(9 votes, average: 5.00 out of 5)

## How to crack the Ultra Hardware push button lock from Amazon

As Scott points out, this rugged, sturdy lock is secure in looks only. Their claim of thousands of combinations are in fact only 252 and can be compromised in about 5 minutes. Here’s his analysis:

I thought I’d warn people that, despite its sturdy feel, it uses relatively weak security. Using it on the gate to the backyard is probably fine, as a deterrent, but using it to protect valuables is a bad idea.

The packaging mistakenly states there are 100,000 possible combinations, while in reality there are many fewer. There are only ten buttons, which can each be depressed once or not. That means there are a total of 2 to the tenth possible combinations, which is only 1024. Worse, since the lock only supports 5 digit combinations, that reduces the total number of possible combinations to 252. That means that if someone tried 30 combinations per minute (2 seconds each), they would necessarily solve it within 8 and a half minutes, and likely within 5 minutes.

Also, the combination is set at the factory and cannot be changed, which isn’t a huge deal, but might irritate some, as it prevents you from changing the combination periodically.

After someone commented erroneously that it indeed has 100,000 combinations, Scott continued to explain:

“What you’re saying *would* be true *if*:

1. the digits could be reused, and if
2. the order of the digits mattered. Sadly, neither of those criteria are met in the case of this lock.

In other words:

1. you cannot have a combination of 7-7-7-7-7, or even 7-1-2-3-7, because the 7 button can only be pressed once in any combination, and likewise for the other digits. And
2. the combinations 1-2-3-4-5 and 5-4-3-2-1 and 4-2-5-3-1 are all equivalent, because it’s only the final state of the lock that matters, not the order in which you pressed its buttons.

It’s like picking lottery numbers — each number can be picked only once, and the sequence doesn’t matter, which intuitively reduces the number of viable combinations. Perhaps surprisingly, it massively reduces them.

Those two facts change the way you have to do the math. Instead of a “permutation with repetition,” (or sometimes called “permutation with replacement”), as you suggested, it’s really a “combination with no repetition,” which you can read about on Wikipedia or other math sources covering “permutation vs. combination.” So, instead of 100,000 possible permutations, there really are just 252 combinations.

The equation changes from: 10 to the 5th power, instead to: 10 factorial divided by all of 5 factorial times 5 factorial, which looks something like this:

$\frac{(10\times9\times8\times7\times6\times5\times4\times3\times2\times1)}{(5\times4\times3\times2\times1)\times(5\times4\times3\times2\times1)} = 252$

