Safe Autodialers
A Comprehensive Comparison

By Locksport.net · Published 2 October 2026 · Updated 3 October 2026

What is a safe autodialer?

A safe autodialer is a robotic device that attaches to a mechanical combination lock dial and systematically tests combinations until it finds the correct one and opens the lock. The device typically consists of a motor (usually a stepper motor), a gripper or chuck that couples to the dial, a microcontroller to manage the dialing sequence, and sometimes sensors to detect when the lock opens.

Autodialers are used by locksmiths for non-destructive safe opening when the combination has been lost, forgotten, or when a safe needs to be accessed after the owner's death. They are also of significant interest within the locksport community as examples of mechanical automation applied to physical security.

A standard three-wheel Group 2 combination lock has approximately one million theoretical combinations (100 x 100 x 100). In practice, a Group 2 lock is allowed to open when each number is up to 1.25 graduations away from the true value (1.5 on a 4-wheel lock), so autodialers step through the dial in increments (commonly 2 to 2.5) rather than testing every number. At a step of 2.5 the keyspace drops to 64,000 (40 x 40 x 40), which is why manufacturers quote full coverage in under 30 hours of continuous operation. Many locks open much sooner. Some autodialers incorporate smart dialing strategies that prioritise factory defaults, common patterns, and statistically likely combinations before resorting to a full brute-force search.

Autodialers vs auto-manipulators

The devices in this article fall into three broad categories:

• Autodialers brute force the combination. They dial candidate combinations one after another and stop when the lock opens. They need no feedback from the lock other than knowing when it has opened.
• Auto-manipulators automate the manipulation technique used by skilled safe technicians. They measure the drive cam contact points (or similar mechanical feedback) from many starting positions, graph the results to find the wheel gates, and so recover the combination far faster than brute force.
• Manipulation assistants sit between the two. A human still turns the dial, but an encoder and software record contact points precisely and generate the graphs automatically.

Lock groups (UL 768)

In the US, mechanical safe locks are rated under UL 768. From least to most secure the ratings are Group 2, Group 2M, Group 1 and Group 1R, and all four require at least 1 million possible combinations. The rating matters for autodialers in two ways: how precisely the combination must be dialed, and whether the lock needs anything other than turning the dial to open.

What the anti-manipulation features actually do

The features in Group 2M and Group 1 locks are aimed at manipulation, meaning reading the contact points of the drive cam to work out where the wheel gates are. They are not aimed at brute force. Examples include:

• False gates (S&G 6600 series, Group 2M). Shallow cuts in the wheels that look like real gates on a manipulation graph.
• Non-concentric rollers (some S&G 6600 models). An oval roller on the lever nose spins freely, so repeated contact point readings give different results.
• Fence lever control devices (La Gard 3332 and 3390, Group 2M; La Gard 1985, Group 1). These hold the lever so the nose never touches the drive cam unless the combination has already been entered, hiding the contact points.
• Push-to-open designs (S&G 8500 series, Group 1R). The fence and nose are held up until the dial is turned to 0 and pushed in, so no contact points can be felt while dialing.
• Shutter drive cams and 16-sided plastic wheels (Mosler 302, Group 1). The drive cam snaps past the contact point so it cannot be felt, and a spring-loaded plunger adds drag to the dial.

What this means for autodialers

• Anti-manipulation features do not stop brute force. An autodialer never reads contact points. It dials combinations and checks whether the lock opens, so false gates, rollers and lever control devices make no difference to it. They do defeat or hinder auto-manipulators and manipulation assistants, which depend on contact point readings.
• Tighter tolerance means more combinations. A Group 2 lock can be covered at a step of 2.5 (40 x 40 x 40 = 64,000 combinations for 3 wheels). A Group 1 lock's 2 number window needs a step of 2 (50 x 50 x 50 = 125,000), roughly doubling the worst-case time before any pruning.
• Locks that need an extra action cannot be autodialed by standard dialers. Dialers detect an open by turning the dial against the bolt. Push-in-dial locks such as the S&G 8500 and 2900 series, Star and AMSEC push-dial safes, and direct entry locks need more than that to open, and the LockManipulator documentation explicitly lists them as unsupported. Many popular Group 1 locks are push-in designs. Purpose-built machines can still do it: the Vogt and Jordan robots brute forced both the butterfly-knob S&G 8400 and the push-dial S&G 8500.
• Ratings are not guarantees. The 2 and 20 hour figures are certification targets. Safe manipulation author LockManipulator documents techniques that open many Group 2M and Group 1 locks far faster. One example is the S&G 8500: pushing the dial in repeatedly makes the fence knock the wheels round until their gates align, so the lock effectively manipulates itself.

