6,000 Years of Locks: The Complete History of Security

The First Lock Was a Piece of Wood

The oldest known locking mechanism wasn't found in a museum of great engineering — it was found in rubble. Archaeologists excavating Nineveh, the ancient capital of Assyria in what is now northern Iraq, uncovered a wooden pin-tumbler mechanism dating to roughly 4000 BCE. It was enormous, ungainly, and almost comically simple by modern standards. And yet, the principle it used — a set of pins that drop by gravity and can only be lifted by the right key — is still working inside the deadbolt on your door right now.

The basic assembly worked like this: a large wooden bolt passed through a wooden frame fixed to the door. Above the bolt was a housing, and inside that housing lived a row of wooden pins. When the bolt was slid closed, those pins dropped by gravity into pre-drilled holes in the bolt, locking it in place. The key — a large, flat paddle resembling a toothbrush, sometimes over two feet long — had vertical pegs positioned to match each pin. Slide the key in through a hole in the door, lift, and the pegs raised the pins out of the holes, freeing the bolt to slide back. Pull the bolt, and you're in.

Why the Egyptians Made It Work

The technology almost certainly originated in Mesopotamia but reached its highest early form in Ancient Egypt around 2000 BCE. Egyptian society was increasingly built around property and stored grain — the Nile valley was abundant, and abundance creates the need to protect what you've accumulated. Egyptian locks were refined, sometimes elaborately carved, and the keys became social objects. To carry a large lock key was to signal ownership. It told the world: I have something worth protecting.

The mechanism itself, though wooden, was genuinely clever. Multiple pins of varying lengths meant a key with the wrong peg positions simply couldn't lift them all simultaneously — the bolt would stay locked. It was a physical combination lock, predating the term by millennia. The vulnerability was obvious in hindsight: wood splinters, warps, and can be forced with enough violence. The keys were also enormous — not something you'd slip into a pocket. But for grain storage and temple doors in a society without steel tools? It did the job for two thousand years.

Greece Compresses the Key

Greek civilization introduced a critical innovation: the sickle-shaped iron key. Where Egyptian keys were two-foot paddles that required a hole in the door to insert, Greek keys were compact enough to pass through a narrow slot. This solved the portability problem but introduced a new one — a sickle-shaped key is just a bent piece of iron, and any bent piece of iron roughly the right shape could work just as well. Greek locks provided more convenience than security. You could lock the door; you just couldn't be entirely confident it would stay locked.

Rome Changes Everything

The Romans looked at the Greek warded lock and improved it dramatically. Between about 200 BCE and 400 CE, Roman metalworkers developed the first fully metal locks — iron mechanisms with bronze or iron keys — and introduced the concept that would define security for the next fifteen centuries: the ward.

Wards are fixed obstructions inside the lock case. They project from the interior walls and create a maze the key must navigate before it can reach the bolt. The correct key has notches cut into its bit that match the ward pattern precisely, allowing it to pass through cleanly. The wrong key gets stopped cold. This was a genuine advance: it meant the security came from the shape of the key, not just whether a tool was bent in roughly the right direction.

The Ring Key — Security as Status Symbol

The ward design allowed keys to be made small enough to wear as rings — and wealthy Romans did exactly that. A ring key was a flex. It told every person you met that you owned property secured by a metal lock, which was expensive, and that you were important enough to need one. Locks became symbols of social standing well before they became truly effective security devices.

The Romans also independently developed the first portable padlock. Using a spring-tine mechanism — a U-shaped spring shackle that snapped into a hasp — they created a lock you could carry and apply to anything that needed securing. The concept of the portable padlock, unchanged in its basic form, is used in billions of locks today.

When Lockmaking Was Art

After Rome fell, metal locks became the exclusive property of the church and the nobility. The rest of Europe went back to wooden bars. But among the wealthy, iron locks evolved into something extraordinary — not because the mechanism improved, but because the decoration did. Gothic lockmakers in France and Germany turned their craft into an art form so refined that their work now hangs in the Metropolitan Museum of Art and the Louvre.

A 15th-century French iron lock was a masterpiece. Elaborate tracery, miniature architectural facades, carved foliage and figures — all surrounding a mechanism that was, underneath the ornamentation, still basically a warded lock. Security hadn't meaningfully improved since Rome. What had improved was the display of status that the lock represented. A magnificent lock on a great chest said something about its owner. That function hasn't entirely disappeared — look at any luxury hotel room door today and you'll notice they still spend money making the hardware look important.

