Bootloader unlocking

An unlocked bootloader on an HTC Explorer (Pico) , showing additional available options

Bootloader unlocking is the process of disabling the bootloader security that enforces secure boot during the boot procedure. It can allow advanced customizations, such as installing custom firmware, or replacing the operating system with another one. Some bootloaders are not locked at all and some are locked, but can be unlocked with a command, a setting or with assistance from the manufacturer. Some do not include an unlocking method and can only be unlocked through a software exploit.

Bootloader unlocking is also done for mobile forensics purposes, to extract digital evidence from mobile devices, using tools such as Cellebrite UFED.

Background

Unlocking the bootloader allows installing and running unsigned code on a device, including user customized software. Operating outside the manufacturer specification might usually result in voiding any warranties and may make the device susceptible to data theft, as the integrity of the operating system (as intended by the manufacturer) can no longer be guaranteed. On Chromebooks, enabling developer mode makes the system less secure than a standard laptop running Linux. Unlocking the bootloader may require reinitialization, formatting to factory settings, or otherwise lead to data loss on Android and ChromeOS devices. This is due to the fact that some user data is impossible to back up without root permission. This will also lead to certain security apps not working, such as Samsung Knox for which the counter would be stuck at "0x1."

Sascha Segan from PCMag considered a non unlockable bootloader a mistake on the Qualcomm Snapdragon Insiders phone, which is targeted at advanced users.

Platforms

Android

Unlocking the bootloader is typically a prerequisite of obtaining root access and/or installing an alternative operating system.

Android bootloader unlocking as of 2026
ManufacturerDifficulty levelMethodRequires internet connection?
GoogleEasy (non-Verizon)

Medium (Verizon, as of 2018) Impossible (newer Verizon phones)

 Command-line (unlocked variant, not restricted to carrier, and non-Verizon carrier variants when paid off fully) Yes
SamsungComplicated
  • Some very old Android versions - available with usual flashing tools.
  • North American versions
    • Below March 2021 security update - Freely unavailable, commercially available (required unlock tokens that are officially unobtainable, but obtainable by third parties through yet publicly unknown means, resold as paid shady services available in Telegram and Discord), additionally modified flashing tools and firmwares are required.
    • Above March 2021 security update - unavailable.
  • Other versions
    • Below One UI 8.0 - freely available.
    • Any versions above One UI 8.0 - unavailable
 Enable option that allows OEM unlock (if it exists) in Development settings, then unlock bootloader in Download mode.

Samsung Knox (on supported devices) will be permanently tripped if modified or custom firmware is flashed, so Samsung Wallet, Secure Folder and applications making use of the Knox framework will be permanently unusable even if the bootloader is re-locked.

Prior to One UI 8.0, devices sold outside of North America had the OEM Unlock option to unlock the bootloader.

From One UI 8.0, Samsung has removed the ability to unlock the bootloader in all regions.

 Yes
OnePlusEasy (non-T-Mobile,non mainland China, 2025+)
Medium (T-Mobile)

Medium (Mainland China, 2025+)

 Command-line, except on T-Mobile US variants where an unlock code is needed or mainland China versions released from 2025 and onwards that require the In-depth test app. No
XiaomiHard (MIUI powered devices)
Very Hard (non-Chinese HyperOS powered devices)
Very Hard (China Mainland)		 On MIUI, you will need to enable developer options, bootloader unlocking and then Mi Unlock. You must connect your Mi account and use the PC MiUnlockTool. Requires a 3-7 day old Mi account.

On devices with Xiaomi HyperOS outside mainland China, you need to request bootloader unlock permissions in the Xiaomi Community app before proceeding with bootloader unlocking. Requires a 1-month-old Xiaomi account.

For Mainland China devices with HyperOS, bootloader unlock for most devices has not been available until early 2026 when some developers found a vulnerability and successfully used that to unlock bootloader of many but not all Xiaomi devices. Not sure if this exploit got patched yet.

