[57] Kwikset Smartkey Gen 3 Reverse Sidebar Bypassed, Picked, Gutted & Explained

[@educatebo]

Just bought a gen 3 dead bolt for practice- $12 at HD. I think Kwikset had made improvements- it is NOT sloppy; the space to insert the shims allows only 1 shim of .012" thickness. This one shim doesn't put on enough pressure, as you say. With the core removed and in a vice I can get 2- .012 shims started as you show. Then, each shim exits the channel half way back due to the slight upward shim tip that was necessary to get the shim in the channel over the side bar to begn with. Couldn't get the shim in the channel IF it was totally flat. The lock did open in the vice with both shims in place. The problems are: very tight tolerances and the curved shim tip.

[@educatebo]

Now having luck with the core in a vice with 2 shims: first 0.010", then 0.012"; insert the first shim (with a slight tip curve to get started) just under pins 1-3. The curved tip makes the shim exit upward after the 3rd pin. Then insert the 2nd shim without any curve on the tip on top of the first shim past pin #3, through the visible space to pin #4. This puts downward pressure on the first shim and prevents it from popping up. Finally push shim #1 all the way under shim #2. Set the wafers as I go. I tried milling one shim to 0.02" but couldn't get it to work. Next I'll try the core in the housing inserting the shims side by side and angling them together?

[@educatebo]

Correction: I CAN get 3 shims between the core and housing: 0.01, 0.01 and 0.013". For my new lock, any 2 shims won't allow pin 5 to set. It takes all 3 shims to put enough pressure on the side bar to set pin 5. Perhaps different shims will be necessary for different gen 3 locks?

[@jpadilla6436]

For hobbyists this is the way to go. In the field, get the decoder. This gen 3 really is a secure lock. Especially the ones with the hardplate shield.

[@SnakePicks]

Wow. Great job picking, gutting, and explaining it all.

[@MrBlackMagic]

Thank you sir

[@camronbay1]

Nice video that's why I mention feeler gauges to make different types of shims to defeat locks on the knob sets I use a punch to create a hole in the back of the plug and use a Allen wrench to rotate the spindle.

[@SchuddeMell]

i was looking forward to this video after seeing your post with the 2 shims : ) very interesting technique and excellent explanation : )

[@MrBlackMagic]

Many thanks :)

[@tartgreenapple]

Best video on how this bypass works, you put a lot of time into making this video, thank you!!!

[@MrBlackMagic]

Very welcome!

[@thelockpickinglebowski633]

Nice work. Yeah I gotta get busy making the right size and shape shims for this.

[@locksportviking3019]

You made that look to easy! I still have trouble with mine but I'm going to have to steal your two tensioner idea👍 Thanks

[@MrBlackMagic]

Always welcome!

[@chriscapune7873]

Great bypass and picking Very nice explanation! 🐈🐾🐈‍⬛🐾

[@MrBlackMagic]

Thanks!

[@arreguina69]

I’ve heard that picking it that way destroys the Rekeying feature. Is it true ? If so I’ll just bump smart keys from now on. “Bump key resistant” is a lie they bump within a few seconds.

[@MrBlackMagic]

Have not noticed any affection on the rekeying system with this method

[@thorlancaster5641]

6:28 Why TF did KWIK SET put a giant hole there for you to shim through? At first I thought it might be a cheat but I see it in other videos too. If they could shield their sidebar, it would make your clever pick impossible. Key retention maybe?

[@MrBlackMagic]

I see no reason for this sidebar access. Maybe its easier for contruction or what ever but its simply a giant design flaw.

[@ceazar75]

He's cheating. That's not normally there.

[@MrBlackMagic]

@@ceazar75 Did you spend 1 minute to check other Kwikset Gen 3 video about it? Go buy a Gen 3 if you don't believe it and try it yourself. Or ask one of the hundred other lockpickers who also did it (go to the subreddit and ask for it, pls)

[@shieldcracker]

Kwikset puts the hole there and another one at 180 degrees apart to place hardened inserts to resist drilling attacks. This leaves only a very thin bridge at the edge of the face of the plug that could potentially be exploited to pick the lock as seen here.

[@arreguina69]

@@ceazar75lol check you Kwikset smartkey

[@johnkeo358]

Are you using two .25 mm feeler guages?

[@MrBlackMagic]

Exactly. Should also work with thinner or slightly thicker gauges too

[@johnkeo358]

@MrBlackMagic I was surprised the Gen 3 was rather high on the LPU ranking system. I understand it's unpickable without the sidebar bypass. I hear the gen 1 and 2 are pickable but much harder to pick without doing the sidebar bypass. I was thinking of using a modified Bobby pin, seems it would be much easier for edc carry.

[@MrBlackMagic]

@@johnkeo358 Could be working with bobby pins but they are a bit stiff while getting them into the tiny area where the exploit works. Let me know once you tried it, curios to know if this could do the trick too

[@qutube100]

Awesome video thankyou!