Security Through Obscurity

Medieval locksmiths did develop one genuinely clever countermeasure for their warded lock problem: they hid the keyhole. Some high-end locks featured spring-loaded shutters, decorative panels that swung aside, or complex sequences of buttons and levers that had to be operated in a specific order before the keyhole was even revealed. One lock type required the user to turn a movable flap, align three rotating discs, and press a recessed button — all before inserting the key.

This was "security through obscurity" — not a stronger mechanism, but a harder-to-find one. It works as long as the attacker doesn't know the sequence. It fails the moment they figure it out. The locksmith community recognized this limitation, but without the metallurgical precision to build truly pick-resistant mechanisms, obscurity was the best tool available. It would remain that way until 1778.

The Era When Locks Became Science

The Industrial Revolution didn't just change how things were made — it changed how people thought about making things. Precision manufacturing, interchangeable parts, scientific methodology applied to design problems. For the first time in history, a locksmith could be an engineer rather than a craftsman, and several of them seized that opportunity with remarkable results. The 90-year period from roughly 1770 to 1860 produced more meaningful advancement in lock security than the previous five thousand years combined.

Robert Barron: The Double-Acting Principle (1778)

In 1778, Robert Barron patented something genuinely new. Previous lever locks — which had existed in crude forms — only required a lever to be lifted to any height above the bolt stump. This was barely better than no mechanism at all, since any tool that lifted the lever high enough would open it. Barron's leap was this: he gave each lever a gate — a slot cut at a precise height. The bolt's stump had to pass through that gate. Lift the lever too little, the stump was blocked below the gate. Lift it too much, the stump was blocked above the gate. Only exactly the right lift height let the stump pass through and allow the bolt to move.

This meant the key had to do precise work on each lever, not just force. An incorrect key or a crude pick tool would move levers to the wrong height and the lock would hold. It was the first time in history that a lock actively penalized imprecision. The concept of "exact required lift" is still the fundamental principle of every quality lever tumbler lock made today.

Joseph Bramah: The 200-Guinea Challenge (1784)

Joseph Bramah went further. In 1784, he patented a cylindrical lock using a completely different mechanism — 18 sliding plates inside a small cylinder, each pushed to an exact depth by a notched tubular key. To open the lock, all 18 sliders had to reach their correct positions simultaneously. The combination of possibilities was, for the time, astronomically large.

Bramah was so confident in his creation — built to tolerances that required new machine tools, designed by his partner Henry Maudslay — that in 1790 he placed a Challenge Lock in his London shop window with a sign: "The artist who can make an instrument that will pick or open this lock shall receive 200 Guineas the moment it is produced." 200 guineas was roughly two years' wages for a skilled worker. The lock sat in that window for 67 years. It became the most famous lock in the world. It was also, as the world would discover in 1851, not actually unpickable.

The Chubb Detector Lock (1818)

Jeremiah and Charles Chubb took a different philosophical approach. Rather than trying to make a lock that couldn't be picked, they made one that would tell you it had been attempted. Their 1818 Detector lock included an additional lever — the detector lever — that set itself in a locked position if any lever was raised too high. If a burglar spent hours probing the mechanism, the owner would return home to find the lock jammed and inoperable. Only the original key, or a special regulating key, could reset the detector. The lock had been forensically flagged.

The Chubb Detector won a British government competition for prison lock security and became the standard for serious applications throughout the 19th century. Its underlying innovation — using the picking attempt itself as the trigger for increased security — was genuinely brilliant. Modern "security pins" (spool pins, serrated pins) operate on a similar philosophical basis: they create false feedback that traps a picker who doesn't know what they're dealing with.

1851: The Day the Myth Died

The Great Exhibition of 1851 was meant to celebrate British engineering supremacy. It succeeded — except in one corner of the Crystal Palace, where Alfred Charles Hobbs, an American locksmith representing a New York company, was quietly dismantling the industry's most cherished myths.

Hobbs first approached a Chubb Detector lock. In front of official witnesses at the Great Exhibition, he picked it open in 25 minutes, then relocked it in 7 minutes — bypassing the detector lever entirely. The industry was shaken. But it got worse. Hobbs then turned to the Bramah Challenge Lock — the one that had sat in a London window for 61 years. Working in private, with sessions observed and sealed between visits to prevent cheating, Hobbs spent 51 hours over 16 days with a specialized set of custom tools. On August 23, 1851, he opened it.