 Yes
AsusImpossibleUnavailable since August 2023, when first-party apps were removed and servers were shut down. Yes
SonyMediumCommand-line, request code at Sony website Yes
FairphoneMedium

Easy (newer software versions)

 Command-line, request code at Fairphone website or forum

Settings > Enable Developer Options > Toggle Bootloader Unlocking in the Developer Options > Wait for verification

 Yes
MotorolaVaries widely between model and SoC manufacturer

Medium (Except Verizon, AT&T, TracFone)

Impossible (Verizon, AT&T, TracFone)

 Command-line, request code at Motorola website Yes
RealmeMedium-Hard (China Mainland and India)
Hard (select global models, e.g. Realme C35 (Global))
Highly Restricted (Other Global models)		Command-line, via the official "In-Depth Test" application. However, official support has been deprecated for most Global variants and devices with Unisoc (Spreadtrum) chipsets, leaving community-developed exploits as the only viable method. Yes
NothingEasyCommand-line No
HuaweiMedium-Hard (Kirin SoCs, select Huawei phones)

Very Hard (MediaTek devices)

Impossible (others)

 Select Huawei phones using the Kirin SoC can have their bootloader unlocked unofficially via potatonv.

Some Huawei devices using MediaTek SoC's can be unlocked with an unlocked seccfg and patched 32-bit Little Kernel. There is a payload that lets you do this: kaeru. For other devices, bootloader unlock has not been available since July 2018.

 Yes
OPPOEasy (MediaTek) or phones bought in mainland China
Medium (Snapdragon) 		Only certain Snapdragon-powered OPPO phones can be unlocked[better source needed] without a third-party paid tool such as UnlockTool.[citation needed] Unlocking is possible on some MediaTek SoCs via MTKClient. Note that certain fastboot binaries have been removed, or locked by RSA key.

MediaTek: MTKClient can be used for older devices, which sometimes requires using MTK bypass utility beforehand. This is unfeasible on modern Mediatek SoCs as they require a download agent file signed by the OEM and this file is not typically distributed.

Any phones bought from mainland China and in depth-test's device support lists: Depth test regardless of SoC (the depth test app can be downloaded from OPPO's website). Command line using adb and fastboot.

 Yes
HMD-NokiaMedium (select models, e.g. Nokia 8)
Impossible (Others)		Possible with unofficial unlocking methods Yes
Vivo Impossible as of May 2022. N/A Yes
LGHardPossible[better source needed] by flashing engineering bootloaders, either using QFIL for newer devices or root for older ones (unofficial). Yes
TecnoMediumCommand-line. Requires Tecno ID account at least two weeks old. No
InfinixMediumCommand-line. Requires Inifinix ID account at least two weeks old. No
ItelMediumCommand-line. Requires Itel ID account at least two weeks old. No
TCLMedium (Ion V only)

Unknown (others)

 For the Ion V mobile phone, you can use a Python tool to reboot to a normally hidden fastboot. No
Amazon Medium Command-line and unofficial. Requires using Linux to brick the device temporarily.[better source needed] Yes

Shutdown of online services

In 2018, Huawei stopped providing bootloader unlock codes. On 31 December 2021, LG shut down its website which provided bootloader unlock codes. In August 2023, ASUS removed the unlocking tool from its website and shut down the servers used to unlock the bootloader.

History

The bootloaders of Nexus and Pixel devices can be unlocked with fastboot.

When Motorola released a bootloader unlocking tool for the Droid Razr, Verizon removed the tool from their models.

In 2011, Sony Ericsson released an online bootloader unlocking tool. Sony requires the IMEI number to be filled in on their website. For the Asus Transformer Prime TF201, Asus previously released a special bootloader unlock tool, up until 2023.

In 2012, Motorola released a limited tool for unlocking the bootloader of their devices; It required accepting terms and conditions and creating an account before the bootloader could be unlocked for your Motorola device.

