Objective. Students will open a residential or light-commercial safe using at least two approved methods—combination manipulation and controlled drilling—while following all PPE and safety protocols.
This lesson, its worked examples and its practice questions has not yet been verified by a credentialed professional in the field or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.
VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.
Opening a safe without the combination or key is one of the most technical services a locksmith provides. Done correctly, it protects the customer's property and demonstrates professional judgment. Done carelessly, it destroys an expensive asset and creates liability. This lesson covers the two main non-destructive and minimally destructive methods: combination manipulation and controlled drilling with borescope inspection.
Before touching any tool, assess the safe. Identify the rating (fire record safe, Residential Security Container/RSC, TL-rated burglary safe, etc.), the lock group (Group 2, Group 1, Group 1R), and the probable construction materials. A residential fire safe typically has a gypsum or vermiculite-filled body and a relatively simple lock. An RSC has a steel body with hardplate protecting the lock. A TL-rated safe adds relockers, glass plates, and hardened steel throughout. Selecting the wrong method wastes time, damages the safe, and can trigger relockers that make entry far harder.
Always attempt manipulation before drilling. Manipulation is non-destructive, builds diagnostic skill, and is often faster than drilling once you have practiced it.
Safety is non-negotiable. Before any drilling begins:
Combination manipulation exploits the mechanical tolerances built into every combination lock. On a standard Group 2 three-wheel lock, each wheel has a notch (the gate). When all gates align, the fence drops and the bolt retracts. Slight variations in the machining of the drive cam and wheels create detectable resistance changes—called contact points—as the dial turns.
1. Set up: Mount a stethoscope or electronic contact microphone against the dial face or door. Work in a quiet environment.
2. Find the contact area: Rotate the dial slowly. You are listening or feeling for the slight drag where the fence contacts the wheel pack. This defines the working area for your graph.
3. Graph the contact points: For each test number on the dial (typically every two or five graduations), rotate and record where the left contact point (LCP) and right contact point (RCP) occur. Plot them on graph paper with the test number on the X-axis and the contact position on the Y-axis.
4. Read the graph: Each wheel produces a characteristic dip or V-shape in the contact-point plot. The center of that V is the probable wheel position (the gate location).
5. Derive and test the combination: From your graph, identify the three most likely numbers, enter them using standard dialing protocol (right-left-right), and test. Adjust by small increments if the bolt does not retract.
6. Document: Record every test number and result on the manipulation worksheet. This documentation protects you professionally and helps instructors verify your method.
Patience is essential. A complete manipulation on a Group 2 lock typically takes between one and three hours for a student learning the process. Experienced technicians may complete it faster, but rushing produces errors.
When manipulation is not practical—due to time constraints, lock damage, or a lock type that resists manipulation—controlled drilling is used. The goal is to drill the smallest possible hole at a precisely chosen attack point to view or directly actuate the lock mechanism, then repair the hole.
The attack point depends on the lock model and safe construction. Common targets include:
Never guess the attack point. Use manufacturer reference materials, technical manuals, or verified trade references. Drilling the wrong location can trigger glass relockers, damage the locking bolt, or destroy the bolt-work entirely.
1. Mark the attack point with a center punch to prevent bit walking.
2. Start with a small pilot hole (typically 1/8 inch or smaller).
3. Enlarge to the minimum diameter needed for borescope insertion or bolt actuation.
4. Insert the borescope and identify the wheel pack, gate positions, or relocker status.
5. Use a piece of stiff wire or a dedicated pick to align gates or trip the relocker.
6. Once the door is open, document the drill hole on the work-order form, install a repair plug, and report the condition to the customer in writing.
Complete a work order that includes: safe make and model, serial number if visible, method used, attack point location, hole diameter, repair performed, and any internal damage observed. This record protects you legally and serves the customer.
Safe-opening services must only be performed for the verified owner or their authorized agent. Obtain written authorization before beginning work. State licensing requirements for locksmiths often specifically address safe-opening services. Failure to verify ownership exposes you to criminal liability regardless of your technical skill.
Answer each question, then check it. Nothing is recorded; this is your own practice.
A free tech program — complimentary, as our commitment to get America working. Help us build VoTechWorks. Tell us what works, what doesn’t, and what you want to learn.