### Here are all the possible combinations:

{0,1,2,3,4}  {0,1,2,3,5}  {0,1,2,3,6}  {0,1,2,3,7}  {0,1,2,3,8}  {0,1,2,3,9}  {0,1,2,4,5}  {0,1,2,4,6}  {0,1,2,4,7}
{0,1,2,4,8}  {0,1,2,4,9}  {0,1,2,5,6}  {0,1,2,5,7}  {0,1,2,5,8}  {0,1,2,5,9}  {0,1,2,6,7}  {0,1,2,6,8}  {0,1,2,6,9}
{0,1,2,7,8}  {0,1,2,7,9}  {0,1,2,8,9}  {0,1,3,4,5}  {0,1,3,4,6}  {0,1,3,4,7}  {0,1,3,4,8}  {0,1,3,4,9}  {0,1,3,5,6}
{0,1,3,5,7}  {0,1,3,5,8}  {0,1,3,5,9}  {0,1,3,6,7}  {0,1,3,6,8}  {0,1,3,6,9}  {0,1,3,7,8}  {0,1,3,7,9}  {0,1,3,8,9}
{0,1,4,5,6}  {0,1,4,5,7}  {0,1,4,5,8}  {0,1,4,5,9}  {0,1,4,6,7}  {0,1,4,6,8}  {0,1,4,6,9}  {0,1,4,7,8}  {0,1,4,7,9}
{0,1,4,8,9}  {0,1,5,6,7}  {0,1,5,6,8}  {0,1,5,6,9}  {0,1,5,7,8}  {0,1,5,7,9}  {0,1,5,8,9}  {0,1,6,7,8}  {0,1,6,7,9}
{0,1,6,8,9}  {0,1,7,8,9}  {0,2,3,4,5}  {0,2,3,4,6}  {0,2,3,4,7}  {0,2,3,4,8}  {0,2,3,4,9}  {0,2,3,5,6}  {0,2,3,5,7}
{0,2,3,5,8}  {0,2,3,5,9}  {0,2,3,6,7}  {0,2,3,6,8}  {0,2,3,6,9}  {0,2,3,7,8}  {0,2,3,7,9}  {0,2,3,8,9}  {0,2,4,5,6}
{0,2,4,5,7}  {0,2,4,5,8}  {0,2,4,5,9}  {0,2,4,6,7}  {0,2,4,6,8}  {0,2,4,6,9}  {0,2,4,7,8}  {0,2,4,7,9}  {0,2,4,8,9}
{0,2,5,6,7}  {0,2,5,6,8}  {0,2,5,6,9}  {0,2,5,7,8}  {0,2,5,7,9}  {0,2,5,8,9}  {0,2,6,7,8}  {0,2,6,7,9}  {0,2,6,8,9}
{0,2,7,8,9}  {0,3,4,5,6}  {0,3,4,5,7}  {0,3,4,5,8}  {0,3,4,5,9}  {0,3,4,6,7}  {0,3,4,6,8}  {0,3,4,6,9}  {0,3,4,7,8}
{0,3,4,7,9}  {0,3,4,8,9}  {0,3,5,6,7}  {0,3,5,6,8}  {0,3,5,6,9}  {0,3,5,7,8}  {0,3,5,7,9}  {0,3,5,8,9}  {0,3,6,7,8}
{0,3,6,7,9}  {0,3,6,8,9}  {0,3,7,8,9}  {0,4,5,6,7}  {0,4,5,6,8}  {0,4,5,6,9}  {0,4,5,7,8}  {0,4,5,7,9}  {0,4,5,8,9}
{0,4,6,7,8}  {0,4,6,7,9}  {0,4,6,8,9}  {0,4,7,8,9}  {0,5,6,7,8}  {0,5,6,7,9}  {0,5,6,8,9}  {0,5,7,8,9}  {0,6,7,8,9}
{1,2,3,4,5}  {1,2,3,4,6}  {1,2,3,4,7}  {1,2,3,4,8}  {1,2,3,4,9}  {1,2,3,5,6}  {1,2,3,5,7}  {1,2,3,5,8}  {1,2,3,5,9}
{1,2,3,6,7}  {1,2,3,6,8}  {1,2,3,6,9}  {1,2,3,7,8}  {1,2,3,7,9}  {1,2,3,8,9}  {1,2,4,5,6}  {1,2,4,5,7}  {1,2,4,5,8}
{1,2,4,5,9}  {1,2,4,6,7}  {1,2,4,6,8}  {1,2,4,6,9}  {1,2,4,7,8}  {1,2,4,7,9}  {1,2,4,8,9}  {1,2,5,6,7}  {1,2,5,6,8}
{1,2,5,6,9}  {1,2,5,7,8}  {1,2,5,7,9}  {1,2,5,8,9}  {1,2,6,7,8}  {1,2,6,7,9}  {1,2,6,8,9}  {1,2,7,8,9}  {1,3,4,5,6}
{1,3,4,5,7}  {1,3,4,5,8}  {1,3,4,5,9}  {1,3,4,6,7}  {1,3,4,6,8}  {1,3,4,6,9}  {1,3,4,7,8}  {1,3,4,7,9}  {1,3,4,8,9}
{1,3,5,6,7}  {1,3,5,6,8}  {1,3,5,6,9}  {1,3,5,7,8}  {1,3,5,7,9}  {1,3,5,8,9}  {1,3,6,7,8}  {1,3,6,7,9}  {1,3,6,8,9}
{1,3,7,8,9}  {1,4,5,6,7}  {1,4,5,6,8}  {1,4,5,6,9}  {1,4,5,7,8}  {1,4,5,7,9}  {1,4,5,8,9}  {1,4,6,7,8}  {1,4,6,7,9}
{1,4,6,8,9}  {1,4,7,8,9}  {1,5,6,7,8}  {1,5,6,7,9}  {1,5,6,8,9}  {1,5,7,8,9}  {1,6,7,8,9}  {2,3,4,5,6}  {2,3,4,5,7}
{2,3,4,5,8}  {2,3,4,5,9}  {2,3,4,6,7}  {2,3,4,6,8}  {2,3,4,6,9}  {2,3,4,7,8}  {2,3,4,7,9}  {2,3,4,8,9}  {2,3,5,6,7}
{2,3,5,6,8}  {2,3,5,6,9}  {2,3,5,7,8}  {2,3,5,7,9}  {2,3,5,8,9}  {2,3,6,7,8}  {2,3,6,7,9}  {2,3,6,8,9}  {2,3,7,8,9}
{2,4,5,6,7}  {2,4,5,6,8}  {2,4,5,6,9}  {2,4,5,7,8}  {2,4,5,7,9}  {2,4,5,8,9}  {2,4,6,7,8}  {2,4,6,7,9}  {2,4,6,8,9}
{2,4,7,8,9}  {2,5,6,7,8}  {2,5,6,7,9}  {2,5,6,8,9}  {2,5,7,8,9}  {2,6,7,8,9}  {3,4,5,6,7}  {3,4,5,6,8}  {3,4,5,6,9}
{3,4,5,7,8}  {3,4,5,7,9}  {3,4,5,8,9}  {3,4,6,7,8}  {3,4,6,7,9}  {3,4,6,8,9}  {3,4,7,8,9}  {3,5,6,7,8}  {3,5,6,7,9}
{3,5,6,8,9}  {3,5,7,8,9}  {3,6,7,8,9}  {4,5,6,7,8}  {4,5,6,7,9}  {4,5,6,8,9}  {4,5,7,8,9}  {4,6,7,8,9}  {5,6,7,8,9}