A 2012 article by The Verge called the unlockable bootloaders a 'broken promise' and called for a fix.

HTC phones have an additional layer of lock called "S-OFF/S-ON".

Bootloaders can be unlocked using an exploit or using a way that the vendor supplied. The latter method usually requires wiping all data on the device. In addition, some manufacturers prohibit unlocking on carrier locked phones. Although Samsung phones and cellular tablets sold in the US and Canada do not allow bootloader unlocks regardless of carrier status, a service has allowed users on an earlier version to unlock their US/Canadian Samsung phone(s) and/or tablet(s).

In 2018, a developer from XDA Developers launched a service which allowed users to unofficially unlock the bootloader of some Nokia smartphone models. Similarly, another developer from XDA Developers launched a service to allow users to unofficially unlock the bootloaders of the US and Canada versions of the Samsung Galaxy S20 and Samsung Galaxy S21 phones.

Huawei announced plans to allow users to unlock the bootloader of the Mate 30 series, but later retracted that. Huawei has stopped providing bootloader unlock codes since 2018. A bootloader exploit named checkm30 has been developed for HiSilicon-based Huawei phones.[non-primary source needed]

When the bootloader of the Samsung Galaxy Z Fold 3 was unlocked, the camera became less functional. This could be restored by re-locking the bootloader. This issue was later fixed by Samsung. For the Samsung Galaxy S22 series, before OneUI 8, unlocking the bootloader had no effect on the camera.

Others

Microsoft

The Windows Phone Internals tool is able to unlock bootloaders of all Nokia Lumia phones running Windows Phone, but not phones like the Alcatel Idol 4 or HP Elite x3. Version 1.0 was released in November 2015. In October 2018, the tool was released as open source software when the main developer René Lergner (also known as HeathCliff74) stepped down.

The slab bootloader used by Windows RT could be unlocked using a vulnerability, but was silently patched by Microsoft in 2016. UEFI Secure Boot on x86 systems can generally be unlocked.

Apple

The boot ROM protection on iOS devices with an A11 processor or older can be bypassed with a hardware exploit known as checkm8, which makes it possible to run other operating systems including Linux.

The bootloader on Apple Silicon-based Macs can be unlocked. However, other Apple devices like the iPhone and iPad cannot be bootloader unlocked even when using the same chip used in a Mac.

Google

The equivalent of bootloader unlocking is called developer mode in Chromebooks. Chromebooks use custom bootloaders that can be modified or overwritten by removing a Write-protect screw. Some models lack a screw and instead may or may not require disabling the onboard Cr50 chip.

In 2013, the bootloader of the Chromecast was hacked using an exploit. In 2021, it was hacked again for newer versions. In 2023, it was reported that the Chromecast HD could be unlocked without exploit.

Asus

Asus used to provide an unlocking tool for both of their smartphone lines, the Zenfone and ROG Phone. This worked as an installable .apk file that the user could install on their phone, then unlock the bootloader. The app worked by contacting Asus unlocking servers, then prompting the user to perform a factory reset.

In 2023 Asus removed the tool from their website and closed the unlocking servers, so even phones with the .apk file installed couldn't unlock their bootloaders. Representatives on the Asus forums claimed the tool would be available again, but as of March 2024 no additional information was provided, even after the release of their latest device the ROG Phone 8 and the previously upcoming release of the Zenfone 11 Ultra.

A user on the popular forum XDA filed a court claim application against Asus due to the unlock tool never being released and alleged that Asus censored comments about the unlock tool on their forum.

SpaceX

In August 2022, security researcher Lennert Wouters applied a voltage injection attack to bypass firmware verification of a Starlink satellite dish from SpaceX.

Relocking

After unlocking a bootloader, some devices allow users to relock it. Relocking is typically done to restore the device to a factory-like state, often for warranty purposes or to re-enable certain security features like verified boot. This process is usually carried out through fastboot commands or manufacturer-specific software.

