How to Root Android: Unlock the Bootloader, Then Install Magisk

Rooting gives apps you approve access to the phone’s superuser account, which Android keeps to itself. Android’s security documentation: “By default, on Android only the kernel and a small subset of the core services run with root permissions.” On today’s phones, rooting takes two steps: unlock the bootloader, then patch your phone’s own boot image with a root tool such as Magisk and flash it from a computer.

Neither step has an official shortcut. The installation guides of Magisk, KernelSU and APatch all require an unlocked bootloader, and their main installation steps flash the patched image from a computer. Magisk 31.1 uses fastboot for most phones and samloader for Samsung firmware. Its in-app Direct Install only works on a phone that is already rooted.

This guide covers what unlocking costs, the unlock itself by brand, installing Magisk, and how to go back.

What unlocking and rooting cost

Read this part first. Most of it can’t be undone by locking again.

• Unlocking erases the phone. Android’s documentation: “For privacy reasons, unlocking the bootloader deletes user data. After unlocking, all data on the device is erased, including both private app data and shared data accessible over USB (including photos and movies).” No official method unlocks without that wipe; back up first. Locking it again later wipes it again: Android’s Verified Boot rules say “all state transitions wipe the data partitions”.
• A warning at every start. An unlocked phone shows a warning screen each time it boots, before Android loads. Android’s guidelines make it orange and dismiss it after ten seconds; each maker’s screen looks a little different. It stays as long as the bootloader is unlocked.
• Payments and some apps. Google Wallet’s help page lists phones that “Are rooted, run a custom ROM, or have modified factory software” and phones that “Have an unlocked bootloader” among those where tap to pay may not work. Apps can ask Google’s Play Integrity service about your phone: on Android 13 and later, its device-integrity verdict needs “hardware-backed proof that the device bootloader is locked”. What an app does with that answer is up to the app, and it can refuse to work. Magisk says plainly: “Magisk no longer handles root hiding.” This guide doesn’t cover hiding root.
• System updates. On most phones, updates need extra steps while rooted (see After rooting). Magisk’s guide for Samsung phones: “Once you have rooted your Samsung device, you can no longer upgrade your Android OS through OTA”; you flash new firmware by hand instead. Sony’s unlock page says “you will not be able to get any more official software upgrades if you unlock the bootloader.”
• Warranty. It depends on the maker. Motorola: “Once you get the unlock code, your device is no longer covered by the Motorola warranty.” Sony: “you may void the warranty”. On Samsung phones, installing Magisk trips the Knox warranty bit, which Samsung describes as “a one-time programmable bit e-fuse”; after that, Samsung Pay and Secure Folder stop working, permanently. We found nothing from Google on unlocking and the Pixel warranty.

Step 1: Can your phone be unlocked?

Maker	How to unlock	What can stop you
Google Pixel	Turn on OEM unlocking, then fastboot flashing unlock	Pixels locked to a carrier: the setting is greyed out
Samsung	Turn on OEM unlocking, then unlock in Download mode; no fastboot	After enabling Maintenance Mode as Magisk directs, no OEM Lock line in Download mode means the phone is “probably not unlockable”, as with US and Canadian models
Motorola	An unlock code from Motorola’s website, after you sign in and enter your device ID	Carrier-exclusive models, “ex. Verizon, AT&T, Tracfone”
Sony Xperia	An unlock code from Sony’s generator, using the phone’s IMEI (IMEI 1 on dual-SIM phones)	In the service menu (dial *#*#7378423#*#*), Bootloader unlock allowed has to say Yes; two US variants aren’t supported
OnePlus	For T-Mobile editions, an unlock token requested from OnePlus, which “may take 1-2 weeks”	We found no official OnePlus guide for other models
Xiaomi	Apply through the Xiaomi Community app, then unlock with the Mi Unlock tool on a computer	Xiaomi: unlocking permission “will only be available to certain users”, with a daily quota of applications; check the Community app for the current rules

For other brands, look for an unlock program on the maker’s support site. Xiaomi’s own advice: “For regular users, it is highly recommended to leave the bootloader locked (default state) and not unlock it.” Our guide to unlocking the bootloader goes through each brand step by step, Xiaomi’s application included.

