Which Android Phones Can Still Be Rooted in 2026

The picture changed in both directions this year. Samsung removed bootloader unlocking from every region in One UI 8 and stripped the unlock code out of the bootloader itself. Xiaomi replaced its seven-day wait with a daily quota most applicants never win. But budget Unisoc phones, written off as permanently locked for years, are now unlockable through a BootROM exploit with a maintained device list.

The short answer

Check your own phone first

This settles it faster than any list.

Step 1. Open Settings → About phone. On Samsung, go into Software information first.

Step 2. Tap Build number seven times.

Step 3. Back out to Settings → System → Developer options. On Samsung it sits at the bottom of the main Settings list.

Step 4. Look for OEM unlocking.

What you find means:

From a computer you can confirm with:

fastboot flashing get_unlock_ability

A result of 1 means unlocking is permitted. 0 means it is blocked.

If the toggle is missing, that is not always the end. Unisoc and some MediaTek devices have BootROM-level routes that do not depend on it. Those sections are below.

Samsung: One UI 8 ended it

This is the biggest change in Android modding this year.

Samsung has blocked unlocking on US models for years. With One UI 8 that went global. XDA contributor salvo_giangri reverse-engineered the One UI 8 Settings app and found Samsung sets ro.boot.other.locked=1 on all devices regardless of region, which is the flag that hides the OEM unlocking toggle.

What makes this different from a normal restriction: the unlock logic appears to have been stripped from the bootloader itself, not merely hidden in the UI. There is no toggle to re-enable and no property to flip. Chipset exploits do not help either, because Samsung verifies its own bootloaders.

Where your Samsung stands

Two warnings worth reading twice

If your Samsung is still on One UI 7

The toggle can be missing for reasons other than One UI 8:

• The device must be signed into a Google account and online. The toggle checks with a server.
• Wait seven days from setup or from the last factory reset. Both Samsung and Google gate it initially.
• Confirm the model code is not a US or carrier variant. Check the box or under the SIM tray.
• Make sure you are in Developer options proper, not a stale Settings search result.

Unlocking still trips the Knox e-fuse permanently. Samsung Wallet, Secure Folder and Knox enterprise apps stop working and do not return after re-locking. Our Knox warranty explainer covers what you lose.

Xiaomi, Redmi and POCO: the queue

The old process was simple: bind your Mi account, wait 168 hours, unlock. That still applies on older MIUI devices, which is why so many guides describe a seven-day wait.

HyperOS replaced it with something much harder.

What it now takes:

• A Xiaomi account at least 30 days old, on the device, with matching SIM and mobile data active
• The request made through the Xiaomi Community app, not the old settings flow
• A daily quota. Applications open at 00:00 Beijing time (GMT+8) and run out fast. “Application quota limit reached” is the normal outcome
• If approved, a further wait of roughly 72 to 168 hours, staying logged in throughout
• A policy limiting unlocks to roughly one device per year per account

Chinese-market devices are harder again, with higher Community level requirements and real-name verification. Some CN models are effectively closed.

The practical split: older Xiaomi, Redmi and POCO on MIUI is a seven-day wait and a good candidate. A recent HyperOS device is a queue you may not win, and nobody can promise how long. This is why we no longer recommend current POCO models as a budget rooting pick, which an earlier version of this page did.

Unisoc: the correction

The reference tooling is TomKing062/CVE-2022-38694_unlock_bootloader, which maintains a support list and a blacklist on its wiki. That list is the authority, not any brand's policy.

Chipsets with documented success include UMS9230 (T606, T612, T616), UMS512 (T610, T618) and SC9863A.

Confirmed devices reported working include the itel S23, Realme C53, Umidigi A15C, Hotwav Cyber 13, FOXXD A67L and the Lenovo Tab M10 3rd Gen, among many others.

The Realme C53 case is worth noting: Realme officially restricts unlocking to China and India, yet the exploit route works on that device regardless of where you bought it. Chipset-level access does not care about regional policy.