UPDATE
Scott has added an efficient way to cycle through the numbers for resolving a correct combination for the Ultra Hardware push button lock. Check out this table that could help crack this lock quickly.

Ultra Hardware push button lock from Amazon

## Discussion

### 8 Responses to “How to crack the Ultra Hardware push button lock from Amazon”

1. And that’s not the only way they’re insecure either if you put pressure on the locking mechanism properly only the correct numbers will press all the way down

Posted by Douglas Fuoco | August 31, 2019, 9:00 AM
2. Why not just divide by 1? Seems counter productive to multiply 5 numbers bracketed by the same 5 numbers bracketed which will always be 1

Posted by Douglas Fuoco | August 31, 2019, 8:59 AM
3. Ur amazing my man!
Hahahaha
u realy cracked me off!
I finally opene it!
Thanky man!.. .
XD

Posted by sofe | March 15, 2016, 8:35 AM
4. 252 is the right answer. just use the formula, as M.Dionne said.Note that these locks are insecure, given the limited number of combinations, only if whoever tries to break the code can run through the combinations systematically, without repetition or omission. In practice not so easy, and I think it would take longer than 8.5 minutes. Note, too, that push-button locks with customisable code setting are far more secure, because the number of possible combinations is greatly increased.

Posted by laurence peddle | January 29, 2016, 11:51 AM
5. In response to Not A Math Wize, the formula for “8 choose 4” in statistics parlance would be:

n! / ( n! times ( n – r )! )

where n is the number of buttons, and r is the length of the combination. The exclamation point means factorial, so n! means “the product of all the numbers from n down to 1”. For ease of typing, / means divide, and * means multiply. So populated, the formula is:

8! / ( 4! * ( 8 – 4 )! )

Which reduces to: 40320 / ( 24 * 24 )
Which further reduces to: 40320 / 576

and finally equals: 70

There are a total of 70 possible combinations for the luggage lock with 8 total buttons and combinations of length 4. At a few seconds per attempt, this lock could be defeated in just a few minutes.

Here’s a version of the solution chart for this particular luggage lock:

http://eosync.com/combos.html?digits=8&comboLen=4&columns=5

This lock could probably be considered reasonably safe from particularly small, impatient or disinterested children. =)

Posted by Scott | March 5, 2015, 1:07 PM
6. They also sell 8 button 1-8 versions with 4 digest passwords… How do I figure out how many possibilities?

Posted by Not a math wize | March 3, 2015, 9:25 PM
7. “CRACK-ing Stuff Guys..!. Although I’m now nursing the Bigest Thumb ever thanks to my Combination Position being only several from last.. How so very Frustrating when I’d planned to start from the end in the first place :/(.. Anyways all said and done I’m now ready to start using my Combi lock to protect my Prize Possessions from those un-ruly people called “THIEF’S”.. Thanks Mr Johnny5

Posted by Johnny5 Critch... | June 9, 2014, 5:07 PM
8. The formula is
n! / (r! x (n-r!))
10! / (5! x 5!)
which I compute as 252 combinations.

Posted by M. Dionne | January 10, 2014, 1:15 PM