Step 2: Turn on OEM unlocking

1. Open Settings › About phone and tap Build number seven times, until you see “You are now a developer!” On Samsung phones it is under About phone › Software information.
2. In Developer options, turn on OEM unlocking, whose description reads “Allow the bootloader to be unlocked”, and USB debugging.

If OEM unlocking is greyed out, its description says why: “Connect to the internet or contact your carrier”, “Unavailable on carrier-locked devices”, or “Bootloader is already unlocked”. Android’s documentation suggests connecting to the internet so the phone can check in, and adds: “If OEM unlocking remains unavailable, your device might be SIM locked by your carrier and the bootloader can’t be unlocked.”

Step 3: Set up the computer

• Download Google’s SDK Platform-Tools for Windows, macOS or Linux and unzip it. It contains adb and fastboot. Use the latest version; fastboot flashing unlock needs at least 23.0.1.
• On Windows, install a USB driver: the Google USB Driver for Pixel phones, or the maker’s driver for others. Google: “If you’re developing on macOS or Linux, then you do not need to install a USB driver.”
• Connect the phone, run adb devices, and on the phone accept the prompt to allow USB debugging from this computer.

Step 4: Unlock the bootloader

Pixel, and phones that use fastboot, from the Platform-Tools folder:

adb reboot bootloader
fastboot devices
fastboot flashing unlock

The second command should list your phone. After the third, the phone asks you to confirm, usually by choosing the unlock option with the volume keys and pressing power. It erases everything and restarts. Nexus phones from before 2015 use fastboot oem unlock instead, and Motorola and Sony give you their own command along with the unlock code. On most Pixels you can also reach the bootloader with the phone off by holding Volume Down and then Power.

Samsung, following Magisk’s 31.1 guide: first open Settings › Device Care › Maintenance Mode and enable it, then enter Download mode to read the OEM Lock and KnoxGuard status. Only after doing that check should a missing OEM Lock line be treated as the guide’s “probably not unlockable” result. To unlock, turn on OEM unlocking and power off. Hold Volume Up and Volume Down together while you plug in the USB cable; older phones with a Home button use a different combination. At the warning screen, long-press Volume Up to unlock; the phone erases itself and restarts. Go through the initial setup, making sure the phone connects to the internet, then turn on Developer options again and check that OEM unlocking is still there and greyed out: that means Samsung’s KnoxGuard lock hasn’t locked the phone, which would block Magisk whether or not the bootloader is unlocked.

Message	What it means
Flashing Unlock is not allowed	OEM unlocking is off, or not allowed on this phone (see Step 2)
< waiting for any device >	The computer doesn’t see the phone in fastboot mode: on Windows, a missing driver; otherwise try another cable or port
unknown command	An old fastboot; update Platform-Tools. Or the phone uses its maker’s own oem command
Flashing is not allowed in Lock State	The bootloader is still locked; unlock it before flashing anything

Step 5: Get your phone’s boot image

Magisk patches the image from your phone’s firmware that contains the ramdisk: boot.img, init_boot.img or vendor_boot.img; a phone without a boot ramdisk uses recovery.img. Take it from the same build that is installed. Magisk 31.1 can extract it from an official OTA zip, payload.bin or factory-image zip, from local storage or a direct HTTPS URL. Our guide to extracting boot.img from an OTA or payload.bin covers the separate Payload Dumper route.

Use only your own image. Magisk’s guide: “NEVER flash patched image shared by others or patch image on another device even if they have the same device model! You may need to do a full data wipe to recover your device.” Keep a copy of the unpatched image off the phone; it is how you get out of a boot loop.

Step 6: Patch and flash with Magisk

1. Install the Magisk app. Its home screen shows Ramdisk: Yes means you patch the partition image containing the ramdisk: boot, init_boot or vendor_boot.
2. Copy the raw image or official firmware package to the phone. In Magisk, tap Install on the Magisk card, choose Patch firmware / image, then Select from storage. The same screen can instead accept a direct image URL; Pixel phones also offer a download for the factory image matching the installed build.
3. Copy the result back to the computer: adb pull /sdcard/Download/magisk_patched-[version]_[random_strings].img.
4. Run adb reboot bootloader, then flash it to the partition it came from: fastboot flash boot magisk_patched-[version]_[random_strings].img, fastboot flash init_boot …, fastboot flash vendor_boot … or fastboot flash recovery ….
5. Restart and open Magisk. It asks to fix its environment; accept and wait for one more restart.