How the process differs

You enter BootROM mode rather than fastboot, usually by powering off and holding both volume keys or volume down while plugging in USB. Then spd_dump sends an unsigned loader to a specific memory address to bypass signature checking, backs up the bootloader partitions, and writes a modified one. After that the device unlocks and behaves like a normal fastboot device for flashing Magisk.

Check the support list for your exact model before starting. If your device is on the blacklist, it is on there for a reason.

MediaTek: the other exploit route

Older MediaTek devices have their own BootROM path through bkerler/mtkclient, which bypasses the manufacturer's unlock policy entirely on vulnerable chips.

The cutoff is roughly 2022. Most MediaTek devices released before then are susceptible. On devices after that, the preloader vulnerability was patched and the BootROM is blocked by eFuse, so attempting it just bootloops the preloader. A separate DA-level exploit reportedly extends coverage into 2024 on some models.

This matters most for budget devices from brands whose official policy is “no.”

The brand list

Verified against manufacturer policy, XDA reporting, and the community tracker at zenfyrdev/bootloader-unlock-wall-of-shame, which documents around forty brands.

Tier 1: Standard fastboot, no account, no wait

The OnePlus caveat. Global OnePlus is genuinely easy today. But Chinese models that shipped with ColorOS 16.0 or newer now require a Deep Testing application, with a 30-day cooldown and roughly two-day approval. What matters is the shipping firmware, not the current version: a Chinese unit that shipped on ColorOS 15 and later updated to 16 keeps the standard path. OnePlus and OPPO share a codebase and OPPO already gates unlocking this way, so this spreading to global models is a real risk.

Tier 2: Account, wait or approval required

Tier 3: Restricted, conditional or a lottery

Tier 4: Effectively closed

Asus: what actually happened

Asus used to be one of the friendliest brands, which is why outdated guides still recommend it. That ended.

Asus's own statement to customers, quoted on its ZenTalk forums: phones released after January 2024 will no longer actively provide the Bootloader Unlock Tool, and for models released in 2023 or earlier the tool was withdrawn from the official website citing stability considerations.

The tool was a client that talked to an Asus server. Those servers are off, so the tool would not work even if you found a copy. This affects the ROG Phone 6, 7 and 8, Zenfone 9 and 10, and everything newer. Asus settled a UK lawsuit and refunded a customer over the undelivered unlock feature.

The narrow exceptions:

• Devices unlocked before the shutdown stay unlocked. Nothing revoked existing unlocks.
• Some older Zenfone models had community fastboot workarounds documented on XDA that unlock temporarily per boot session. These are model-specific and fiddly.
• Exploit research targeting Qualcomm and Adreno vulnerabilities is ongoing in the ROG community, but nothing production-ready exists.

If you own an already-unlocked Asus, keep it that way. If you are buying, buy something else.

Nokia and HMD: per model, not per brand

Nokia is not a blanket no. HikariCalyx maintains hmd-nokia-codename, a per-device database of codenames and which unlock method applies. Four documented routes exist:

Which applies depends on your exact model and hardware revision. Same model name does not mean same internals: different TA-numbers of the same Nokia can have different unlock policies.

Worth knowing the limits. The Nokia G22, despite using the same Unisoc T606 as devices that unlock cleanly, has resisted community attempts consistently. Check the database for your specific TA-number before assuming either way.

Two things that cut across every brand

Chipset can override brand policy

The order to check things in:

• What chipset? Unisoc and older MediaTek have BootROM routes independent of what the manufacturer allows.
• What does the manufacturer allow? Only matters if there is no chipset route.
• What does the carrier allow? Overrides both.

This is why a cheap Unisoc phone from a brand with a hostile policy can sometimes be easier than a mid-range device from a cooperative brand.

Carrier locks override manufacturer policy

• United States. Verizon blocks unlocking across the board, including on Pixels. T-Mobile is more permissive, but OnePlus devices bought through T-Mobile or Metro need an unlock token tied to the original purchase, which second-hand buyers cannot get.
• Canada. The CRTC Wireless Code requires devices sold after 1 December 2017 to be unlockable. Unusually friendly.
• Japan. NTT Docomo greys out the toggle on its branded devices entirely.

Buy unlocked from the manufacturer. It is the single decision that avoids the most problems.