However, the ability to relock a bootloader varies significantly across manufacturers and device models. Some manufacturers provide official methods to relock the bootloader without issue, especially if the device is running official, signed firmware. In contrast, other devices may experience functionality issues after relocking—such as the loss of access to certain features or the risk of a "soft brick"—particularly if any system modifications remain or if unofficial firmware is installed.

Importantly, relocking the bootloader does not always reverse all changes made during the unlocking process. For example, some devices will retain a bootloader unlock flag or record in the hardware's tamper logs, which may still void warranties or affect access to services like DRM-protected content.

As a result, users are advised to consult manufacturer-specific guidelines and ensure that all system components are restored to their official state before attempting to relock the bootloader.

See also

References

  1. ↑ Tamma, Rohit; Donnie Tindall (2015). Learning Android forensics: a hands-on guide to Android forensics, from setting up the forensic workstation to analyzing key forensic artifacts. Birmingham, UK. ISBN 978-1-78217-444-8. OCLC 910639389.{{cite book}}: CS1 maint: location missing publisher (link)
  2. ↑ Porup, J. M. (2017-06-19). "How to install Linux on a Chromebook (and why you should)". Ars Technica. Archived from the original on 2017-06-19. Retrieved 2021-09-06.
  3. ↑ "Qualcomm Smartphone for Snapdragon Insiders Review". PCMag. 16 August 2021. Archived from the original on 2021-08-16. Retrieved 2021-09-06.
  4. ↑ zenfyr (2026-04-14), zenfyrdev/bootloader-unlock-wall-of-shame, retrieved 2026-04-15
  5. ↑ "Rooting your Bootlocked Pixel Phone (Verizon Edition)".
  6. ↑ "[CLOSED][Android][UNSAMLOCK] Bootloader Unlock for Samsung US/Canada Devices". 8 January 2021.
  7. ↑ "2023 SM-G950U/U1/W Rev8 Root Method Android 9 (Snapdragon models) Via Bootloader Unlock Token". 3 March 2020.
  8. 1 2 "Bootloader unlocking option removed from One UI 8.0". XDA Forums. 2025-07-26. Retrieved 2025-07-27.
  9. ↑ "Device Compatibility Knox Solutions | Samsung Knox". Archived from the original on 2024-12-07. Retrieved 2024-12-05.
  10. ↑ Leon, Jean (2025-07-26). "One UI 8 Could Be Killing Part of the Core Essence of Android". Android Headlines. Retrieved 2025-07-27.
  11. ↑ "Unlock your Fairphone's bootloader". Fairphone. Retrieved 2026-08-19.
  12. ↑ "[Guide]Un/locking Motorola Bootloader". XDA Forums. 2020-04-08. Retrieved 2025-06-12.
  13. ↑ Ufiano. "Guide: How to unlock Realme C35 Bootloader". GitHub Gist. Retrieved 2024-05-22.
  14. ↑ Hazarika, Skanda (2021-02-24). "Dozens of Huawei and Honor devices with Kirin processors can now be bootloader unlocked". XDA. Retrieved 2026-10-13.
  15. ↑ "帖子详情 - Oppo社区".
  16. ↑ "Proton Drive".
  17. ↑ "[Guide] How to unlock the bootloader on Nokia Android Phones for free". techmesto. 21 June 2021. Retrieved 31 Oct 2025.
  18. ↑ "vivo Smartphone FAQs | vivo India". www.vivo.com. Archived from the original on 2022-11-29. Retrieved 2022-11-29.
  19. ↑ "V60 Bootloader Unlock and Magisk Root". XDA Forums. 8 November 2021. Retrieved 24 July 2025.