Samsung phones get a whole firmware package instead of one image. Magisk’s 31.1 guide tells you to download the firmware from Samsung with samloader-rs, copy its AP file to the phone, patch it in Magisk, and pull the patched .tar back with adb (“DO NOT USE MTP as it is known to corrupt large files”). Back in Download mode, use the samloader command on the computer to flash the patched file as AP, together with BL, CP and CSC from the same firmware—not HOME_CSC. This wipes the phone again: “Installing Magisk for the first time REQUIRES a full data wipe (this is NOT counting the data wipe when unlocking bootloader).” Odin remains another Samsung flashing tool, but it is not the path in this version of Magisk’s guide.

Ramdisk: No means Magisk lives in the recovery partition. You patch recovery.img with Recovery Mode ticked, and Magisk is only active when you start the phone with the recovery key combination and release the keys at the splash screen. A normal start runs Android without root.

Other root tools: KernelSU and KernelSU Next work in the kernel, and KernelSU officially supports GKI kernels 5.10 and later, in practice phones that came with Android 12 or later. APatch always patches boot.img, never init_boot. Our comparison of KernelSU, APatch and Magisk helps you choose.

After rooting

• Approve root apps first: Magisk 31.1 removed reactive superuser request prompts. Open its Superuser tab and explicitly grant each app before that app tries to use root; return there to revoke access later.
• Modules add features and change system files. MMRL browses and installs them; LSPosed needs Magisk’s Zygisk.
• System updates: Magisk asks you to turn off Automatic system updates in Developer options. When an update comes, choose Uninstall › Restore Images in Magisk without restarting, install the update in Settings, and before restarting, choose Install › Install to Inactive Slot in Magisk. That works on phones with A/B slots; on others, you flash Magisk again after the update. On Samsung, you patch the new firmware’s AP and flash it with HOME_CSC.
• Stuck in a boot loop after a module: with USB debugging, run adb shell magisk --remove-modules. Without USB debugging, Magisk’s FAQ suggests its Safe Mode: press Volume Down some seconds before the boot animation and let go as soon as it appears, which should start the phone with modules disabled.
• Won’t boot after flashing: flash the stock image you kept, the same way you flashed the patched one.

How to undo it

• Unroot: “The easiest way to uninstall Magisk is directly through the Magisk app.” Or flash your stock init_boot or boot image back.
• Restore a Pixel completely with the Android Flash Tool at flash.android.com in Chrome or Edge, using its back to public option, or by installing Google’s full OTA image with adb sideload, which Google says works “without the need to wipe the device or unlock the bootloader”.
• Samsung goes back with a full flash of the stock firmware. Magisk’s guide warns never to restore only boot, init_boot, recovery or vbmeta to stock: “You can brick your device by doing so”. The Knox warranty bit stays tripped.
• Lock the bootloader again only once the phone runs complete stock firmware, at least as new as what it had before. A locked phone only starts software signed with a key it trusts, normally its maker’s. Its Verified Boot also stores a rollback index, a security version number taken from the newest software it has started, and when locked it rejects software with a lower one; on an unlocked phone, Android’s Verified Boot documentation notes, such “rollback index failures are allowed”. So locking with Magisk still installed, or with an older stock build than the phone had, can leave it unable to start, with a message that no valid operating system could be found.
• On Pixels, mind the bootloader updates that raise that limit. Google’s factory-image page warns, for example, that after the May 2026 update on the Pixel 10 series “you won’t be able to flash and boot older Android 16 builds”, and that the inactive slot still holds the old bootloader, which can leave the phone unbootable; it says to sideload the full OTA once after first booting such an update, so both slots hold a bootable system. Other makers have their own rules: follow the instructions for your model.
• Then lock with fastboot flashing lock, or fastboot oem lock on older phones. Locking wipes the phone again. Afterwards, turn OEM unlocking off in Developer options.