Bootloader unlocking is the process of disabling thebootloader security that enforcessecure boot during the boot procedure. It can allow advanced customizations, such as installingcustom firmware, or replacing theoperating system with another one. Some bootloaders are not locked at all and some are locked, but can be unlocked with a command, a setting or with assistance from the manufacturer. Some do not include an unlocking method and can only be unlocked through asoftware exploit.
Bootloader unlocking is also done formobile forensics purposes, to extract digital evidence from mobile devices, using tools such asCellebrite UFED.
Unlocking the bootloader allows installing and running unsigned code on a device, including user customized software. Operating outside the manufacturer specification might usually result in voiding anywarranties and may make the device susceptible todata theft, as the integrity of the operating system (as intended by the manufacturer) can no longer be guaranteed.[1] On Chromebooks, enabling developer mode makes the system less secure than a standard laptop running Linux.[2] Unlocking the bootloader may require reinitialization, formatting to factory settings, or otherwise lead to data loss on Android andChromeOS devices. This is due to the fact that some user data is impossible to back up without root permission. This will also lead to certain security apps not working, such asSamsung Knox for which the counter would be stuck at "0x1."
Sascha Segan fromPCMag considered a locked bootloader a mistake on the Qualcomm Snapdragon Insiders phone, which is targeted at advanced users.[3]
Unlocking the bootloader is typically a prerequisite ofobtainingroot access and/or installing acustom ROM.
| Manufacturer | Difficulty level | Method |
|---|---|---|
| Easy (non-Verizon) Medium[4] (Verizon) | Command-line (unlocked variant, not restricted to carrier, and non-Verizon carrier variants when paid off fully) | |
| Samsung | Complicated
| Enable option that allows OEM unlock (if it exists) in Development settings, then unlock bootloader in Download mode. Samsung Knox (on supported[8] devices) will be permanently tripped if modified or custom firmware is flashed, soSamsung Wallet, Secure Folder and applications made use of the Knox framework will be permanently unusable even if the bootloader is re-locked. Prior to One UI 8.0, Devices sold outside of North America had the OEM Unlock option to unlock the bootloader. From One UI 8.0, Samsung has removed the ability to unlock the bootloader in all regions.[9][10] |
| OnePlus | Easy (non-T-Mobile) Medium (T-Mobile) | Command-line, except on T-Mobile US variants where an unlock code is needed |
| Xiaomi | Hard (MIUI powered devices) Very Hard (non-Chinese HyperOS powered devices) Impossible (China Mainland) | Requires a 3-7 day old Mi account (limited to one device per month and three devices per year). On devices withXiaomi HyperOS outside mainland China, you need to request bootloader unlock permissions in the Xiaomi Community app before proceeding with bootloader unlocking. Requires a 1-month-old Xiaomi account. For Mainland China devices with HyperOS, bootloader unlock has not been available since February 2025. |
| Asus | Impossible | Unavailable since August 2023, when first-party apps were removed and servers were shut down. |
| Sony | Medium | Command-line, request code at Sony website |
| Fairphone | Medium | Command-line, request code at Fairphone website or forum |
| Motorola | Varies widely between model and SoC manufacturer[11] Medium (Except Verizon, AT&T, TracFone) Impossible (Verizon, AT&T, TracFone) | Command-line, request code at Motorola website |
| Realme | Medium-Hard (China Mainland and India) Hard (select global models, e.g. Realme C35 (Global)) Highly Restricted (Other Global models) | Command-line, via the official "In-Depth Test" application. However, official support has been deprecated for most Global variants and devices with Unisoc (Spreadtrum) chipsets, leaving community-developed exploits as the only viable method.[12] |
| Nothing | Easy | Command-line |
| Huawei | Medium-Hard (Kirin SoCs, select Huawei phones) Impossible (others) | Select Huawei phones using the Kirin SoC can have their bootloader unlocked unofficially via potatonv:https://www.xda-developers.com/huawei-honor-bootloader-unlock-potatonv/ For other devices, bootloader unlock has not been available since July 2018. |
