Security Ratings for Padlocks: CEN Grades and ASTM Testing

Padlocks are the one piece of security hardware people buy almost entirely on appearance. A heavy body and a thick shackle look serious. Neither tells you how the lock behaved when a laboratory attacked it with the tools an actual thief would use, which is precisely what the standards are for.

The European structure: EN 12320

The European standard for padlocks is EN 12320, Building hardware, Padlocks and padlock fittings. According to the standards body listing for BS EN 12320:2021, it covers mechanical padlocks and padlock fittings for buildings and general use, and specifies performance requirements for strength, security, durability, performance, and corrosion resistance.

Its classification structure is worth understanding because it is not a single score. The standard establishes one category of use, two categories of durability, six categories for corrosion resistance, and six grades for security based on performance tests that simulate an attack.

Two implications follow. First, security and corrosion resistance are graded independently, so a padlock that survives serious attack testing may still be a poor choice for a coastal gate, and vice versa. Second, with six security grades rather than three, the spread between adjacent tiers is narrower than people assume; a one-grade difference is a step, not a leap.

The standard also explicitly includes limited manual attack testing, because machine testing does not replicate all known manual attacks. Test tools referenced include curved long nose pliers, chisels, pipe wrenches, and hammers. That detail is a useful reality check: the graded threat is a person with common hand tools, not an exotic laboratory rig.

The North American structure: ASTM F883

In North America the analogous document is ASTM F883. Its scope, per the standard performance specification for padlocks, covers environmental, functional, operational, and security requirements, and includes function descriptions, cycle tests, operational tests, environmental tests, forcing tests, and surreptitious entry tests. Like EN 12320, it describes and grades various levels of performance so users have criteria for selecting a suitable padlock.

The distinction between forcing tests and surreptitious entry tests is the one to carry away. Forcing covers cutting, prying, pulling, and impact. Surreptitious entry covers picking, decoding, and other methods that leave no visible sign. A padlock can be excellent at one and ordinary at the other, and which matters depends on whether you would rather deter a theft or be able to detect one.

ASTM is candid about the limits of its own method: the tests described are laboratory tests, and while they simulate field conditions as to attacks or the environment, they do not duplicate them. A grade is a repeatable comparison, not a promise about a specific alley on a specific night.

Beyond the standards

Independent attack-testing schemes also exist, particularly in the United Kingdom, where insurers and cycling organizations reference third-party ratings that are separate from EN grading. These schemes typically publish a rating tier rather than the full test protocol, so treat them as an additional data point alongside a standards grade rather than a substitute for one.

The system fails at its weakest element

A padlock is never used alone. It secures a hasp, a chain, a cable, a shackle, or a locker latch, and an attacker will simply choose whichever of those is easiest. Grinding a chain is usually faster than defeating a hardened shackle, and unscrewing an unprotected hasp from soft wood is faster than either.

The standards recognize this. ASTM publishes a separate specification, ASTM F2155, which describes and grades performance levels for hasps and other attachment devices so users can select suitable hardware, with the same caveat that its tests are laboratory simulations. If you spend on a graded padlock and bolt it to an ungraded hasp, you have bought a rating for one link in a chain you did not rate.

Choosing a tier

Two variables should drive the decision: what the lock protects, and how long an attacker could work on it unobserved. A shed at the back of an unlit property gives someone unlimited quiet minutes, which argues for a higher security grade and a shrouded shackle regardless of what is inside. A gym locker in a staffed building is a low-exposure application where durability and corrosion resistance may matter more than attack grade. Match the grade to exposure time first and asset value second, then rate the hasp, chain, and mounting to the same level.