How to Shim a Padlock — Bypass Guide

Walk into any hardware store, pick up the padlock hanging on the display hook — the $8 one, the $15 one, probably the $25 one too — and there's a good chance it can be opened in under ten seconds without a key, without picking a single pin, and without leaving any obvious sign of entry. That's shimming. It's not new, it's not exotic, and it doesn't require any skill. Just a thin piece of metal and the knowledge that the vulnerability exists.

The reason this works on so many locks comes down to a fundamental design choice that most budget padlocks share: a spring-loaded pawl that grips the shackle. That pawl is the entire security mechanism. And it has a weakness that a shim exploits directly.

💡

What makes this bypass, not picking

Picking interacts with the key cylinder — the pins, the plug, the shear line. Shimming ignores all of that completely. The keyway is irrelevant. The cylinder could be the most secure in the world and it wouldn't matter. You're attacking the shackle retention mechanism, not the lock.

The Mechanism

Why the spring pawl is a design flaw waiting to be exploited

Most padlocks secure the shackle using one or two spring-loaded pawls — small metal tabs that snap into a notch cut into the shackle heel when the lock closes. The spring pushes the pawl into the notch. The notch holds the shackle down. That's the whole system.

The vulnerability is geometric. The shackle notch is open at one side — it has to be, because the shackle needs to enter it when you close the lock. That means the pawl is sitting in a groove that something thin and stiff can slide into from the shackle gap. When the shim rides down the side of the shackle and contacts the pawl, it pushes the pawl back against its spring, exactly as a key would when unlocking. The notch empties. The shackle pulls free.

"The keyway could be the most secure cylinder ever made and it wouldn't matter. You're not touching it."

This is the key insight: the spring is doing all the work for you. It's designed to compress when something pushes against it — that's how the lock closes in the first place. The shim just does the same thing from the other direction.

Cutaway showing shim riding shackle into pawl notch

The two-pawl problem

Most padlocks that use this system have a pawl on each side of the shackle — one for each shackle leg. This means you typically need two shims working simultaneously, one down each side of the shackle. In practice this just means cutting two shims and inserting them at the same time. It's still very fast. Some cheaper locks only have a single pawl on one leg, which makes it even quicker.

Attack Surface

Shackle heel notch

Key Cylinder

Never touched

Noise

Silent

The Tools

A soda can is genuinely all you need

This is one of those situations where the cheapest possible option works just as well as a commercial tool. Aluminium from a drinks can is thin enough, stiff enough, and has a natural curl that makes it easier to work with. People have been doing this for decades. Here's what you can use:

🥤

Aluminium from a soda can

Free

Cut the top and bottom off an empty can, then cut a strip about 1cm wide and 6–8cm long. Round off the corners with scissors so it doesn't snag. The natural curl of the can gives the shim a slight hook shape which actually helps it seat in the shackle gap. This is the classic method and it genuinely works well. The metal is the right thickness — thin enough to fit, stiff enough to push the pawl.

🔧

Commercial shim tool

~$10–15 for a set

Purpose-made shims are available from locksport suppliers like Sparrows and Multipick. They're pre-cut to the correct width, pre-notched, and made from thinner spring steel that seats more reliably. The notch at the tip helps the shim grab the pawl rather than sliding past it. Worth having if you want something repeatable and consistent, but the soda can method works on a surprising number of locks.

✂️

Cutting your own — the shape matters

The shim needs to be narrow enough to fit down the gap between the shackle and the lock body, and long enough to reach the pawl. For most padlocks that's about 6–8mm wide and 50–70mm long. A small notch or hook at the tip helps it catch the pawl rather than sliding straight past. Scissors work fine for aluminium can material.

Which Locks Are Vulnerable

If it has a spring pawl, assume it's shimmable

The list of vulnerable locks is unfortunately very long. The spring pawl design is cheap to manufacture and widely used across virtually all budget and mid-range padlocks. If a padlock doesn't explicitly state "double-locking," "anti-shim," or "ball bearing locking" — and sometimes even if it does — it's worth assuming the spring pawl is there.

Here are some of the most common locks you'll encounter and how they fare:

Master Lock No. 3

Vulnerable

The iconic brass padlock found everywhere. Single spring pawl. Shims in seconds. One of the most documented shim targets in locksport.

Master Lock No. 140

Vulnerable

Budget combination padlock series. Spring pawl locking. Widely used on lockers, storage units, and gym bags.

Brinks Home Security

Vulnerable

Widely sold at hardware stores. Most models in the standard line use spring pawl retention. Opens easily with a soda can shim.

Master Lock 930D

Vulnerable

Laminated steel body padlock often used for sheds and gates. Looks substantial but uses single spring pawl. The body hardness is irrelevant to shimming.

Generic/unbranded padlocks

Very Vulnerable

Anything without a brand, sold in multipacks or at discount stores. Almost universally spring pawl. Often single-pawl. These fall to a shim immediately.

