Safecracking: Open a Safe with Drained Internal Batteries

EricMay 28, 2022August 15, 2022

In a Nutshell

I need a steel box to shield my magnets. I bought a hotel safe, but it’s permanently locked. This is how I broke into the safe without drilling.

The procedure is simple: We’ll break through the LED digits, fish out the locking motor wires, power them, and open the safe. Only try this with a safe you own.

Goal: Let’s safecrack your electronic Elsafe hotel safe that is permanently locked, has no override code, has no override hardware dongle, may or may not have dead internal batteries, and you own it.

Find an Elsafe Hotel Safe

This safe makes a great home safe, and you can hack the Atmel ATMega162v chipset and put in some Arduino code. You can only find these hotel safes at auction. For example:

Remove the Number Pad

The number pad is glued on, and by now the glue has weakened. Simply lift it up with your fingernail or with a chisel and yank it off. Do not worry about the connectors. You want to expose the LED digits under the plastic number pad.

Remove the Elsafe number pad to expose the LED digits

Chisel the LED Digits

Take a chisel and hammer the space between each digit so they fall into the safe. Do this with a modicum of grace so the digits fall, but the chisel does not. Slide the digits out of the way. The goal is to expose a generous hole with which to work.

Fish Out the Power Wires

If you did not go Hulk-smash on the LED digits, right below them are red and gray power wires. Fish them up with needlenose pliers and cut them so you have a maximum amount of wire coming through the hose. Strip the wires. Check with a multimeter if they have a potential of 7.5V or close to that.

Fish Out the Locking-Motor Wires

With a flashlight held sideways, look for the only red and black wires near the bolt side of the LED-digits hole. They will be held with a 2-pin JST connector to the PCB board. Fortunately, the design of the safe holds one or both wires to a pylon so yanking them will not yank them from the motor. With needlenose pliers, wiggle and pull on both wires at the same time, if possible, until the JST male connector dislodges. Pull it up to the hole as best you can.

Prepare the Locking-Motor Wires

If you have a female, 2-pin, 2.54 mm JST connector, attach it to the protruding male JST connector so you do not have to strip those short wires. Alternatively, insert rigid breadboard wires into the holes to act as terminals. I suggest either being careful or using some hot glue to temporarily hold the motor wires because they are short.

Prepare the motor wires and the power wires

Power Supply

If your safe’s batteries are still good, you can power the locking motor directly with the safe’s own batteries by touching the wires. Otherwise, a USB 5V-battery with some alligator cables does wonders.

Check if the batteries are still good or not

Power the Motor

This is the only part that requires finesse. When the motor is energized, it turns a worm gear which turns a regular gear which causes the bolt to go in and out in cycles.

Fiberoptic camera view of the locking mechanism

You have to briefly power the motor with a 5V to 7.5V power supply and test if the safe door will open. If you go too far and the bolt still catches, either keep going or reverse the motor polarity. The motor is a simple brushed DC motor so you can reverse the polarity and operate it with various voltages.

Results

Elsafe hotel safe successfully opened electronically

Success: You will find that a lot of Elsafe hotel safes with holes for LED digits are susceptible to this kind of destructive safecracking. Only follow this method on your own Elsafe because Elsafe has long stopped technical support for these safes. My particular safe is 21 years old!