Most commercial autodialers are designed and marketed for Group 2 locks. Several, including the JACK range, also list Group 1 models such as the La Gard 1985 among their supported locks.

Source for lock group definitions and features: Safecracking for Everyone, Second Edition (LockManipulator), chapters "Security ratings", "Group 2M" and "Group 1".

Currently available commercial models

JACK Professional (MPM Lock Decoders)

The JACK Professional is the flagship model from MPM Lock Decoders, created by Czech programmer Marek Pederzoli. It is one of the most feature-rich autodialers on the market and supports a broad range of lock brands.

JACK Professional mounted on a safe. Image: MPM Lock Decoders

JACK Plus (MPM Lock Decoders)

The JACK Plus is the mid-range model that replaced the original award-winning JACK Basic. It shares the core mechanical platform with the Professional but omits several premium features.

JACK Plus. Image: MPM Lock Decoders

JACK PW1 (MPM Lock Decoders)

The JACK PW1 is an additional model in the JACK range with support for both 3-wheel and 4-wheel combination locks, localised in English and Czech. It includes 6 speed settings, dialing progress saving, and password protection.

JACK PW1. Image: locksmith.cz

Combi QX3 (Q Security Products / Lockmasters)

The Combi QX3 takes a modern approach with Bluetooth wireless control via a bundled tablet. Designed specifically for Group 2 locks with 3 and 4 wheel support.

Combi QX3 with its control tablet. Image: Q Security Products

Sparrows H.A.L.E. (Sparrows Lock Picks)

The H.A.L.E. (Human Autonomous Lock Entry) decoder from Sparrows uses powerful magnets for mounting and a computer-controlled motor to dial combinations. It incorporates built-in manufacturer codes and allows users to add educated guesses such as birthdays, street numbers, or phone numbers to prioritise during the search.

AutoDialer V4

The AutoDialer V4 has been in active use for over 5 years, primarily in the Vietnamese market. It is designed for Group 2 mechanical combination locks, particularly the S&G 6700 series and compatible models.

AutoDialer V4 kit. Image: autodialer-v4.com

Keydecoder.eu Autodialer

A European-made autodialer from keydecoder.eu, designed specifically for LaGard and Sargent 3-disk mechanical code locks, including safe deposit box locks.

Keydecoder.eu autodialer. Image: keydecoder.eu

ITL 2000 / ITL 2000-II (Intralock Tools)

The ITL 2000 is one of the longest-running autodialers on the market. Produced by Intralock Tools Limited, it was one of the first self-contained microprocessor-controlled safe dialers to gain widespread adoption among locksmiths and remains on sale today as the ITL 2000-II kit. Older units are also common on the secondhand market.

ITL 2000-II kit. Image: locksmith.cz

Operating the ITL 2000

An unofficial ITL-2000 operating guide in the LockManipulator repository explains how the machine is set up in practice:

• Contact area first. Before mounting, the operator finds both contact points by hand and rounds the midpoint down to a whole number. The machine uses this "drop" point to test for an open lock. If it is wrong, the dialer cannot recognise an opening at all.
• Mounting. Towels or spacers go between the magnets and the safe door so the magnets can be removed and the door is not marked. The dialer runs a calibration spin, the dial is set to the contact area centre, and the collar is tightened. The operator then checks that the dial returns to the same position, and remounts if it does not. The guide warns never to fully loosen the collar, because the numbered jaws then grip off centre and have to be reinserted in order along the collar's spiral.
• Four key parameters, all set under Set Drop:
  • Drop: the centre of the contact area.
  • Offset: half the contact area width. Keep it at 4, so third numbers within 4 of the drop are skipped. Any larger and the real third number may be excluded.
  • Checkpoint: how far past the contact area the machine turns to test the lock. Keep it at the maximum of 26, or it will not turn far enough to detect an open and will relock the lock.
  • Increment: keep it at 2. Larger steps may miss the combination, and smaller ones waste time.
• Custom ranges per wheel. Each wheel can be switched from "auto increment" (every number) to a fixed range, for example if the second number is known to be between 30 and 50. Wheels 1 and 3 take the range low to high, and wheel 2 takes it high to low, matching their dialing direction. Entering a range the wrong way round excludes it instead.
• Speed. The guide advises leaving the default speed alone, as it is already at the limit of reliable dialing. Lowering it to turn a very stiff dial may work but risks burning out the motor. It also describes the Left/Right setting, for locks that open with a final left turn, as effectively obsolete, since it knows of no compatible locks that need it.
• Confirming the combination. When the dialer stops, turning the dial right should stop within one rotation as the bolt retracts. The safe should not be relocked until the combination is confirmed. If the reported combination does not open the lock, the guide gives a pattern of nearby combinations to try by hand: the first and second numbers each at -2, 0 and +2, and the third number at -4, -2, +2 and +4, a total of 36 combinations.
• If nothing opens. If the full sequence completes and the lock is still closed, either the setup is wrong or the lock is faulty and must be drilled.

Auto-manipulators and manipulation assistants

Tools that automate manipulation, rather than brute force, are far rarer than autodialers. Lockpicker Jan-Willem Markus has described the auto-manipulator as "the holy grail of auto dialers". The Combi+ and TSM below are the two we found currently on sale. The SoftDrill, an earlier commercial auto-manipulator, is covered under previously available models, and the AUTOGRAPH3000 is a hobbyist build that is not available.

For background on what these tools automate, see Finnish machinist Jaakko Fagerlund's OzSecCon 2018 talk, Manipulation aids in opening safe locks. According to a write-up of the conference, it covered:

• graphing the wheels by turning them through each number, and why the sloped right contact point is the most useful to measure
• how wheels are not perfectly round, with deviations of up to 0.5 mm
• attacks based on dialing tolerances, cheap electronics and reading the wheels in the order 3, 2, 1
• using electronics to graph the wheel pack, with the "ultimate way" being a manipulation robot, an "autodialler with a microphone" such as the SoftDrill

Combi+ / Combi Plus (Q Security Products)

The Combi+ Manipulator (part Q8030) is a tablet-controlled tool that both manipulates and dials Group 2 safe locks. It is a sister product of the Combi QX3 (Q8035) and is sold by Q Security Products in the US, by LSC in Australia (listed as made by LTI Inc), and was announced in the UK by Safe Ventures. Barry Wels, who resold it in Europe in 2021, described it as a sensitive robot dialer that manipulates three and four wheel combination locks.

Combi+ Manipulator with control tablet. Image: Q Security Products

TSM - The Safe Manipulator

TSM (The Safe Manipulator) is a PC-based manipulation assistant, also associated with Safe Ventures. The technician still turns the dial, but a high resolution encoder records the dial position and the software builds the wheel graphs automatically. It is marketed both for live safe opening and as a tool for teaching manipulation.

TSM encoder on a safe dial with the graphing software. Image: locksmith.cz

AUTOGRAPH3000 (not available)

The AUTOGRAPH3000™©® is a hobbyist auto-manipulator built by YouTuber Abrasive and shown in a quick demo video. Rather than brute forcing the combination, it takes contact point readings automatically and graphs them to locate the wheel gates. The demo shows it working on a cutaway combination lock while the software plots contact point readings against dial position and logs each wheel pack position as it tests it. The AUTOGRAPH3000 is not currently available, and no source code or design files have been released.