  20. ↑ dksoni411 (2017-12-09). "Tutorial - Root, TWRP - LG V20 Using DirtySanta most variants". XDA Forums. Retrieved 2026-10-09.{{cite web}}: CS1 maint: numeric names: authors list (link) CS1 maint: url-status (link)
  21. ↑ "[UNLOCK][ROOT][TWRP][UNBRICK] Fire HD 10 2017 (suez)". XDA Forums. 2019-03-21. Archived from the original on 2025-04-09. Retrieved 2025-04-19.
  22. ↑ "Huawei stopt met het uitdelen van codes om bootloader vrij te geven". Tweakers (in Dutch). Archived from the original on 2023-05-07. Retrieved 2023-05-07.
  23. ↑ "LG stopt eind dit jaar met tool voor unlocken van smartphonebootloaders". Tweakers (in Dutch). Archived from the original on 2023-05-07. Retrieved 2023-05-07.
  24. ↑ "ASUS is apparently killing the ability to root Zenfones". Android Authority. 8 August 2023. Archived from the original on 2024-01-30. Retrieved 2024-01-30.
  25. ↑ "Factory Images for Nexus and Pixel Devices | Google Play services". Google Developers. Archived from the original on 2017-04-04. Retrieved 2022-11-07.
  26. ↑ Ingraham, Nathan (2011-10-24). "GSM Motorola RAZR hits the FCC; Verizon model has locked bootloader". The Verge. Archived from the original on 2022-10-01. Retrieved 2022-06-14.
  27. ↑ By (2011-04-14). "Sony Ericsson Promotes Android Bootloader Unlocking". Hackaday. Archived from the original on 2022-05-28. Retrieved 2022-06-14.
  28. ↑ Kotipalli, Srinivasa Rao; Mohammed A. Imran (2016). Hacking Android: explore every nook and cranny of the Android OS to modify your device and guard it against security threats. Birmingham, UK. ISBN 978-1-78588-800-7. OCLC 957298786.{{cite book}}: CS1 maint: location missing publisher (link)
  29. ↑ Tiefenthäler, Ronald (22 February 2012). "Asus: Bootloader Unlock Tool für Tablet Transformer Prime TF201 verfügbar". Notebookcheck (in German). Archived from the original on 2021-08-04. Retrieved 2021-08-04.
  30. ↑ Rodgers, Evan (2012-08-17). "Motorola unveils Android bootloader unlocking tool with limited device support". The Verge. Archived from the original on 2012-08-19. Retrieved 2021-09-10.
  31. ↑ Viscomi, Rick; Andy Davies; Marcel Duran (2015). Using WebPageTest: web performance testing for novices and power users. Sebastopol, CA. ISBN 978-1-4919-0281-3. OCLC 927108295.{{cite book}}: CS1 maint: location missing publisher (link)
  32. ↑ Kopfstein, Janus (2012-11-20). "Access Denied: why Android's broken promise of unlocked bootloaders needs to be fixed". The Verge. Archived from the original on 2017-02-10. Retrieved 2024-11-22.
  33. ↑ Afonin, Oleg (2016). Mobile Forensics ' Advanced Investigative Strategies (1 ed.). Packt Publishing. ISBN 978-1-78646-408-8. OCLC 960040717.
  34. ↑ "USA/Canada - Samsung Bootloader Unlock". Telegram. Retrieved 2024-06-18.
  35. ↑ "[CLOSED][Android][UNSAMLOCK] Bootloader Unlock for Samsung US/Canada Devices". XDA Forums. 2021-01-08. Archived from the original on 2024-06-27. Retrieved 2024-06-18.
  36. ↑ Rox, Ricci (2 April 2018). "Nokia users can now unofficially unlock their bootloaders but the methodology is as sketchy as it gets". Notebookcheck. Archived from the original on 2021-09-06. Retrieved 2021-09-06.
  37. ↑ "Huawei Mate 30 will not have an unlocked bootloader". The Indian Express. 2019-09-25. Archived from the original on 2019-09-26. Retrieved 2021-09-06.
  38. ↑ "Huawei will no longer offer bootloader unlock codes for its Android devices". 9to5Google. 2018-05-24. Archived from the original on 2021-09-06. Retrieved 2021-09-06.
