, thumb drive, bottle, locker, storage unit, abandoned home, bomb shelter, antique can, maybe even a confidential file to post pictures of the adventure of finding out what’s inside it.

There have been a lot of safes posted since then, ranging from modern £20 B&Q specials up to vintage monsters.

There has also been a lot of crap posted about safes and how to open them.

I’m writing this post to try and clear up some aspects of safes, both in terms of opening them an using them to improve your own security.

First things first, if you want your safe opened quickly and without damage, call a good safe engineer. If you are in the UK or Europe, I can put you in touch with someone.

Otherwise, read on.

Opening cheap modern safes

There are a lot of cheap modern safes, constructed of sheet steel (or even plastic/cement laminate!), often with digital combination locks or very insecure mechanical locks. These only provide an illusion of security.

How would I open a cheap digital combination lock safe?

  • Find the manual. The safe will have a default code, and could have a reset procedure that can be triggered from outside the safe. Try this first.
  • Call the manufacturer. Some of these safes have reset procedures that you can get from the manufacturer. You will need to prove ownership. Sometimes you need the serial number which will be inside the safe.
  • Try hitting it. A lot of these safes hold the boltwork back using a spring loaded solenoid. If you hit the safe in the right place with a mallet (or even your hand on smaller safes) whilst turning the handle, it bounces the solenoid back enough to allow the safe to open. This works on a surprisingly large number of safes.
  • Pick the override lock. Nearly all of these safes have a mechanical override lock. These are normally cheap wafer locks, which can be picked open easily by locksmiths and hobbyists.
  • Try and activate the code reset button. Many safes have a small button inside the door used to change the combination. I’ve managed to press this button from outside the safe by using a welding rod poked through a mounting hole on the rear of the safe.
  • Take the front panel off and manually activate the solenoid or motor. Some of the cheap safes have all of the electronics outside of the safe. If you remove the front panel, you will often find two wires going through the door. These connect to the solenoid or motor inside the safe. Apply the correct voltage (usually the same as the total voltage of the batteries) and the safe will unlock.
  • Cut the safe open. I’ve not seen one of these resist more than a few minutes with even a small angle grinder. The top or back is normally easiest.

Most of the time, you don’t really care if the safe survives or not, so go to town on it.

Opening bigger and better safes

If you want to try it yourself, you have the following options…

Non-destructively open the lock. There are a number of techniques that can be used to open mechanical combination locks – reading contact points, or brute forcing (trying every combination using a motor). This is a very skilled job. It is also unwise if you don’t know if the lock works or not – hours could be spent trying to open a lock that will never unlock. Matt Blaze has written a great guide on this (and other vulnerabilities) called “Safe Cracking For the Computer Scientist“. If the lock is mechanical, it can be picked.

Drill the safe. If non-destructive entry is not possible, safe engineers will drill the safe. This involves making a small penetration somewhere on the safe and then opening the safe through the hole. Again, this is a skilled job. You need to know exactly where to drill and then how to open the safe. Sometimes you will drill near to the combination lock and use a borescope to read the wheel pack. Sometimes you will drill to access the bolt or fence instead. Many safes have very hard steel called “hardplate” protecting the lock, and this requires a lot of pressure and special drill bits to get through. Most safes have some form of “relocker” – additional spring-loaded bolts that will trigger under attack and hold the boltwork shut. You really don’t want to trigger these as there is no way to unlock them from outside the safe. The small hole that is left can be filled with hardened steel and welded over for repair.

Cut the safe open. This still generally requires skill or knowledge if you don’t want to damage the contents. Angle grinders, punches, concrete breakers, and thermal lances are tools used here. This can be very time consuming and noisy.

Do you see a theme? You generally need to know what you are doing.

Opening a vault

Unless you can make a hole in the wall, floor, or ceiling, you should call a safe engineer.

Old safes vs. new

Most older safes tend to be fairly secure. I believe this is because of two things. Firstly, safes used to be made better, or at least, more solidly.  Secondly, if an old safe has survived this long and not been opened, it’s either secure or too damn heavy to throw out.

Old safes have the advantage that most safe engineers won’t easily be able to determine how to open the lock or where to drill, just through a lack of knowledge and experience.

A lot of modern safes are cheap crap. Anything you can buy in B&Q can be cut open in under 10 minutes. But a good, expensive modern safe is a formidable opponent. Modern combination locks are very good – they have extensive “anti manipulation” features. Even low-cost lever locks are hard to pick. Hardplate is very hard and there are advanced composite materials that are difficult to drill or cut through.

What not to do

There is a lot of bad advice floating about.

Don’t cut the external hinges off the door. They aren’t part of the locking mechanism on even the cheapest safes, so you now have a broken safe that is still closed.

Don’t force the handle. Good safes have boltwork that won’t open no matter how much force you apply to the handle. The handle will shear off first or you will break part of the drive mechanism.

Don’t hit the dial or spindle of the combination lock. The combination lock and door has something called a relocker on it. If you trigger this by hitting it, additional spring-loaded bolts will fire and mean that you cannot open the safe even if you unlock the lock. You’ve potentially made an easy job much harder.

Don’t attempt to use thermite. I’m not sure why, but people suggest this. I suspect none of them have made or used thermite. I have. It’s hard to mix correctly, it isn’t cheap, it’s dangerous, and it will destroy the contents of the safe.

Don’t try a plasma cutter. Again, I suspect these people have never used a plasma cutter. They are exceptionally good at cutting through plate. They are no good when you cannot make the cut in one pass (there is nowhere for the slag to go, so it gets blasted back towards you). They will toast the contents. They are expensive and need a lot of compressed air.