AUTOGRAPH3000 quick demo. Image: Abrasive on YouTube

Jan-Willem Markus also cites "locksport: S&G 6731 autodialer build 0.4" by idanhurja on YouTube as a notable auto-manipulator project, and notes that most such projects are neither open source nor public.

Previously available models

ITL 1000 (Intralock Tools)

The ITL 1000 was the predecessor to the ITL 2000. Technical details are scarce, but it established Intralock's early presence in the autodialer market. Users of the ITL 1000 often upgraded components such as the dial clamp and base to the newer ITL 2000 specifications.

JACK Basic (MPM Lock Decoders)

The original JACK Basic was the entry-level model in the JACK range. It has since been replaced by the JACK Plus, which offers improved capabilities at a similar price point. The Basic model is no longer in production but can occasionally be found secondhand.

SoftDrill (LockTec Tools / Mas-Hamilton, 1999)

The SoftDrill was a commercial auto-manipulator announced in The National Locksmith, November 1999 (Vol. 70, No. 11, pp. 60-62). It was made by LockTec Tools, Inc., a subsidiary of the Mas-Hamilton Group, which made the X-07 and Auditcon electronic safe locks and later became Kaba Mas. MBA USA, Inc. was its exclusive worldwide distributor. The launch article presented it as a faster, non-destructive alternative to autodialers, which it said could take up to 30 hours, and to drilling and lock replacement, which it said could cost a customer up to $3,000 and take up to 72 hours.

Images: The National Locksmith, November 1999

A contemporary review carried the headline "Don't Call Me an AutoDialer!!", and the manufacturer called it a lock "profiler". The name combines "software" with "drill": it did a job normally done with a drill, but without damaging the lock. Kaba Mas later filed a patent for the method, US20050261804 (local PDF copy), which describes the same system: a laptop with a data acquisition card, a stepper motor driving the dial, and a vibration sensor that detects contact points.

A second-hand SoftDrill kit with laptops, spare DAQ card, motors and the original manual, listed for sale at $8,400

The reviewer noted that the SoftDrill causes far less wear than a brute force autodialer because it dials far fewer combinations, and that it opened locks with mechanical faults such as a loose spline key and a stuck fly. All of the reviewer's failed openings happened with early software, and each of those that still failed after the setup was adjusted revealed at least two correct numbers.

Patented autodialer and auto-manipulator designs

Several autodialers and auto-manipulators were designed and patented long before cheap microcontrollers made DIY builds practical. US20050261804 describes the commercially sold SoftDrill. We have not found evidence that the others became products, but they show how long the idea of automated safe opening has existed. Glenn E. Wilson patented a brute force autodialer in 1984 and followed it with a fully automatic manipulator in 1990.

Patent drawings via Google Patents (US patent drawings are in the public domain)

Patents for autodialer-resistant locks

Lock manufacturers took autodialers seriously enough to patent countermeasures. These patents are useful references because each describes the autodialer threat it was designed to defeat.

US5473921, Fig. 1 - Ilco Unican anti-autodialer mechanism. Drawing via Google Patents

Open source and DIY projects

SparkFun Safe Cracker

The SparkFun Safe Cracker is the most well-known open source autodialer project. Created by Nathan Seidle (founder of SparkFun Electronics) along with Rob Reynolds and Joel Bartlett, it was presented at DEF CON 25 where it successfully cracked a SentrySafe in approximately 30 minutes. A full build guide is available on the SparkFun website.

SparkFun Safe Cracker on a SentrySafe. Image: SparkFun Electronics (CC BY-SA 4.0)

The SparkFun project is significant for two reasons. It demonstrated that a functional safe autodialer could be built for a fraction of the cost of commercial units using readily available components and 3D printing, and it combined automated dialing with a genuine manipulation technique rather than relying on brute force alone.

eNBeWe ESP8266 autodialer

A DIY autodialer project documented on blog.enbewe.de that uses an ESP8266-based NodeMCU board as the controller with a stepper motor and DRV8825 driver module. The firmware was developed using PlatformIO and the source code is available on GitHub.

eNBeWe autodialer mounted on a safe. Image: blog.enbewe.de

Startup Chuck autodialer

An Arduino-based brute force autodialer built by Charles McNall (Startup Chuck) in 2025 and featured on Hackaday. Its source code is on GitHub.