This moment — known as the Great Lock Controversy — permanently changed the philosophy of security. The industry stopped talking about "unpickable" locks and started talking about "resistance time." How long can this lock hold against a skilled, equipped, determined attacker? That's still the right question. The Abloy Protec2 we recommend on this site doesn't claim to be unpickable. It claims to take so long that the attacker gives up and goes somewhere easier. Hobbs understood this in 1851. Some manufacturers are still pretending otherwise.

An American Looks at an Egyptian Lock and Sees the Future

While the British were fighting over lever tumblers, an American named Linus Yale Sr. looked at the ancient Egyptian pin-tumbler mechanism and realized it hadn't been finished yet. The concept was right. The execution was wrong. If you applied industrial precision to the pin-tumbler principle — machined cylinders, tight tolerances, hardened steel — you could create something far more practical and scalable than any lever lock.

Linus Yale Sr. began experimenting in the 1840s. His son, Linus Yale Jr., took the work further. In 1861, Yale Jr. patented the modern cylindrical pin-tumbler lock — a small cylindrical plug inside a cylindrical housing, with pins split at a shear line, activated by a flat serrated key. The key had varying cut depths; each depth corresponded to a pin of different length. All pins had to align at the shear line simultaneously for the plug to rotate. If even one pin was wrong, the cylinder was locked solid.

The Flat Key: Security That Fits in Your Pocket

The flat, serrated key was Yale Jr.'s other masterstroke. Before Yale, keys were bulky bits of iron — heavy, awkward, not something you'd want to carry all day. Yale's flat key was thin, light, and cheap to stamp from sheet metal. It could be mass-produced. It could be duplicated by any hardware store with the right blank. And it carried the security of the mechanism in those tiny cut depths — thousandths of an inch of difference between a key that works and one that doesn't.

In 1868, Yale Jr. partnered with Henry Towne to form the Yale & Towne Manufacturing Company in Stamford, Connecticut. Within a generation it was the largest lock manufacturer in the world. By the 1920s, the company employed over 12,000 people. The Yale pin-tumbler cylinder lock had become the global standard for residential security — and it remains so today, though the security of any given implementation varies wildly.

Schlage Reinvents the Installation

In 1920, Walter Schlage — a San Francisco inventor — looked at how locks were installed in doors and decided the whole approach was wrong. The standard of the time required a lock to be mortised into the door edge: a complex installation requiring a skilled carpenter and significant door modification. Schlage patented the bored cylindrical lock, which needed only a round hole drilled through the door face and a smaller hole in the door edge. No specialist required. A homeowner with a drill could install it in an afternoon.

His push-button "A" series lock — the one with a button in the center of the interior knob — became the definitive American household lock design. It's still in production. The Schlage B60N deadbolt, which we recommend on this site as the best value residential deadbolt available, is a direct descendant of that 1920 innovation.

Finland Invents the Disc Detainer: Abloy (1907)

In Finland, Emil Henriksson had a different problem: springs. Every pin-tumbler lock on the market depended on springs to return pins to the locked position. Springs corrode. Springs freeze. Springs fail in extreme cold, in marine environments, in the kind of Finnish winter that makes Canadian winters look mild. Henriksson noticed the rotating disc mechanism in cash registers and adapted it for locks.

The Abloy disc detainer mechanism — patented between 1907 and 1919 — uses rotating discs instead of spring-loaded pins. The discs have notches cut at specific angles. The correct key rotates each disc to its precise position; when all discs are aligned, their gates line up and allow the lock cam to rotate. No springs means no spring failures. The mechanism is impervious to freezing and highly resistant to debris. Abloy locks became the preferred choice for critical infrastructure, shipping containers, outdoor installations, and environments where a spring-pin lock would simply fail.

Medeco Adds a Third Dimension (1968)

By the 1960s, the pin-tumbler cylinder had been picked, bumped, and raked by enough people that the security community knew it had a fundamental vulnerability. The binding principle — the fact that pins under torque set sequentially rather than simultaneously — was the problem. Standard security pins helped, but the core attack surface remained.

In 1968, Medeco introduced a solution: rotating pins. Their high-security cylinder didn't just require pins to be lifted to the correct height — each pin also had to be rotated to a specific angle. The key had angled cuts that both lifted and twisted each pin. When all pins were at the correct height AND angle, a sidebar dropped into grooves on the sides of the pins, allowing rotation. Two independent security systems working simultaneously. Picking in the traditional sense required setting both height and angle on each pin — exponentially more complex than a standard cylinder.

