Master Key Systems: Key Hierarchies Designed and Kept Under Control

How One Key Opens Many Locks

Every pin-tumbler cylinder works on the same principle. A plug rotates inside a fixed housing, and a line of spring-loaded pin stacks crosses the gap between them. When the right key goes in, each stack is lifted until its break lines up exactly with that gap, the shear line, and the plug is free to turn.

In an ordinary cylinder, each stack has one break, so exactly one key depth works in each position. Master keying adds a small spacer, called a master pin or master wafer, between the bottom pin and the driver in some of the chambers. Now that chamber has two breaks. A shallow cut lifts the stack until the upper break meets the shear line; a deeper cut aligns the lower one. Either key turns the plug.

The arithmetic matters. If master pins sit in three chambers, each of those chambers accepts two heights, so the cylinder actually accepts two times two times two, or eight, distinct bittings. Only two of them are keys you meant to issue: the change key and its master. The other six are mathematical side effects. Add a grand master level and some chambers carry two master pins, giving three working heights each, and the count climbs quickly.

That is the core trade-off of every master keyed installation:

• More levels deliver more convenience at the top of the hierarchy
• More master pins create more theoretical keys and more shear lines to exploit
• Careful bitting selection keeps those side-effect combinations away from keys that actually exist

Designing a system well means accepting the first point and actively managing the other two.

The Levels, From Great Grand Master to Change Key

Locksmiths describe a master key system by its levels, counted from the bottom up.

• Change key. Operates one door, or a small set of doors keyed alike. It's the key most people carry.
• Master key. Operates every cylinder in one group, such as a floor, a department, a trade or one building's units.
• Grand master key. Operates the cylinders under several masters, typically for the owner, facilities director or property manager.
• Great grand master key. A fourth level used on large campuses, school districts, hospitals and multi-building complexes where several grand master groups exist.

Two-level systems use change keys and one master. Three levels add a grand master, and four add the great grand master. Very large institutions sometimes go further, but every added level makes the cylinders more complex and the top key more dangerous to lose.

Some keys sit outside the simple tree. A selective master opens a hand-picked group of doors that crosses branches, such as every electrical room in three buildings. A control key, used only with interchangeable cores, removes cores from their housings and deserves even tighter handling than the grand master. Some doors are deliberately left out of the system, and keying schedules mark them NMK, for not master keyed, so nobody assumes the master reaches them.

The Door and Hardware Institute publishes a standard key coding system so that a short letter-and-number stamp tells a locksmith where a key sits in the hierarchy without revealing its cuts. Whatever notation a property uses, the stamp on the key should point to the chart, never to the door.

Designing Around How People Actually Use the Building

A key plan that looks tidy on a floor plan can still fail the people who carry it. Good design starts with questions about roles rather than rooms.

Who opens the building in the morning, and who locks up at night? Which people need to reach every room, and which only need their own office plus a restroom? Are there rooms that should stay closed even to most managers, such as cash handling, pharmaceuticals, personnel files, network equipment, or evidence and firearms storage? Which vendors visit, how often, and do they need a key or an escort?

From those answers, doors fall into groups. A dental office might divide into front-of-house, clinical and storage. A light-industrial building might split into office, production, shipping and maintenance. An apartment community usually splits by building, with a separate group for amenities and another for service rooms.

A few design habits pay off for years:

• Group by function rather than by current employee, because staff changes far faster than room use
• Keep sensitive rooms under their own master, or out of the system entirely
• Reserve unused change keys and at least one unused master for expansion
• Plan common doors, like a laundry room every resident uses, as deliberate cross-keyed openings rather than afterthoughts
• Decide who holds the top key before the system exists, not after

Expect the first draft to change. Walking the plan past the people who actually open doors, such as custodians, maintenance staff and shift leads, catches problems that owners and managers tend to overlook.

The Arithmetic Behind a Keying Chart

Behind every keying chart sits a set of calculations that a locksmith either works out by hand or runs through keying software and then checks. The basic inputs come from the lock manufacturer:

• Number of pin positions. Commonly five on residential hardware and six on commercial cylinders, with some systems using seven
• Number of available depths and the increment between them. Schlage's standard system uses ten depths spaced .015 inch apart, while Kwikset uses seven depths spaced .023 inch apart
• Maximum adjacent cut specification, which limits how sharply neighboring cuts can differ so the key enters and withdraws smoothly. Each manufacturer publishes its own limit
• Minimum master pin size, so thin wafers don't tilt sideways in the chamber and jam the plug

From there, the locksmith picks a top master bitting and a progression method. In total position progression, each position steps through its own set of depths, and the combinations become the change keys. The rotating constant method holds certain positions at the master depth on a rotating pattern. Because Schlage depths sit so close together, most Schlage systems use two-step progression, where a change key differs from the master by at least two depths in each progressed position.

