Teardown Tuesday: Bluetooth Padlock

March 20, 2018 by Mark Hughes

The Masterlock Bluetooth Padlock 4400D is a digital padlock that can be operated through button presses on a keypad or through a phone app.

The Masterlock Bluetooth Padlock allows keyless entry using a built-in four-button keypad or Masterlock's Bluetooth apps.

Rather than using a typical numerical passcode to access a padlock, the Masterlock Bluetooth Padlock uses a series of key-presses with four directional buttons: up, down, right, and left. These four options combined to create a seven-sequence unlock pattern provides $$4^7=16348$$ unique combinations. Someone trying to break into this lock has only a 1 in 16348 chance of guessing the correct combination.


Image of Bluetooth Padlock from Masterlock.


As an alternative, the lock can use its Bluetooth capabilities to be opened via Masterlock's app.

Taking Apart the Padlock

The lock must be destructively disassembled by drilling through or around stainless steel rivets in the back of the lock. Since drilling through a rounded-head stainless steel rivet is a bit difficult, I chose to drill the aluminum case that surrounds the rivets with a very inexpensive 1/4" hole saw. With the four rivets defeated, the padlock can never be securely reassembled.

The electronics are in a compartment on the front side of the padlock and are separated from the mechanical and electromechanical parts by the body of the lock. The electronics compartment is held closed with two threaded bolts whose heads are on the back side of the lock. One screw is in clear view in the upper right corner. The second screw is blocked by the long end of the shackle. To remove the shackle, grind off the small pin pressed into the side of the shackle with a rotary tool.


What's Inside the Padlock: Mechanics and Electromechanics

Image created by Mark Hughes.


Above is a graphic that demonstrates how the lock works on a mechanical level. Here's a guide to the parts labeled:

  1. Motor
  2. Blocking cam
  3. Post
  4. Cylindrical pieces
  5. Shackle

Inside the padlock, a motor (1) has a flat disk with a protruding pin that intercepts an asymmetrical blocking cam (2) and rotates the blocking cam to allow the downward movement of a post (3). When a user exerts an upward force on the shackle (5), the two cylindrical pieces (4) move out of the concavities in the shackle and apply a force against the camming surface of (3), forcing the protrusion of (3) to move down against the spring pressure.  

For more details of a similar locking mechanism, see Masterlock's Patent 8453481

What's Inside the Padlock: Electronics

View of the dismantled padlock. The image at the left is the front of the padlock, the image at the right is the rear of the padlock.
ComponentDescriptionCostMore Information
MSP430 FR594916-bit FRAM Microcontroller$6User's Guide
CC2541 F256Bluetooth Low Energy and System-on-Chip$6Datasheet | User's Guide

The two main microchips that control the padlock are the MSP430FR5949 and the CC2541F256. The circuit board is also populated with support circuitry that includes a DC motor driver circuit composed of transistors and possibly MOSFETs, crystals to control timing, a Light Emitting Diode to provide visual feedback, and various resistors and capacitors.




The Texas Instruments MSP430FR5949 is a 16-bit microcontroller and the brains of this device. It interprets button presses, activates the LED and motor, and communicates with the CC2541F256. The MSP430FR59xx microcontroller series has a standby power consumption as low as 350 nA. It also uses Ferroelectric Random Access Memory (FRAM), which allows for very low power write cycles.



The CC2541F256 is a Bluetooth transceiver that communicates both with the MSP430FR5949 and the phone app, allowing users to control the lock and update the device when necessary. At the core of this chip is an 8051 microprocessor.


Functional diagram of TI's CC2545 SoC. Image from Texas Instruments. Click to enlarge.


The Masterlock 4400D Bluetooth Electronic Padlock is built around two microchips, the CC2541F256 and the MSP430FR5949. It also contains the microchip support circuitry and a motor driver circuit.

While getting into this device was challenging, there's also not much inside that would require regular service.


Next Teardown: Steam Gaming Controller

  • I
    Ingo_Debus March 23, 2018

    So once the coincell battery is drained, you cannot open the lock anymore? I think I prefer a mechanical solutione here..

    Like. Reply
  • R
    radio-active March 23, 2018

    The patent describes a way to access the battery compartment once the lock is open. Also a way to “jump start” the lock with an external battery. I don’t see the implementation of either of those in this examination of the lock. In general these tear-downs are a little light on technical details. However, I can see exactly where I would need to drill a hole in order to rotate the motor and cam that would open the lock…

    Like. Reply
    • Mark Hughes March 28, 2018
      @radio-active, The purpose of any padlock is to keep honest people honest, as any such lock can be quickly defeated with a 30-second grinding wheel or a heavy-handed-sledge-hammer-attack. The purpose of our tear-down articles is to show basic design principles and highlight best practices. AAC employees never attempt to reverse engineer, critique, or demonstrate ways to "hack" or "defeat" devices. In this instance, the disassembled lock and the patent drawings are from two completely different locks. Your felonious interests are best served at other sites. I recommend that you ply your trolled comments in fields anew, as we'll not entertain them here.
      Like. Reply
      • M
        MilfordsMrFixIt March 30, 2018
        The veil was a bit thin on that one wasn't it?? LOL Seriously now, I have been thinking of ordering a couple of these, but can't get a straight answer: speaking only of the one you opened up, Can you, or can you Not replace the battery. Our usage would have these locks opened and locked 50 to 100 times a day, so a dead battery would be a real bad thing.
        Like. Reply
        • Mark Hughes March 30, 2018
          @MilfordsMrFixIt, I doubt the lock designers ever imagined a duty cycle any where near as high as your use-case. The shackle must be opened to remove the battery.
  • G
    ggrise March 30, 2018

    Masterlock website states that for 4400 series locks, battery compartment can be partially opened on a locked lock to allow jumpering of a dead battery and subsequently unlock and then you can replace the battery

    Like. Reply
  • R
    ronsoy2 April 06, 2018

    Cutesy toy. Not really a practical device. If it is only to keep honest people out, then use a much more reliable rotary dial padlock and not worry about fooling with dead batteries or other possible fails of a complicated mechanism.

    Like. Reply