Bootloader Unlocking Explained: What It Is, Risks & How to Check

“Unlocked” is the most overloaded word in the phone world. A listing that says “fully unlocked Pixel” might mean the phone works on any carrier — or that someone has unlocked its bootloader to install custom software, which is a completely different thing with completely different consequences.

This guide explains what a bootloader actually does, why manufacturers lock it, what changes when it’s unlocked, and how to check a phone’s real bootloader state in under a minute — whether you’re an enthusiast or a buyer trying to avoid surprises.

What a bootloader does

When you press the power button, the phone doesn’t jump straight into Android. A chain of small programs runs first. The bootloader is the link in that chain that loads the operating system, and on a locked device it checks a cryptographic signature on each piece before handing over control. This is Android’s Verified Boot: if the system or boot partitions have been changed, a locked bootloader refuses to start them or shows a warning.

A locked bootloader only runs software signed by the manufacturer. An unlocked bootloader will run anything — a custom ROM, a rooted boot image, a modified kernel. That freedom is the whole point for enthusiasts, and the whole risk for everyone else.

Bootloader unlock vs carrier (SIM) unlock

The two interact in one important way: on many carrier-sold phones, the OEM unlocking switch in Developer options stays greyed out until the phone is carrier-unlocked (and on some carriers, such as Verizon-sold Pixels, it never becomes available). That’s why our OEM unlocking greyed out guide starts with a carrier check. If you just want the phone to work on another network, you need a carrier unlock, not a bootloader unlock — see carrier-locked vs unlocked and the carrier and SIM-lock check.

How bootloader unlocking works

On most brands the process has the same shape, though the details differ:

1. Enable Developer options and switch on OEM unlocking. This sets a flag that allows the bootloader to accept an unlock command — it doesn’t unlock anything yet.
2. Reboot into the bootloader (fastboot mode) and send fastboot flashing unlock (older devices: fastboot oem unlock).
3. Confirm on the phone’s screen. The phone wipes all user data and reboots unlocked.

Some brands add a gate: Motorola issues unlock keys through its website, Xiaomi requires its own unlock tool and a waiting period tied to a Mi account, and certain regional models can’t be unlocked at all. Samsung uses Download mode instead of fastboot, and US Snapdragon Galaxy models generally don’t offer bootloader unlocking.

The real risks of an unlocked bootloader

Security

Verified Boot is what stops malware or a thief from modifying the system partition. With the bootloader unlocked, anyone with physical access can boot a modified image. For a daily phone holding banking apps and two-factor codes, that’s a meaningful downgrade.

Apps that check integrity

Google’s Play Integrity system lets apps ask whether the device is running certified, unmodified software. An unlocked bootloader usually fails the stronger checks, so some banking apps, contactless payments, streaming apps in HD, and games may refuse to work or downgrade features.

Samsung Knox

Samsung phones have a hardware Knox warranty bit (an e-fuse). Booting unofficial software after unlocking trips it from 0x0 to 0x1 permanently. Relocking doesn’t reset it. Afterwards, Samsung Wallet/Pay, Secure Folder and some Knox-based features stop working, and Samsung may decline warranty repairs. A Samsung Info report confirms the model and warranty record, but only the phone itself shows the Knox state — in Download mode, look for a line such as “WARRANTY VOID: 0x0” or similar, depending on model.

Warranty and updates

Google and OnePlus have historically been relaxed about unlocking; other brands may refuse warranty service. Official over-the-air updates may fail on a modified system.

How to check if a bootloader is unlocked

1. Watch the boot screen

Restart the phone. Unlocked devices show a warning before the logo — on Pixels, a message that the bootloader is unlocked and software integrity can’t be guaranteed; other brands show similar “device is unlocked” or “can’t be trusted” text. A locked phone boots straight to the logo.

2. Ask Android with ADB

With USB debugging on (see our ADB inspection guide):

adb shell getprop ro.boot.verifiedbootstate
adb shell getprop ro.boot.vbmeta.device_state
adb shell getprop ro.boot.flash.locked

• verifiedbootstate: green = locked, official software; yellow = locked with a user-installed signing key (rare, custom ROMs that support relocking); orange = unlocked; red = verification failed.
• vbmeta.device_state: locked or unlocked.
• flash.locked: 1 = locked, 0 = unlocked.

Not every manufacturer exposes all three, so an empty line isn’t a red flag by itself.

3. Ask the bootloader with fastboot

Run adb reboot bootloader, then:

fastboot devices
fastboot getvar unlocked
fastboot flashing get_unlock_ability
fastboot reboot

getvar unlocked returns yes or no. get_unlock_ability returns 1 if OEM unlocking is allowed and 0 if it isn’t — useful for buyers who want to unlock later. The bootloader screen on many phones also prints “Device state: locked/unlocked”. Our fastboot commands guide explains every output.

Buying a phone with an unlocked bootloader

An unlocked bootloader isn’t proof of anything bad, but it changes what you’re buying:

• Ask why it was unlocked and what software it’s running now. “I rooted it for a while” is fine; “I don’t know” isn’t.
• Prefer phones returned to official firmware and relocked (green state). Don’t relock it yourself unless you’ve confirmed it’s on stock software.
• Remember that an unlocked bootloader also makes a phone easier to tamper with — run a GSMA blacklist check as you would with any phone.
• For Pixels, the Google Pixel Info check confirms the variant (a Verizon model can’t be bootloader unlocked), and the Pixel carrier unlock covers network locks. For OnePlus, use the OnePlus Info check.

Verdict: carrier unlocking sets the network free; bootloader unlocking sets the software free, at a cost in security and app compatibility. For most people, a locked bootloader on official software is the right default — and for a buyer, a green Verified Boot state is the reassuring answer. The Pixel check guide covers the rest.