The problem
Why ordinary keys leak
Every key you hand out is a template for more.
Common keyways, common blanks
Most residential and light commercial locks use a small number of very common keyways. The keyway is the shape of the slot the key slides into, the profile of grooves along the side of the blade. Because those profiles are so widely used, blank keys for them are sold everywhere: hardware stores, big box stores, kiosks in supermarkets, and online.
That is convenient when you need a spare. It is a real problem when you are trying to control access to a building. An employee, a tenant, a contractor or a cleaner can take a key you issued and have a copy cut in minutes, with no record anywhere. You cannot see those copies, count them or get them back. When that person leaves, the only way to be sure their access is gone is to rekey.
Some keys are stamped "Do Not Duplicate". That stamp is a request, not a control. Many key cutters will honor it, and some will not, and a blank with the same profile works the same regardless of what is stamped on the original.
The answer
What makes a keyway restricted
A restricted keyway system uses a key profile whose blanks are not sold on the open market. The blanks are distributed only to authorized dealers, and those dealers cut keys only on the authority of the system's owner. The effect is that a key from your system cannot simply be copied at a kiosk, because the kiosk does not have, and cannot buy, the blank.
There are different levels of restriction. At one end are keyways that are simply not commonly stocked, which slows casual copying but does not stop it. In the middle are restricted keyways controlled by agreement between the manufacturer and its dealers, where blanks are sold only to authorized locksmiths who follow the owner's authorization rules. At the higher end are patented keyways, where the key profile or a feature of the key is protected by a patent, giving the manufacturer legal grounds to act against unauthorized blank production for as long as the patent lasts.
Many restricted systems pair the keyway with additional features in the lock, such as secondary locking elements, sidebars, or interactive parts on the key, which also raise resistance to picking and other manipulation. That is a separate benefit from duplication control, but they often come together in the same hardware.
What matters for most owners is not the technical detail but the outcome: a key that only you can authorize to be copied, with a record of every one cut.
How control works
Authorized signers and key records
The heart of a restricted system is not the metal, it is the paperwork. When a system is set up, the owner names one or more authorized signers. Those are the only people who can request new keys or changes to the system. Some systems use signature cards kept on file, some use ID cards or codes, and many combine several checks.
When someone wants an additional key, the request must come from, or be approved by, an authorized signer. The locksmith cuts the key, records it against the system, and often stamps it with a unique number. Over time, the owner builds a record of exactly how many keys exist, what each one opens, and who received it.
- Name at least two authorized signers. One person as the only signer becomes a problem when they are on vacation, ill, or leave the organization.
- Keep the signer list current. When a signer leaves, remove them from the list the same day. A former manager who can still order keys defeats the purpose.
- Number and log every key. Stamped numbers on keys, matched to a log of who received each one, turn a key audit from guesswork into a simple check.
- Collect keys at departure. The log tells you exactly which keys each person holds, so collecting them is straightforward.
- Audit once a year. Ask every key holder to show their keys. Missing numbers show you exactly where the gaps are.
Who uses it
Where restricted keyways make sense
Any place where more than a few people hold keys.
Offices and businesses. Staff come and go. Cleaners, contractors and vendors need access. A restricted system means a departing employee cannot keep an uncounted copy, and the key log shows exactly what to collect.
Apartment buildings and multi unit properties. Common doors such as main entrances, laundry rooms, trash rooms and storage areas are shared by every tenant. Rekeying them at each turnover is impractical. A restricted keyway on common doors stops tenants handing out copies of the building key, which is one of the most common ways buildings lose control of who can enter.
Schools, churches and nonprofits. Volunteers, staff, board members and rental groups often hold keys, and turnover is frequent. A restricted system combined with a sensible key hierarchy keeps access manageable.
Medical and professional offices. Records rooms, medication storage and server closets need tighter control than the front door. Restricted keys for those areas add a layer that ordinary keys cannot.