Startup Chuck autodialer on a safe. Image: Hackaday / Startup Chuck

LockManipulator Auto Dialer (Jared Dygert)

The LockManipulator Auto Dialer is the most complete DIY autodialer we found. The GitHub repository contains the firmware, a browser-based control interface, STL and STEP print files, a wiring schematic, a full bill of materials, a user manual and a demonstration video. Its author argues that autodialers should not be restricted to locksmiths and government buyers, and estimates the build at about $150 to $200.

Unlike the other projects in this section, it is source available rather than open source. It is released under the PolyForm Noncommercial License 1.0.0, so you can build, modify and share it for personal or other non-commercial use, but not sell it or use it commercially.

LockManipulator Auto Dialer on a safe. Image: LockManipulator/Locksport

Reading the firmware shows three techniques that set it apart from simpler DIY builds:

• Sensorless open detection. After each combination the dialer turns in the opening direction to a set distance past the contact point (20 numbers by default). If the combination is right, the bolt retracts and the dial hits a hard stop. The TMC5160's StallGuard feature detects the motor stalling from its electrical load, so no switch, servo or handle sensor is needed. Before each run the firmware calibrates the stall threshold automatically by picking up all the wheels and sweeping through threshold values.
• Wheel-aware dialing. The firmware tracks where each wheel is and which direction it was last turned. That includes "rotational conversion", the small offset (0.5 by default) between where a wheel is left and where it is picked up when the dial reverses. As a result it only redials the wheels that need to change, avoids disturbing wheels that are already set, and starts each reset wheel next to the previous wheel's position to cut dial travel.
• Pruning likely-invalid combinations. By default it skips combinations whose consecutive numbers are within 5 of each other, a last number inside the drop-in area between the contact points, and any per-wheel exclusion ranges you enter. It tries permutations of user-supplied likely numbers first, and starts the first wheel at 10 rather than 0. Acceleration follows a smooth S-curve so free-spinning wheels do not overshoot.

The self-centering dial gripper on an S&G dial. Image: LockManipulator/Locksport

The documentation is unusually candid about limitations:

• Wear. The author describes autodialing as usually destructive. Tens of thousands of combinations can age a lock by decades and wear out internal parts, whatever the speed, so manipulation is recommended for antique or rare locks.
• False results. Stall detection can give false negatives, which sound like a "clunk clunk" as the lock unlocks and relocks, so the manual recommends staying within earshot. The combination the device reports may not be exact because wheels can carry momentum, so the real combination should be recovered from the lock before relocking.
• Default credentials. The Wi-Fi password and web login are fixed in the firmware (the published Wi-Fi password is "AutoDialer"), so builders should change them before using it anywhere other people could connect.

The author also says they have built and tested an auto-manipulator, which they plan to sell with its parts list and source code published in the same way.

Ruxcon 2014 autodialer (Janke and Davis)

Melbourne security researchers Luke Janke and Jay Davis presented an Arduino-based autodialer for Group 2 locks at Ruxcon 2014, reported by The Register. It used 3D-printed parts and stepper motors salvaged from stage lighting. The builders estimated a parts cost of about $150 (the prototype cost about $1,500) and a worst case of under four days, and could load default combinations from an SD card to try first. We have not found a public release of the design files.

The Janke and Davis autodialer. Image: The Register

Vogt and Jordan safe cracking robots (MIT, c. 2006)

Two MIT students, Kyle Vogt and Grant Jordan, built two laptop-controlled brute force autodialers that targeted Group 1 "manipulation proof" locks rather than the usual Group 2. Vogt wrote them up on his blog in 2010 and 2011 (original robot, v2, both via the Internet Archive). He dated the v2 robot to 2006, with the first robot built before it. The first was later covered by Hackaday. The design files and code were never released.