| OPPO | Easy (MediaTek) or phones that bought in mainland China[13] Medium (Snapdragon). | Only certain Snapdragon-powered OPPO phones can be unlocked[14][better source needed] without a third-party paid tool such as UnlockTool.[citation needed] Unlocking is possible on some MediaTek SoCs via MTKClient. Note that certain fastboot binaries have been removed, or locked by RSA key. MediaTek: MTKClient can be used for older devices, which sometimes requires using MTK bypass utility beforehand. This is unfeasible on modern Mediatek SoCs as they require a download agent file signed by the OEM and this file is not typically distributed. Any phones bought from mainland China and in depth-test's device support lists: Depth test regardless of SoC (the depth test app can be downloaded from Oppo's website). Command line using adb and fastboot. |
| HMD-Nokia | Medium (select models, e.g. Nokia 8) Impossible (Others) | Possible with unofficial unlocking methods[15] |
| Vivo | Impossible as of May 2022.[16] | N/A |
| LG | Hard | Possible[17][better source needed] by flashing bootloaders with QFIL utility (Unofficial). |
| Tecno | Medium | Command-line. Requires Tecno ID account at least two weeks old. |
| Infinix | Medium | Command-line. Requires Inifinix ID account at least two weeks old. |
| Itel | Medium | Command-line. Requires Itel ID account at least two weeks old. |
| TCL | Medium (Ion V only) Unknown (others) | For the Ion V mobile phone, you can use a Python tool to reboot to a normally hidden fastboot. |
| Amazon | Medium | Command-line and unofficial. Requires using Linux tobrick the device temporarily.[18][better source needed] |
The bootloaders ofNexus andPixel devices can be unlocked withfastboot.[19]
WhenMotorola released a bootloader unlocking tool for the Droid Razr,Verizon removed the tool from their models.[20]
In 2011,Sony Ericsson released an online bootloader unlocking tool.[21] Sony requires theIMEI number to be filled in on their website.[22] For the Asus Transformer Prime TF201, Asus has released a special bootloader unlock tool.[23]
In 2012, Motorola released a limited tool for unlocking bootloaders.[24] They require accepting terms and conditions and creating an account before the bootloader can be unlocked for your Motorola device.[25]
A 2012 article byThe Verge called the unlockable bootloaders a 'broken promise' and called for a fix.[26]
HTC phones have an additional layer of lock called "S-OFF/S-ON".
Bootloaders can be unlocked using an exploit or using a way that the vendor supplied. The latter method usually requires wiping all data on the device.[27] In addition, some manufacturers prohibit unlocking on carrier locked phones. Although Samsung phones and cellular tablets sold in the US and Canada do not allow bootloader unlocks regardless of carrier status, a service has allowed users on an earlier version to unlock their US/Canadian Samsung phone(s) and/or tablet(s)[28][29]
In 2018, a developer fromXDA Developers launched a service which allowed users to unlock the bootloader of some Nokia smartphone models.[30] Similarly, another developer fromXDA Developers launched a service to allow users to unlock the bootloaders ofSamsung Galaxy S20 andSamsung Galaxy S21 Phones.
Huawei announced plans to allow users to unlock the bootloader of the Mate 30 series, but later retracted that.[31] Huawei has stopped providing bootloader unlock codes since 2018.[32] A bootloader exploit named checkm30 has been developed forHiSilicon based Huawei phones.[33][non-primary source needed]
When the bootloader of theSamsung Galaxy Z Fold 3 was unlocked, the camera became less functional. This could be restored by re-locking the bootloader.[34] This issue was later fixed by Samsung.[35] For theSamsung Galaxy S22 series, unlocking the bootloader has no effect on the camera.[36]
The WPInternals tool is able to unlock bootloaders of allNokia Lumia phones runningWindows Phone, but not phones like theAlcatel Idol 4 orHP Elite x3.[37][38] Version 1.0 was released in November 2015.[39] In October 2018, the tool was released as open source software when the main developer René Lergner (also known as HeathCliff74) stepped down.[40]
The slab bootloader used byWindows RT could be unlocked using a vulnerability, but was silently patched by Microsoft in 2016.[41] UEFI Secure Boot on x86 systems can generally be unlocked.
