# Is there a system to brute force a combination padlock?

Our escape room recently acquired some old lockers with a couple of these combination padlocks on them. Unfortunately, the seller didn't know the code.

Is there a mathematical system in cycling through the possible solutions? The code is 5 of the numbers between 0 and 9. The order of the numbers doesn't matter and each number can only appear once, which should narrow it down a lot.

• There are 15120 possible combinations if no number repeats. Otherwise, there are 387420489 of them. – Napoleon of Puzzling Dec 21 '17 at 14:58
• I suppose you could start by trying to analyse which keys seem more worn out, or seem to have more fingerprints, or just seem softer to press. That might give you a starting point in narrowing down which numbers are more likely to be a part of the combination. Once you can narrow those down to 5, it's a very simple process to try different combinations of those numbers – HugoBDesigner Dec 21 '17 at 14:59
• @NapoleonofPuzzling Is it really that many? Even when considering that there's no difference between 12345 and 54321? – Ravn Dec 21 '17 at 15:01
• If the order does not matter, then there are only $10!/(5!^2)=252$ possibilities. That should be easy to cycle through in twenty minutes or so. – Jaap Scherphuis Dec 21 '17 at 15:04
• If my understanding is correct, 5 keys must be down for the lock to open up. That narrows your possibilities down quite significantly, and if my hand-made combination sequences are accurate enough, it'll be only 128 different combinations to go through: pastebin.com/RZxQkqen – HugoBDesigner Dec 21 '17 at 15:12

Because we want to choose 5 of 10 digits, there will be $${10 \choose 5} = \frac{10!}{5!5!} = 252$$ possibilities.

Now the fun part is how do we do the bruteforce? To minimize the time taken, we can arrange the combinations in such a way that the different digit between each two combinations is only 1 (e.g. after 01234 then can be 01235 or 91234.)

Using lexicographical order doesn't satisfy it as 01239 will goes to 01243 (it changed 2 digits.) To make it efficient, I have written a simple program that generate a possible sequence of 252 combination such that the different digit between each two combinations is only 1.

The program is here: program

And the result is here: result

Some excerpts:

1: 56789
2: 46789
3: 45789
4: 45689
5: 45679
6: 45678
7: 35678
8: 35679
9: 35689
10: 35789
11: 36789
12: 34789
13: 34689
14: 34679
15: 34678
16: 34578
17: 34579
18: 34589
19: 34569
20: 34568
21: 34567
22: 24567
23: 24569
...


Bonus: If above list doesn't open the lock, then maybe it's not 5 of 10. Can be 4 of 10 or 6 of 10. In that case, update the value of N in my program and run it. For example, using #define N 4.

I guess, changing exactly one digit (therefore "pushing" two digits -- push out removed digit, pushed in new digit) and test the lock requires around 3 seconds. Therefore the time taken will be $252 \times 3 \approx 13~minutes$.

• After cycling through all 252 5-digit combinations and 192 of the 210 4-digit combinations, the first of the two locks finally opened (0157 was the code)! Thank you so much for the help, that program was amazingly helpful! – Ravn Dec 22 '17 at 12:38