  39. ↑ "Checkmate Mate 30 - Attack the bootrom of Huawei smartphones" (PDF). Archived (PDF) from the original on 2021-09-06.
  40. ↑ Clark, Mitchell (2021-08-24). "Samsung will let you unlock your Z Fold 3's bootloader, but at the cost of your cameras". The Verge. Archived from the original on 2021-08-24. Retrieved 2021-09-06.
  41. ↑ "Unlocking the bootloader no longer kills the Galaxy Z Fold 3's cameras". xda-developers. 2021-12-07. Archived from the original on 2022-02-13. Retrieved 2022-03-14.
  42. ↑ "Unlocking the bootloader doesn't break the camera on the Samsung Galaxy S22 series". xda-developers. 2022-02-26. Archived from the original on 2022-02-26. Retrieved 2022-02-26.
  43. ↑ "Tool van Nederlandse ontwikkelaar kan custom roms op alle Lumia's flashen". Tweakers (in Dutch). Archived from the original on 2021-08-04. Retrieved 2021-08-04.
  44. ↑ "Windows Phone Internals 2.2 Unlocks the Bootloader on all Windows 8 & 10 Lumia Smartphones". xda-developers. 2017-12-04. Archived from the original on 2021-08-04. Retrieved 2021-08-04.
  45. ↑ Andrew Orlowski. "Rooting and modding a Windows Phone is now child's play". The Register. Archived from the original on 2022-09-28. Retrieved 2022-06-14.
  46. ↑ "Windows 10 Mobile's bootloader unlocker is now open source". Neowin. Archived from the original on 2022-05-25. Retrieved 2022-06-14.
  47. ↑ Francisco, Shaun Nichols in San. "Microsoft silently kills dev backdoor that boots Linux on locked-down Windows RT slabs". www.theregister.com. Archived from the original on 2021-09-06. Retrieved 2021-09-06.
  48. ↑ Lundberg, Anders. "16-year-old runs Linux on iPhone 7". Macworld UK. Archived from the original on 2021-08-04. Retrieved 2021-08-04.
  49. ↑ January 2021, Michelle Ehrhardt 19 (2021-01-19). "Linux is Finally on Apple M1...Kind Of". Tom's Hardware. Archived from the original on 2021-08-04. Retrieved 2021-08-04.{{cite web}}: CS1 maint: numeric names: authors list (link)
  50. ↑ December 2014, Lucian Armasu 31 (2014-12-31). "You Can Now Run Full Linux Apps Inside A Chrome OS Window". Tom's Hardware. Archived from the original on 2021-09-06. Retrieved 2021-09-06.{{cite web}}: CS1 maint: numeric names: authors list (link)
  51. ↑ Robert, Foss (2017-03-08). "Quick hack: Removing the Chromebook Write-Protect screw". Collabora. Archived from the original on 2021-09-04. Retrieved 2021-09-04.
  52. ↑ "Chromecast bootloader exploit surfaces, opens up plenty of possibilities (video)". Engadget. 28 July 2013. Archived from the original on 2020-09-04. Retrieved 2021-09-06.
  53. ↑ "Modders ontgrendelen bootloader van Google Chromecast met Google TV". Tweakers (in Dutch). Archived from the original on 2021-08-01. Retrieved 2021-09-06.
  54. ↑ Wilde, Damien (23 September 2022). "Chromecast with Google TV HD bootloader can be unlocked by default". 9to5Google.
  55. ↑ "Court Action against Asus' false promise on bootloader unlock tool". XDA Forums. 2024-02-18. Retrieved 2024-03-23.
  56. ↑ Hardcastle, Jessica Lyons. "Starlink satellite dish cracked on stage at Black Hat". The Register. Retrieved 2022-11-22.
  57. ↑ Wilde, Damien (2021-09-09). "How to downgrade from Android 12 Beta to Android 11 on Google Pixel [Video]". 9to5Google. Archived from the original on 2021-10-18. Retrieved 2021-09-28.