Master Lock Speed Dial

Check Model

Some models in this line use ball bearing locking. Verify before assuming — the more expensive variants are resistant.

📍

Real-world context

These locks show up on storage units, garden sheds, bike chains, school lockers, gym bags, trailers, and gates. Budget padlocks are everywhere. The fact that shimming is this easy and this widespread is a genuine security problem — most people have no idea their lock can be opened faster than it can be picked.

How It's Done

Step by step

This is the basic process for shimming a spring pawl padlock. The whole thing takes under thirty seconds to learn and under ten seconds to execute once you have the feel for it.

1

Open the shackle fully

The lock needs to be in the closed position but with the shackle raised as high as it will go. This opens the gap between the shackle and the lock body to its maximum width, giving the shim room to enter. On most locks this means pulling the shackle up after closing.
2

Insert the shim into the gap

Slide the shim into the gap between the shackle leg and the lock body with the tip pointing downward. The shim should travel alongside the shackle, not between the two shackle legs. You're going down the same channel the shackle sits in.
3

Push down while pulling the shackle up

Push the shim downward firmly while applying upward pressure on the shackle. The shim tip will contact the spring pawl and begin to push it back. You'll feel a slight resistance then a give — that's the pawl clearing the notch. On locks with two pawls, insert shims on both sides and work them simultaneously.
4

Shackle pulls free

Once both pawls are cleared, the shackle pulls out under the upward pressure you're already applying. The lock is open. The key cylinder is untouched. On most budget locks this entire process takes under ten seconds once you know what you're doing.

⚠️

Does it leave marks?

Yes — shimming leaves scratches on the shackle heel and inside the shackle channel where the metal scrapes against the pawl. It's significantly more covert than cutting the lock off, but it's not traceless. A close inspection will show marks. If you're testing your own locks, that's worth knowing.

What Stops It

Two designs defeat shimming completely

There's no trick to defeating shimming — it just requires a lock that was designed with this attack in mind. There are two main approaches, and both work by removing the thing the shim needs to push against.

Ball bearing locking

Instead of a flat spring-loaded pawl that sits in a notch, ball bearing designs use steel balls that seat into a recess on the shackle. A shim physically cannot depress a steel ball — the geometry doesn't allow it. The shim tip arrives at a curved surface and has nothing to lever against. This is a true design fix, not just a harder-to-shim version of the same mechanism. Locks using ball bearing shackle retention are immune to this attack.

True double-locking (anti-shim)

This is different from a lock simply having two pawls — two pawls just means you use two shims, one down each side, which is standard technique and barely harder. True double-locking means the key releases a secondary element that physically blocks the pawl from moving at all. The shim arrives at the pawl, pushes against it, and the pawl doesn't move because something behind it is holding it in place. Without the key releasing that blocker first, the pawl is immovable from the shackle side. Locks genuinely marked "double-locking" or "anti-shim" use this mechanism — though the quality of implementation varies between brands.

We're only listing locks we're confident about. Anti-shim marketing claims and actual mechanism design don't always match — always verify your specific model before relying on it.

Mul-T-Lock MT5+

Resistant

Ball bearing locking — well documented and consistent across production runs. The shim has no flat pawl surface to depress. Shimming is not a viable attack.

Abloy Protec2

Resistant

Disc detainer mechanism — no spring pawl exists anywhere in the design. There is nothing for a shim to interact with. Immune by design, not just by implementation.

⚠️

Why we kept this list short

A lot of locks are marketed as "anti-shim" or "double-locking" and the claims don't always hold up — especially on older production runs or budget implementations of the feature. Rather than list six locks and get one wrong, we've kept it to two we're certain about. If you know your specific lock is genuinely resistant, trust your own testing over any list.

The Takeaway

What you actually need to know

If your padlock cost under $20 and doesn't specifically say "double-locking," "anti-shim," or "ball bearing," assume it can be shimmed. This covers the majority of padlocks protecting sheds, storage units, gym lockers, bike chains, and gates right now. Not because the people using them are careless — but because the hardware is genuinely, fundamentally insecure against this attack and it isn't advertised.

The fix is buying a lock where the shim has nothing to push against — either ball bearing locking or a true double-locking mechanism where the pawl can't move without the key. Don't rely on marketing language alone. Test it yourself or look for documented locksport testing on your specific model and production run.

The $8 padlock is better than no padlock for deterring casual opportunists who don't know this technique exists. The moment someone knows about shimming, it's not a lock — it's decoration.

Attack Difficulty

Very Easy

Time Required

Under 10 sec

Tool Cost

$0 (soda can)

Shimminga Padlock

Why the spring pawl is a design flaw waiting to be exploited

The two-pawl problem

A soda can is genuinely all you need

If it has a spring pawl, assume it's shimmable

Step by step

Two designs defeat shimming completely

Ball bearing locking

True double-locking (anti-shim)

What you actually need to know

Shimming
a Padlock