Theboot ROM protection on iOS devices with anA11 processor or older can be bypassed with a hardware exploit known as checkm8, which makes it possible to run other operating systems including Linux.[42]
The bootloader onApple Silicon-based Macs can be unlocked.[43] However, other Apple devices like theiPhone andiPad cannot be bootloader unlocked even when using the same chip used in a Mac.
The equivalent of bootloader unlocking is called developer mode inChromebooks.[44] Chromebooks use custom bootloaders that can be modified or overwritten by removing a Write-protect screw.[45] Some models lack a screw and instead may or may not require disabling the onboard Cr50 chip.[1]
In 2013, the bootloader of theChromecast was hacked using an exploit.[46] In 2021, it was hacked again for newer versions.[47] In 2023, it was reported that the Chromecast HD could be unlocked without exploit.[48]
Asus used to provide an Unlocking tool for both of their smartphone lines, theZenfone andROG Phone. This worked as an installable .apk file that the user could install on their phone, then unlock the bootloader. The app worked by contacting Asus unlocking servers, then prompting the user to perform a factory reset.
In 2023 Asus removed the tool from their website and closed the unlocking servers, so even phones with the .apk file installed couldn't unlock their bootloaders. Representatives on the Asus forums claimed the tool would be available again, but as of March 2024 no additional information has been provided, even after the release of their latest device theROG Phone 8 and the upcoming release of theZenfone 11 Ultra.
A user on the popular forumXDA (website) filed a court claim application against Asus due to the unlock tool never being released and alleged that Asus censored comments about the unlock tool on their forum.[49]
In August 2022, security researcher Lennert Wouters applied a voltage injection attack to bypass firmware verification of aStarlink satellite dish fromSpaceX.[50]
After unlocking a bootloader, some devices allow users to relock it. Relocking is typically done to restore the device to a factory-like state, often for warranty purposes or to re-enable certain security features like verified boot. This process is usually carried out through fastboot commands or manufacturer-specific software.
However, the ability to relock a bootloader varies significantly across manufacturers and device models. Some manufacturers provide official methods to relock the bootloader without issue, especially if the device is running official, signed firmware. In contrast, other devices may experience functionality issues after relocking—such as the loss of access to certain features or the risk of a "soft brick"—particularly if any system modifications remain or if unofficial firmware is installed.
Importantly, relocking the bootloader does not always reverse all changes made during the unlocking process. For example, some devices will retain a bootloader unlock flag or record in the hardware's tamper logs, which may still void warranties or affect access to services like DRM-protected content.
As a result, users are advised to consult manufacturer-specific guidelines and ensure that all system components are restored to their official state before attempting to relock the bootloader.[51]
According to information from technology groups in Vietnam, after updating version 2.1.6 of theVNeID application released on May 30, 2024, some Android phone users have received warnings : "Your device is not safe, there is a risk of containing malicious code...". As a result, users are thrown to the main screen and cannot use the VNeID application, even though before the update they could still log in and use it normally.
This is because VNeID 2.1.6 update has added new security measures to stop working on Android devices with root access, unlocked bootloader and developer mode enabled. To use, users must disable root access to the device, relock bootloader and turn off developer options.
In 2018, Huawei stopped providing bootloader unlock codes.[52] On 31 December 2021, LG shut down their website which provided bootloader unlock codes.[53] In August 2023,ASUS removed the unlocking tool from their website and shut down the servers used to unlock the bootloader.[54]
{{cite book}}: CS1 maint: location missing publisher (link){{cite book}}: CS1 maint: location missing publisher (link){{cite book}}: CS1 maint: location missing publisher (link){{cite web}}: CS1 maint: numeric names: authors list (link){{cite web}}: CS1 maint: numeric names: authors list (link)
| Processes |  | ||||||
|---|---|---|---|---|---|---|---|
| Bootingfirmware |
| ||||||
| Hybrid firmware bootloader | |||||||
| Bootloaders |
| ||||||
| Partition layouts | |||||||
| Partitions | |||||||
| Utilities |
| ||||||
| Network boot | |||||||
| ROM variants | |||||||
| Related | |||||||