How a Master Key System Actually Works

A master key system works by giving every lock two correct answers: the change key that opens only that door, and the master that opens all of them. The design lives in a written keying schedule, and the schedule — not the keys — is the system. Keep the schedule on file and the building can grow for decades; lose it and the only ways forward are decoding every cylinder or rekeying the building.

That is the part building owners most often have backwards. The master key feels like the valuable object, but keys can be cut again from the record, and the record cannot be rebuilt from the keys without touching every lock in the building. The folder matters more than the keyring. Everything else about master keying follows from that one fact.

Every key in the system belongs to a level, and the levels form a hierarchy. At the bottom is the change key — the key a tenant or an employee carries. The industry glossary maintained by the LIST Council defines it as a key that “operates only one cylinder or one group of keyed alike cylinders.” In plain terms: it opens one door, or one set of doors deliberately set to match, and nothing else.

The master key sits above the change keys. Each cylinder under it is pinned to accept exactly two keys — its own change key and the master — so a manager carries one key instead of forty, and no tenant’s key opens a neighbor’s suite. That two-answers rule is the whole trick, and it is why the system has to be designed on paper rather than improvised one lock at a time.

Larger properties add a grand master: a key that operates two or more separate master groups. One master covers the east building, another covers the west, and the grand master operates both. The hierarchy can stack higher, but it rarely should. Most Tri-State systems — a strip mall, a medical office, a church with a school attached — are well served by two levels.

A real system starts with a meeting, not a pinning kit. The national standard for this work, ANSI/BHMA A156.28, most recently revised in 2023. Its stated purpose includes the keying conference: the sit-down where the owner decides, before any cylinder is touched, how the building should work. Which doors fall under the master, who carries it, and what the cleaner’s key does and does not open all get answered there.

The decisions come out of that meeting as a keying schedule, and the schedule is the document this whole post keeps pointing back to. Ours records three things:

• Who holds what — which people or roles carry which keys, from the master down to every change key, so a new manager can read the building’s key situation off one page.
• Which cylinder is which — every opening in the building, the hardware installed on it, and the key symbol that operates it.
• The bitting list — what the same LIST Council glossary calls “a listing of all the key combinations used within a system.” That one never leaves the shop’s file. It is the document a matching key gets cut from later.

On our side, this is exactly the process our commercial locksmith service in Evansville describes: we walk the doors, count openings, and write down what is actually installed, because no honest schedule gets designed from a photo. You get the keying schedule in writing, and the records stay on file with the shop.

A master key system has a hard ceiling on how many distinct keys it can contain. Designers start from a documented chart of every usable cut, planned in full before the first key is made — Locksmith Ledger’s walkthrough of the design process shows the map coming first. Once the chart is drawn, the capacity is fixed. Spend it all on day one and the building cannot grow.

Good design spends that capacity deliberately. We reserve unused change keys in the schedule for doors that do not exist yet, so the three suites you build out in five years drop into the plan instead of forcing a redesign. The reservation costs nothing at design time. It only has to be thought of.

The alternative is expanding outside the original chart, and the trade press has been blunt about it for decades. Locksmith Ledger’s guidance on system ownership warns that expanding a system without its original records voids any assurance of its integrity — nobody can say what the new cuts collide with. Keys can start operating doors they were never meant to, and nobody finds out until it matters.

The payoff for all this paperwork is quiet and enormous. Call the shop that holds your records — two years later, ten years later — and a matching key gets cut from the file. No re-survey, no pulled cylinders, no guessing. We have done this work across the Tri-State since 1983, and the systems that age well are the ones whose schedule never left the file. Whether the building is in Evansville or any of the towns we cover, the folder is what makes the second call a five-minute job instead of a second project.

The failure mode is documented too. Locksmith Ledger describes a university campus whose keying records were destroyed; rebuilding the paperwork meant decoding every lock on the campus, one cylinder at a time. That is the documented alternative to keeping the folder. The information still exists, but only inside the locks, and getting it back out is a building-sized job.

One thing to settle before any of this starts: who owns the records. The same Ledger guidance recommends putting it in writing at the outset — do the schedule and bitting list belong to the owner or the shop, and who may authorize new keys against them. We hold records on file for our commercial customers, and we would rather have that arrangement named in the paperwork than assumed.

Master keying is not free, security-wise, and you should hear that from the people who sell it. A cylinder in a master system accepts more keys than a stand-alone cylinder, which is exactly what makes it convenient. A veteran master keyer writing in Locksmith Ledger called the practice “a controlled loss of security”, and that is the honest frame: a trade made on purpose, only where the convenience earns it.

Right-sizing is how the loss stays controlled. Not every door belongs under the master. Supply closets, common corridors, and mechanical rooms usually do. A pharmacy cabinet, a server room, or an owner’s office may deserve to stand alone on its own key, outside the system entirely. A smaller system is also a simpler chart, which leaves more room for the doors that genuinely need to be on it.

The rest is key control, which is a discipline rather than a product. Keep an issuance log so every cut key is accounted for. Keep a current key-holder list, and collect keys at every turnover rather than assuming they come back. For buildings that need to control duplication itself, restricted keyways add another layer — a subject for its own post. None of it is complicated, and all of it lives in the same folder as the schedule.

A master key system, then, is less a piece of hardware than a piece of writing: a plan for who may open what, recorded well enough to outlive the people who made it. The keys wear out and get recut. The schedule is the system. Keep it where you can find it.