The combination of height, angle, and sidebar gave Medeco cylinders a theoretical combination count in the billions. It also made them virtually immune to bump keys, which could only address the height dimension. Medeco became the preferred lock for US embassies, government facilities, and high-security commercial applications.

The Pick-Attack Arms Race

Every advance in lock security came as a direct response to a picking technique. Understanding the attacks explains the defenses:

Single Pin Picking (SPP) exploits the binding order. Under light torque, one pin binds more than the others. The picker feels this, sets it, moves to the next. High-security locks use spool or serrated pins that create a false set — the pin feels set but isn't, trapping an inexperienced picker.

Raking bounces a serrated pick over multiple pins at once, setting them by chance. High-security cylinders use tight keyway bittings that prevent rake picks from reaching all pins simultaneously.

Bump keys use a specially cut key struck with a mallet. The kinetic energy travels up the key pins, momentarily launching the driver pins above the shear line. Anti-bump pins with internal springs, or secondary locking mechanisms like sidebars, defeat this. A Medeco cylinder cannot be bumped. An Abloy disc detainer cannot be bumped — there are no pins to launch.

Impressioning requires the attacker to use a blank key in the lock, then look at the marks left by the pins, and file the blank to match. High-security keyways and rotating pin designs make this extremely difficult. Key control — restricted keyways that only authorized dealers can cut — prevents unauthorized key duplication entirely.

The Hotel that Started the Revolution

In 1976, a Norwegian inventor named Tor Sørnes filed a patent for a mechanically recodable card lock. Rather than metal keys, guests would use a card with a pattern of holes or magnetic data that could be changed between guests. In 1979, the Westin Peachtree Plaza Hotel in Atlanta installed the world's first electronic keycard system. You could manage thousands of rooms from a single computer. A lost key became a deactivated card, not a rekeying emergency. The era of physical key management for large facilities was over.

This evolved into magnetic stripe cards through the 1980s and 1990s, then RFID cards, then NFC chips. The credential shifted from "what shape metal do you have" to "what data does your card contain." The lock became electronic rather than purely mechanical — though most hotel locks retained a mechanical backup that you never see but that's there if the power fails.

Biometrics: From "What You Have" to "Who You Are"

The history of security credentials follows a three-stage pattern. First came something you have (a physical key). Then came something you know (a PIN or code). The third stage — still unfolding — is something you are: a biometric. Your fingerprint, your face, the pattern of your iris, the geometry of your hand.

First-generation fingerprint readers used optical sensors: a camera photographed your fingerprint and compared the 2D image against a stored template. These worked reasonably well but could be fooled by a high-resolution photo of your fingerprint printed on transparent film and pressed against the sensor. Not easy to do, but definitely done.

Second-generation capacitive sensors measure the electrical difference between the ridges and valleys of your fingerprint. They read the actual texture of the skin rather than its image. These are what's in your phone, and they're significantly harder to spoof.

Third-generation ultrasonic sensors — currently found in high-end phones and commercial security systems — use sound waves to map the 3D structure of the fingerprint, including sub-surface tissue. A silicone mold of your fingerprint won't fool one, because it lacks the biological sub-surface pattern. These are genuinely close to a security ceiling in biometric terms.

Smart Locks and Wireless Protocols

The modern smart lock is a computer with a deadbolt attached. It communicates with your phone, your home hub, your cloud service, and increasingly other smart home devices. This creates capabilities that were unimaginable a decade ago — temporary digital keys sent to your contractor, automatic locking when your phone leaves the geofence, full audit logs of every entry — and it creates new attack surfaces that a pin-tumbler cylinder never had to worry about.

The New Attack Surface

A smart lock introduces something no Egyptian, Roman, or Victorian locksmith had to think about: remote attack vectors. A skilled attacker can't pick a Schlage Encode Plus with a tension wrench — but they might attempt a replay attack, capturing the Bluetooth or RF signal used to unlock the lock and replaying it later. They might compromise the cloud server that manages temporary keys. They might exploit a firmware vulnerability in the lock itself. None of these require being anywhere near your door.

Manufacturers have responded with AES-128 and AES-256 encryption, rolling codes (where each unlock command is unique and a captured code can't be reused), and multi-factor authentication requiring both the app and a physical button press. These measures are effective against casual attackers. The sophisticated ones remain a problem that the industry is still solving. The physical cylinder — that pin-tumbler backup — is currently still the most reliable part of most smart locks.