Homes. Homeowners with house cleaners, dog walkers, nannies or adult children coming and going sometimes choose a restricted keyway so the keys they hand out cannot be copied without their knowledge.
Master keying
Restricted keyways and master key systems together
Restricted keyways and master key systems solve different problems and work best together. A master key system decides which keys open which doors, so a manager key opens every office while a staff key opens only one. A restricted keyway decides who can make more of those keys.
A master key system built on a common keyway is only as secure as the hardest key to copy, and on a common keyway that is not very hard. A single master key copied at a kiosk opens the whole building. That is why master key systems for larger properties are usually built on restricted or patented keyways, where the master key cannot be duplicated without authorization.
If your building already has a master key system on a common keyway, converting to a restricted keyway can often be done in stages, starting with the most sensitive doors and the master keys themselves. We can survey the building and plan the conversion. Our master key systems page covers how hierarchies are designed.
Converting
Moving an existing building onto a restricted system
Usually a cylinder swap, not new doors or new hardware.
In most buildings, converting to a restricted keyway does not mean replacing the locks. The lever sets, deadbolts, mortise locks and exit devices stay in place. What changes is the cylinder, the part that accepts the key. Many commercial locks accept standard cylinder formats, so a restricted cylinder can replace the existing one directly.
A typical conversion runs like this. We survey every door and lock and note the cylinder type. We work with you to decide which doors go onto the restricted system and how keys should be arranged. Cylinders are pinned to the new system, installed door by door, and tested. New keys are issued against the log, and old keys are collected.
For buildings that must stay open during the work, conversions can be staged over several visits, with doors switched in groups so staff are never left without access. Some owners start with exterior doors and master keys, then convert interior doors later.
Where locks use interchangeable cores, the conversion can be especially quick, since cores can be swapped in seconds with a control key. That same feature makes future rekeying faster for the life of the system.
Honest limits
What a restricted keyway does not do
A restricted keyway is a strong control over duplication. It is not a complete security program, and it is worth being clear about its limits.
- It does not stop a key being lent. A key holder can still hand their key to someone else. The restriction stops copies, not sharing. Policy and the key log handle that.
- It does not fix a weak door. A restricted cylinder in a door with a poor frame or a thin strike is still a weak door. Hardware and frame matter as much as the key.
- It does not last forever unmanaged. A system with no updated signer list and no key log slowly loses its value as keys go uncounted.
- Patents expire. Patent protection on a keyway has a limited life. After it ends, blanks may eventually become available more widely. Many manufacturers introduce newer keyways over time, and a long lived system may eventually need an update.
- It does not replace electronic access where that suits better. For doors that need time schedules, audit trails or instant deactivation of a lost credential, access control may be the better tool, often alongside restricted keys for override.
Choosing a system
Questions to ask before you commit
Restricted systems are a long term decision, since every future key and cylinder must come through the system. A few questions help you choose well.
- Who can cut keys for this system, and where? You want a local source that can respond when you need keys or a cylinder quickly, and clarity about what happens if that source is unavailable.
- Who owns the system records? The owner should hold the authorization and have access to the key records, not be dependent on a single vendor's goodwill.
- How is authorization checked? Signature cards, ID cards, codes or a combination. Stronger is better, as long as it is practical for your staff.
- What level of protection does it offer? Restricted by distribution only, or protected by patent, and how long is left on any patent.
- Does it fit your hardware? Cylinder formats must match your locks and exit devices, or adapters must exist.
- Can it grow? A system should have room for more doors and more levels of access as the building changes.
Contractors and vendors
Keys for people who are not on the payroll
The largest leak in most buildings.
Employees are usually the first group owners think about when it comes to key control. In practice, the harder group to manage is everyone else: janitorial crews, HVAC and elevator contractors, landscapers, security patrols, delivery drivers with after hours access, and the IT consultant who needs the server closet once a quarter.
These keys tend to be issued informally, to a company rather than a person, and they pass from one worker to the next as crews change. Nobody at the building knows who is carrying them on any given day. On a common keyway, any of those workers can have a copy cut for convenience, and many do.