Images: Kyle Vogt (kvogt.com, via the Internet Archive)

• Original robot (S&G 8400). It opened a safe fitted with a Sargent & Greenleaf 8400, a Group 1 lock that Vogt says the US government used for classified documents for nearly 30 years. A custom stepper motor turned the dial through a coupling made of heavy-duty surgical tubing. Because the 8400 opens with a butterfly knob in the centre of the dial, the head also carried an RC servo with a machined knob to turn it independently of the dial. A high resolution optical encoder on the motor shaft detected a successful opening: the torque needed to open the lock was more than the stepper could deliver, so a stall showed up as a position error. Vogt designed an Atmel microcontroller control board with about 2,000 lines of C firmware, connected to a laptop over USB. Jordan wrote the dialing algorithm in Java, using the lock's mechanical tolerances and forbidden zones to cut the number of combinations by about an order of magnitude. It found the combination after about 21,000 attempts, in "just a few hours".
• v2 (S&G 8500). A second robot was designed to open any safe with a Sargent & Greenleaf 8500 series lock, the push-dial Group 1R design described above. It mounted with two magnets at the base of aluminium support columns and was driven by Jordan's Java GUI, which showed the dial position, the combination being tried and the working combination once found. Vogt published a video of it running, slowed down for the camera.

The project shows that "manipulation proof" ratings say nothing about brute force, and that a purpose-built dialer can handle the extra actions, such as a butterfly knob or a push-in dial, that defeat general-purpose autodialers.

Other DIY safe projects

Further DIY autodialer projects are collected under Hackaday's safe autodialer tag and on DigiKey's TechForum. DeflateAwning/Safe-Cracker on GitHub is a stepper motor based build targeting a Sentry safe. These projects vary widely in sophistication and reliability, but most combine a microcontroller, a stepper or servo motor and 3D-printed parts to drive the safe dial.

Combination padlock auto-manipulators

The same ideas have been applied to combination padlocks, where the small keyspace and well documented weaknesses make automated manipulation very fast.

• Combo Breaker (Samy Kamkar, 2015) - A motorised, 3D-printed device that cracks Master Lock combination padlocks in 8 attempts or fewer. It uses an Arduino Nano, a stepper motor, an optical rotary encoder and an analog feedback servo to pull the shackle. Parts cost under $100. The design is open source on GitHub.
• SeifIbrahim/combo-breaker - A build inspired by Kamkar's design that opens Master Lock combination padlocks in seconds. It lifts the shackle, rotates the dial side to side to find sticking points, and then tests the short list of candidate combinations.
• Combination Lock Cracker - A Hackaday.io project, with code on GitHub, that the author reports opens locks in under 45 minutes.

Comparison summary

Choosing an autodialer

For professional locksmiths who regularly open safes, the JACK Professional is the most capable option. Its smart dialing modes, broad lock compatibility, diagnostics, and GSM notification features justify the premium price for high-volume use. The JACK Plus offers a more affordable entry point for those who do not need the advanced features.

The Combi QX3 appeals to technicians who prefer a modern tablet-based interface. Its Bluetooth control and dedicated app make it straightforward to configure, and the price is competitive at the lower end of the range.

The Sparrows H.A.L.E. is notable for its built-in manufacturer code database and hint-based searching. The GSM text notification feature is practical for jobs where the technician cannot remain on-site.

Technicians who already practise manipulation, or want to learn it, may get more value from a manipulation tool than from a brute force dialer. The TSM keeps a human on the dial but makes contact point readings far more precise. The Combi+ automates the whole process and typically opens a Group 2 lock in one to one and a half hours, much faster than brute force, though at around $7,500 it is one of the most expensive tools here.

For locksport enthusiasts and those interested in the engineering challenge, the open source projects - particularly the SparkFun Safe Cracker - provide an excellent platform for learning about safe mechanisms, motor control, and automated physical security testing at a fraction of the cost of commercial tools. Anyone who wants a DIY dialer that can actually be used on a real Group 2 safe should look at the LockManipulator Auto Dialer. It is the most capable and best documented build we found, though its licence rules out commercial use.