The raw list is always longer than the usable list. Bittings that break the adjacent cut rule are dropped, as are any that would let one change key operate another's cylinder, and any that would produce a key opening far more doors than intended. What survives is a finite number of usable change keys, which is why large properties sometimes need a different keyway or a longer pin count before they can keep growing.

Keyways, Sectional Systems and Restricted Blanks

Bitting controls which key turns a cylinder. The keyway controls which keys can even enter it. That second layer matters just as much.

Every cylinder in a system has to accept the master keys above it, so all of them must share a keyway or belong to a family designed to work together. In a sectional or multiplex arrangement, each branch gets its own keyway section. Change keys from one branch can't physically enter cylinders in another, while master blanks are milled to slip into several sections. Large institutions use sectional keyways to add a mechanical wall between branches on top of the bitting math, and to multiply the number of available change keys without adding more master pins.

The keyway's other job is duplication control. Common keyways sold at every hardware store offer none. Restricted keyways are distributed only through authorized dealers, who should cut keys only on the system owner's instructions. Patented key systems from makers such as Medeco, Mul-T-Lock, ASSA and Schlage's high-security lines add legal protection against blank manufacturing for the life of the patent, along with registration cards or signature checks.

A 'Do Not Duplicate' stamp is the weakest form of control. It's a request printed on brass, and duplicating counters don't always honor it. For an owner whose master key system protects payroll records, medication storage or inventory worth stealing, a restricted keyway for at least the masters and exterior doors is usually money well spent. Our high-security locks service covers pick, bump and drill resistance in more depth; the focus here is simply who can get another copy.

What Existing Hardware Can Join the System

Owners are often relieved to learn that master keying rarely means replacing every lock. What can stay depends on a few checks we make at each door.

Hardware that usually works:

• Commercial key-in-lever and knob locks from Schlage, Sargent, Corbin Russwin, Yale and similar makers, provided they share a keyway
• Mortise and rim cylinders on storefront doors and exit devices, including those that drive Adams Rite deadlocks and Von Duprin rim devices
• Residential Schlage and Kwikset pin-tumbler deadbolts and levers, as long as each brand stays within its own keyway
• Rekeyable padlocks and cabinet locks built around pin-tumbler cylinders

Hardware that usually doesn't:

• Kwikset SmartKey cylinders, which use sliders and can't accept master pins
• Warded locks with skeleton-style keys on older interior doors
• Wafer-tumbler cabinet, mailbox and furniture locks
• Smart locks with proprietary override cylinders that can't be re-pinned in the field

Condition matters as much as brand. A worn plug lets pins sit unevenly, and in a master keyed chamber that shows up as a change key that works perfectly while the master drags, or the reverse. Cylinders with cracked housings, loose retaining rings or heavy wear go on the replacement list.

Mixed brands are the most common obstacle. When most doors run one keyway and a few run another, we usually swap the minority to match. A building split evenly between two brands is a real decision point: convert everything to one keyway, or run two parallel systems under separate masters and accept a second top key.

Interchangeable Cores and Construction Keying

Interchangeable core hardware separates the keyed core from the lock body. A control key, cut to a third shear line called the control line, turns a sleeve that lets the whole core slide out of its housing. A new core, pinned to a different key, slides in and locks in place.

Two families dominate:

• Small format interchangeable cores, the figure-eight shaped cores that fit a wide range of locks and padlocks across brands
• Large format interchangeable cores, specific to manufacturers such as Schlage, Sargent, Corbin Russwin, Yale and Medeco, which retrofit into those makers' commercial hardware

The appeal is speed after a key loss. Instead of disassembling hardware to re-pin a cylinder, someone holding the control key can swap a core in moments, and the old core gets re-pinned at leisure. Schools, universities, hospitals and multi-tenant office buildings rely on IC systems heavily for that reason.

The cost is complexity. Each core carries an extra shear line, which adds another theoretical way to operate it, and the control key becomes the most sensitive key on the property. IC hardware also costs more per opening than conventional cylinders.

Construction keying solves a different problem. During a build or tenant improvement, contractors need access long before the owner's permanent keys are issued. Some manufacturers use construction cores that are swapped for permanent cores at turnover. Others pin cylinders with a construction element that is voided at turnover, often by inserting a special breakout key. Either way, the goal is the same: trade keys handed around for months stop working on move-in day.

Key Control and Record Keeping

The mechanical side of a master key system can last decades. The administrative side decides whether it stays secure for more than a year or two.

A complete record set has four parts:

• The keying schedule. Every opening, its location, function, cylinder type and key code
• The bitting list. Actual cut depths for every key in the system, held by the owner and the locksmith only
• The key issue log. Which coded key went to which person or role, the date, a signature and the return date
• A cabinet or storage layout. Where unissued keys, spare blanks and spare cores live

Keys themselves should carry blind codes rather than room numbers or bittings. The code points back to the schedule, which only authorized staff can read.