[@eccentric_by_default489]

How can you tell what gen a kwikset smart lock is by looking at it?

[@MrBlackMagic]

Maybe its possible to differ them based on the keyway but i am not entirely sure

[@eccentric_by_default489]

@@MrBlackMagic that's what I'm trying to figure out. I know theres different ways to bypass or pick the different gens. My issue is identifying the gens

[@MrBlackMagic]

@@eccentric_by_default489 As you can also decode some KwikSet Gens just based on the keyway view i would highly recommend to use an endoscope camera to search for unique features

[@jasonmuscarello8305]

I noticed there was a notch where you put the shims in. They don't come that way...

[@MrBlackMagic]

They do. The notch is getting more noticable as more as you use it for the exploit also some cover plates may hide it better. check out other Kwikset Smartkey videos abou this topic. I am by far not the first one using them.

[@pouncerminned863]

Where to buy the shims?

[@MrBlackMagic]

I made them out of feeler gauge. But you can try anything that fits like a cut soda can.

[@pouncerminned863]

@@MrBlackMagic oh ok. I do have some standard shims I can cut thinner I suppose

[@pouncerminned863]

@@MrBlackMagic last question, what is the height gap measurement as I’m gunna make some shim picks from feeler gauge as well. Maybe 2 to 3 mm should be ok huh?

[@MrBlackMagic]

@@pouncerminned863 you mean the thickness of the feeler gauge i used for this shims or from-to thicknes of a feeler gauge in general?

[@pouncerminned863]

@@MrBlackMagic I just want to know the size of that gap where you slide the shim into-

[@andy41417]

Block shims with #3 master pin on edge over steel ball.

[@MrBlackMagic]

Could you go more into detail? i am not sure if i understand what you are trying to say

[@jim3922]

why’s that hole there?

[@MrBlackMagic]

I have no clue. Maybe due to the building or machining process. A big design flaw in any case

[@SamuelColvin-q7x]

Kwikset smart key locks have plastic in them. I notice that the Kwikset smart key lock in your video has plastic. I've seen and heard that Kwikset smart key locks can be forced open. I wouldn't recommend Kwikset smart key locks.

[@MrBlackMagic]

Me neither. The basic mechanism may be a good idea, but the execution of this build is very faulty.

[@candyquahogmarshmallow8257]

2:30 "shit tip"

[@entropysalvage3546]

Unfortunately your not likely to find these locks in the wild with such a convenient notch filed in them for your tensioning tool 🤪

[@MrBlackMagic]

Unfortunately this sidebar is accessible exactly as shown. I am also not the first person using this kind of bypass on this specific spot. Go grab a Gen 3 and try it yourself buddy.

[@rmsg7504]

@@MrBlackMagic What is shown is a slot in the side of the cylinder. You will not find them that way out in the wild.

[@MrBlackMagic]

@@rmsg7504 that is not true. I am not the only one who used this kind of bypass and the lock setup I had would be implemented in the door exactly as shown (with the notch accessible). I don't know if it is always the case but at least very often.

[@rmsg7504]

@@MrBlackMagic I can see file slot on side of front edge of the face of the cylinder.

[@MrBlackMagic]

​@@rmsg7504 Because this specific lock from the video has been bypassed, picked and tested many times by different pickers, there are of course marks or slightly worn parts. In any case is this part accessible without filing or cutting so the bypass can be applied in most up to all gen3 out there. Go to your hardware store, buy one of those and try it yourself.

[@rmsg7504]

So you have to cut a slot in the side of the cylinder to fit the shims in? Not very practical. I can see the slot you filed or cut in the side of the cylinder on the video.

[@MrBlackMagic]

There is no need to file or cut something to access this slot/notch and apply the shown bypass. This specific lock has been picked, bypassed and tested many times by different pickers so of course there are marks, scratches and slightly worn out parts but that does not affect the bypass itself. you can use this technique in most up to all gen3 in the wild. Go to your hardware store, buy one of those and try it yourself.

[@rmsg7504]

@@MrBlackMagic it's clearly cut or filed NOT wear marks.

[@MrBlackMagic]

@@rmsg7504 go watch some picking videos about the gen3 (for example from panda-frog as he used the same lock, you can see the notch ~2:25; but many other pickers used the same basic technique in their videos), go to the lockpicking reddit or discord and ask about this lock and/or my video, go and buy such a lock and try it yourself. Please try out this suggestions before judging. You will see that this exploit works in general on the kwikset gen3 exactly as i demonstrated.

[@rmsg7504]

@@MrBlackMagic I'm not talking about the technique I'm talking about the filed or dremeled material removed from the front of the cylinder face which is being used to gain access to the side bar. That would not be modified that way in the field it would be round... not notched out.

[@MrBlackMagic]

@@rmsg7504 dude it is not filed or modified no matter what it may look like for you. Go ask in the lockpicking community or buy this lock yourself but I won't argue longer with you about this point