A restricted system does not solve all of that on its own, but it closes the copying route and gives you a way to track what you issued. A few habits make it work well. Issue contractor keys to a named person, recorded in the log, not just to the company. Give contractors keys only to the areas they need, which a master key hierarchy makes possible. Set a review date for every contractor key, and collect it when the contract ends. Where a vendor needs access only occasionally, a lockbox or an access control credential that can be switched off may be better than a key at all.
Key audits
Running your first key audit
Once a restricted system is in place, the key log turns the annual audit from a guessing game into a checklist. If you have never done one, here is a simple way to run it.
- Print the log. List every numbered key, what it opens, and who it was issued to.
- Ask each holder to present their keys. In person, not by email. Check the stamped numbers against the log.
- Mark what is missing. Any key that cannot be produced is either lost or in the wrong hands. Note what it opens.
- Decide on action for each gap. A lost change key for one office may mean rekeying one door. A lost master key is a bigger decision and may call for rekeying the affected part of the system.
- Update signers and holders. Remove anyone who has left, add anyone new, and confirm the authorized signers are still the right people.
- Record the audit. Date it, note the result, and keep it with the system records. Next year's audit starts from there.
Most owners find the first audit surfaces a handful of gaps and the second one very few, because people know the keys are being counted. That change in behavior is a large part of the value.
Scenarios
Restricted keyway situations compared
| Situation | Where restricted keys help |
|---|---|
| Staff turnover every few months | Departing staff cannot keep uncounted copies |
| Apartment building entrance keys spreading | Tenants cannot copy the common door key |
| Master key system on a common keyway | Master keys can no longer be duplicated at a kiosk |
| Records room or medication storage | Tighter control on the rooms that matter most |
| Home with regular household help | Keys handed out cannot be copied without the owner |
| Church or nonprofit with many volunteers | Key log shows who holds what, and what to collect |
Local factors
Restricted systems across New Castle and Kent County
In New Castle County, restricted keyway systems are common in office buildings along the Wilmington riverfront and downtown, in medical and professional offices around Christiana and Newark, in apartment communities in Bear, Glasgow and Pike Creek, and in schools and churches throughout the county. Buildings that house several small businesses often use them to keep each tenant's keys separate from the common doors.
In Kent County, we see them in state and county offices around Dover, in churches and nonprofits, in multi unit rentals in Dover, Smyrna and Milford, and in agricultural and industrial businesses where many workers need access to some buildings and not others.
Wherever the building, the approach is the same: understand who needs access to what, choose a system that fits the hardware and the budget, and set up the records so the owner stays in control.
Questions
Frequently asked
What is a restricted keyway?
A key profile whose blanks are not sold on the open market. Only authorized dealers can obtain them, and they cut keys only with the owner's authorization.
Is a Do Not Duplicate stamp the same thing?
No. The stamp is a request that some key cutters ignore. A restricted keyway controls the blanks themselves, so copies cannot be cut without authorization.
Do I need new locks to switch to a restricted system?
Usually not. Most conversions replace only the cylinders. The existing lever sets, deadbolts and exit devices stay in place.
Who can order more keys?
Only the authorized signers you name. We recommend at least two, and updating the list whenever someone leaves.
Can restricted keys be master keyed?
Yes. Restricted keyways are commonly used as the base for master key systems, so master keys cannot be copied casually.
Are restricted locks harder to pick?
Many restricted systems include additional locking features that raise resistance to picking and manipulation. It depends on the specific product.
Is this worth it for a home?
For some homes, yes, particularly where several people outside the family hold keys. For a household that rarely hands out keys, standard rekeying may be enough.
What happens if a restricted key is lost?
The log shows which doors it opens. Depending on its level in the system, you may rekey only those cylinders, which is often quicker with interchangeable cores.
Tired of not knowing how many keys exist?
Call and tell us about the building. We will explain the options and what a conversion would involve.