Policy turns records into control. Decide who can request keys, who approves them, and how many masters exist. Require keys back at separation, lease end or contract completion, and record each return. Audit the log against the cabinet and against the people who should be holding keys at regular intervals, and immediately whenever a master holder leaves.

When a key goes missing, the records do the triage. The schedule shows exactly which openings that code operates, so you can rekey the affected branch, issue new keys under new codes, and retire the old code on paper. Without records, the only safe response to a lost master is rekeying everything, which is the most expensive outcome a key system can produce.

Electronic key cabinets and key-tracking software exist for larger operations, but a disciplined paper log and a locked cabinet serve most small and mid-sized properties well.

Security Trade-Offs and Honest Limits

A master keyed cylinder is, by design, easier to open than the same cylinder pinned for a single key. That isn't a reason to avoid master keying. It's a reason to do it carefully and to be honest about what it can and can't protect.

The main weaknesses:

• Extra shear lines give a lock picker more chances to set pins, so master keyed cylinders are generally easier to pick than single-keyed ones
• Side-effect bittings mean keys nobody issued could still operate some cylinders
• In 2003, security researcher Matt Blaze published a method showing that someone holding an ordinary change key, access to one lock in the system and a supply of matching blanks could work out the master's cuts
• A lost or copied top-level key compromises every door beneath it at once

Design choices that reduce these risks include keeping levels to a minimum, keeping cash rooms and other high-value openings off the master, using restricted or patented keyways for masters and exterior doors, and choosing bittings that avoid near-misses between branches. Restricted blanks in particular blunt the attack Blaze described, because the blanks it depends on are hard to obtain.

Some situations call for something other than keys. Doors with constant turnover, many users, or a need for time-of-day restrictions and audit trails are often better served by electronic access control, using cards, fobs or codes that can be canceled instantly. Card systems that involve new wiring, door position switches or tie-ins to fire alarm releases may also require a licensed low-voltage contractor working alongside the locksmith. A practical approach for many properties is a hybrid: electronic access on the busiest doors, a master key system everywhere else, and mechanical overrides keyed into the system where the hardware allows.

California Rules That Shape Master Keyed Properties

Several California rules affect how master key systems are designed and used.

Locksmith licensing. The Locksmith Act, Business and Professions Code section 6980 and following, requires locksmith companies to be licensed through the Bureau of Security and Investigative Services. Julian's Locksmith holds license LCO7891, which anyone can verify at search.dca.ca.gov. We verify identification and authority over a property before designing a system, cutting masters or rekeying any branch.

Rental housing. Civil Code section 1941.3 requires landlords to provide working deadbolts on main swinging entry doors and security for windows in rental units. Civil Code sections 1941.5 and 1941.6 require landlords to change locks within 24 hours of a tenant's written request in certain situations involving a protective order or similar documentation. In a master keyed building, that change can be made by re-pinning the unit cylinder to a fresh change key, so the old key stops working immediately while the system stays documented. California's landlord entry rules also call for reasonable written notice, generally 24 hours, before entering a unit except in emergencies and certain other situations, so a management master is a tool for lawful access rather than a way around tenants' rights.

Egress. Building and fire codes require doors in the path of exit to open from the inside without a key, tool or special knowledge in most occupancies. Master keying applies to the outside of those doors and to interior rooms, never to blocking a way out.

Fire department access. Many fire departments require a rapid-entry key box at commercial buildings to hold keys for responders. Coordinate with your local fire authority about which masters belong inside it, and log that key like any other.

Working With Julian's Locksmith on a Master Key System

We're a mobile locksmith, so design surveys, pinning and key cutting all happen at your property. We serve businesses, apartment owners, HOAs, schools, churches and medical offices across the Inland Empire, the San Gabriel Valley, the Pomona Valley, north Orange County and southeast Los Angeles County.

A typical project runs in this order:

• A phone call to (951) 903-3193 to describe the property, the number of doors and what's driving the change
• An on-site survey and door inventory, with ownership or management authority verified
• A proposed hierarchy and written quote, with hardware and keying costs separated
• Chart approval, then pinning, installation and key issue on a schedule that suits your operation
• A records handoff. Keying schedule, bitting list, issue log and lost-key procedure

To speed up the first visit, gather what you have: any old keying chart, a floor plan, a rough list of who holds keys today, and sample keys from each group. Photos of the lock brands and keyways help too.

Our hours are 6:30 a.m. to 11:30 p.m. every day. Weekends are included. The late hours suit businesses that want cylinders pinned after closing, and we give an honest ETA and timeline when you call rather than a promise we can't keep.

We don't publish prices, because every master key system depends on door count, levels, hardware and keyway. You'll have a written quote before any cylinder is pinned, and the chart we produce belongs to you.