What to buy if rooting is the point

Google Pixel, direct from Google. Still the best answer and not close. Standard fastboot, factory images for every build, the platform every rooting tool targets first, GrapheneOS available. Avoid carrier units, especially Verizon.

Nothing Phone. Standard fastboot plus custom AVB key support, letting you run a custom OS with the bootloader re-locked. A better security position than most rooted setups, and very few devices offer it.

OnePlus global. Easy today. Understand the OPPO codebase risk before a multi-year hold.

Sony Xperia 2020 or newer. IMEI submission is a real hurdle, but 2020-onward models support custom AVB keys.

Motorola G3x and above. Reasonable budget option. Verify your model is in the programme first, since E-series and lower G-series are not.

A supported Unisoc budget device, if you are comfortable with BootROM work and check the support list first. This is a genuinely new option compared to a year ago.

No longer recommended: current POCO and Redmi models because of the HyperOS queue; Asus because the servers are off; and Samsung unless it is an older non-US unit still on One UI 7.

Before you buy anything for rooting

• Check the chipset first. It may open a route the brand does not offer.
• Buy unlocked from the manufacturer, never a carrier.
• Confirm the exact model code and hardware revision, not the marketing name.
• On Samsung, confirm the One UI version and understand any update may close the door permanently.
• Give a brand-new release several weeks before expecting a working procedure.
• Confirm stock firmware is publicly available for your exact model. That is your recovery route.

Frequently asked questions

Can my Samsung still be rooted?
Only if it is a non-US model still on One UI 7 or older with the toggle present. Once it goes to One UI 8, unlocking is gone and cannot be restored.

Is there a workaround for the One UI 8 restriction?
Not currently. The unlock logic appears removed from the bootloader rather than hidden, and Samsung verifies its own bootloaders, which blocks the chipset routes that work elsewhere. Treat anyone selling a One UI 8 Samsung unlock with heavy scepticism.

Can Unisoc phones really be rooted?
Yes, many of them, through the CVE-2022-38694 BootROM exploit rather than normal fastboot. It is model-specific, so check the maintained support list for your exact device. Using the wrong loader files can erase the phone.

Why does my Xiaomi keep saying quota limit reached?
The daily allocation was already taken. Applications open at midnight Beijing time and go quickly. It is not a device fault and no setting fixes it.

My OEM unlocking toggle is greyed out. Can that be fixed?
Sometimes. Make sure the device is online and signed into a Google account, and wait out the initial period after setup. If it stays greyed after that it is usually a carrier lock, which software does not fix.

Does unlocking delete my data?
Yes, always, on every device. There is no version that preserves data. Back up first.

Can I re-lock afterwards?
Usually, but re-locking with modified software installed can leave a device that will not boot and will not accept a flash. Return to unmodified stock first. Nothing and recent Sony are the exception, since custom AVB keys let you re-lock properly with a custom OS.

Is my new 2026 flagship rootable?
Check the brand tier, then give it a few weeks after release even on a cooperative brand. Tooling lags new firmware, and being first is how people brick phones.

Why did rooting get harder?
Several manufacturers tightened at once across 2025 and 2026: Samsung removing it outright, Xiaomi adding quotas, OPPO and OnePlus adding approval programmes, Asus shutting its servers. The counter-trend is chipset-level exploits opening up devices the manufacturers never intended to be open.

Related reading: Bootloader unlock guide · How to root any Android device · Complete Android rooting guide · Magisk vs KernelSU vs APatch · Samsung Knox warranty explained · Android rooting risks

Sources: Community bootloader unlock tracker at zenfyrdev/bootloader-unlock-wall-of-shame. TomKing062 CVE-2022-38694 support list. HikariCalyx hmd-nokia-codename database. bkerler/mtkclient. XDA Forums firmware analysis of One UI 8 by salvo_giangri. Asus ZenTalk official statements. Xiaomi Community unlock documentation. OnePlus Deep Testing announcement.

Last verified: 29 August 2026. Manufacturer policies and exploit availability both change without notice. Confirm against your exact model and the linked device lists before buying or attempting anything.