Don’t try any other half-cut idea from someone who has no idea what they are doing. Dousing the safe in liquid nitrogen, filling with water and blowing it up etc. all sound like they are a lot more work and cost than just paying a safe engineer.

Don’t think that opening safes is some kind of mystical black art. There are hundreds of people who can open safes. The more expensive and secure the safe, the less there are that can open it. But there is no safe that cannot be opened.

Don’t think that the safe will have anything exciting in it. They very rarely do.

What do you need in a safe?

After reading all of that, you’ve decided you need a safe. What should you look for?

  • Avoid any digital combination safe that has a mechanical override lock. Instead of having one good mechanical lock, you now have a digital lock and a crap mechanical lock. The security of the safe is limited by the lower of the two.
  • Look for a good lever lock. At prices acceptable to most householders, a good lever lock will provide the best security.
  • Decide if you are protecting against fire and/or theft. A lot of “fire safes” have extremely poor security. Burglary is far more common than house fire. My safe protects against theft, and the small fire chest inside protects truly irreplaceable objects.
  • Avoid any safe that a single person can easily pick up. You don’t need something that weighs 750kg, but 50kg+ makes things a lot more awkward for burglars.
  • Make sure you can bolt the safe to the floor and/or wall. A 50kg safe attached to a concrete floor with 4 expanding bolts is going to be as hard to move as a 500kg safe.
  • Make sure it is big enough to hold your stuff. If it can’t hold the thing you need to protect, it has no purpose. A lot of smaller safes can’t take 15.6″ laptops.
  • Make sure it is accessible enough that you actually use it. If it is hidden away, you are unlikely to ever use it. If your stuff isn’t in the safe, it doesn’t matter how secure the safe is.

Recommended contacts

The following locksmiths and safe engineers are known to me, and whilst I have never had to use their services, I know they do good work.

Jason Jones at Kelocks (UK)

Stuart Game at BBS Safe Engineers (UK)

Nigel Tolley at Discreet Security Solutions (UK)

Jord Knapp at Knapp Junior (NL)

Emiel van Kessel at De Slotenspecialist (NL)

Oliver Diederichsen at Tresoroeffnung (DE)

 

5 thoughts on “A newbie’s guide to safes, both opening and using

  1. Permalink  ⋅ Reply

    Nigel

    June 18, 2013 at 9:13pm

    Whilst not a great fan of all this info being pooled so neatly, anyone could find this out with a little work, so I’ll not moan.

    As a pro, I agree with pretty much all of this. Main point to disagree with is that the top safe engineers will go to massive lengths NOT to drill a safe – it takes forever on a decent one, and those relockers can turn a 2 hour pick/decode into a 3 day job with a few hundred blunted carbide tipped drills if you nick the glass.

    Also, “additional sprint-loaded locks” is wrong. They are spring-loaded bolts. They take no key. Even better, some of the relockers are also relocked(!), so nothing short of complete destruction will open the door.

    • Permalink  ⋅ Reply

      cybergibbons

      June 18, 2013 at 9:20pm

      Thanks – I was hoping you would pass comment!

      I hope that the post really drives people to speak to safe engineers rather than do it themselves. There have been so many safes lose their hinges on reddit already, some of which look like nice, vintage pieces.

      I think I agree with you with good safe engineers on good safes. But, looking at mid-range safes with mid-range safe engineers, it seems that drilling is quite popular. The post is maybe focused on the US where combo locks seem more common on cheaper safes.

      Happy to change it through, what do you think?

      I had relockers as bolts, but then I thought the layman would assume they were alongside the main bolts, whereas they are usually bolts that fire into the boltwork. I’ll clarify.

  2. Permalink  ⋅ Reply

    Sterling Brenner

    July 9, 2013 at 3:56am

    My wife and I recently had some trouble retrieving the contents from our fire proof safe. Normally, I’m the kinda guy that will try anything to solve a problem on his own before admitting failure and contacting the right person for the job. In this particular case, every attempt I made at opening the case failed and as you alluded to in the article, the last thing you want to do is destroy the contents of the safe while attempting to extract them. Long story short, contacted a technician from the company and all was resolved without hassle. :)

  3. Permalink  ⋅ Reply

    Jason Jones

    July 22, 2013 at 8:11am

    Some good advice there, the main difference with cheap safes is that they are nothing more than an over priced tin box, I specialise in opening odd, medium to high grade safes, Most of these safes will have some knid of AED (Anti Explosive Device) that are ment to be set off it attacked. A lot of the safes and vaults I work on were made at a time where a would be thief would have a long time undisturbed to try and break into a safe (this was a time before Alarms) so they could sit there over the weekend having a go.

    There are a lot of traps that they are put in different models of safes and vaults to stop them from being opened by every known method of attack. I did a large 6ft safe not that long ago that had tar in the body, the ide is some one tried to use hot equipment to open and would catch the tar alight and the room would fill with dense chocking smoke.

    • Permalink  ⋅ Reply

      cybergibbons

      July 22, 2013 at 8:38am

      Thanks for commenting Jason, I hope you are OK with the link to your site (I’ve heard many good things about your work).

      The older safes are fascinating, I love the fact that they might be almost completely unique and have all manner of crazy devices to stop people getting in.

      I really don’t get these cheap safes. There are Yale branded safes in B&Q that are £130 or so, have a digital lock and a wafer lock override. Literally less than 2 minutes to open. I spent about £500 on a ex-display safe, and I’m confident it would withstand any reasonable attack, it would be hard for anyone to move even if it wasn’t bolted onto a concrete slab floor.

Leave a Reply

Your email will not be published. Name and Email fields are required.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code class="" title="" data-url=""> <del datetime=""> <em> <i> <q cite=""> <strike> <strong> <pre class="" title="" data-url=""> <span class="" title="" data-url="">