Advertisement

If you’re venturing into software modifications such as rooting, installing custom recoveries, flashing custom ROMs, or anything else in between, then you will first need to unlock the bootloader of your Samsung Android device.

In this guide, you will learn how to properly unlock the bootloader on Samsung Galaxy phones and tablets. I will be covering all the aspects of the process in detail, from enabling OEM unlocking, all the way to disabling the new VaultKeeper service.

I am pretty sure you’d be excited to jump to the instructions. But let me ask you to slow down a bit. Before everything else, I want to talk about the bootloader on Samsung devices and the unlocking process, and share some of the key information regarding it. I encourage you to read ahead, especially if you’re someone who is new to the scene. Even if you’re not, you might learn a thing or two apart from what you already know.

Table of Contents

Introduction

Samsung is known for complicating things when it comes to custom development. Almost every year, the manufacturer introduces at least one of their special new security features, which in most cases, affects the custom development process directly or indirectly.

Yes, such features play important role from a security standpoint, but they also tend to discourage the developers.

Think of it as this way, the developers always have to keep up with new Android versions and any core changes introduced by them. Like A/B partitions, Boot Image Header versions, mount-points, etc in the past. Then it’s the OEM-specific changes that are done to the code. It’s quite a lot to handle, to say the least.

And on top of all this, we have Samsung, which is known to implement its own flavored code into the mix. Magisk’s creator John Wu has called out Samsung on several occasions. Here’s one where the developer pointed out how the AVB implementation on Qualcomm Galaxy devices was broken, detailing some of the bugs he found.

AndroidPolice also did a piece on why Samsung devices still don’t support seamless updates, John Wu jumped in with his opinion, stating that “Samsung is definitely THE worst for modding“.

Magisk creator's John Wu's opinion on Samsung and software modding

Anyways, I (or John) am not discouraging you from buying Samsung devices. For an average customer, I think they are great devices with a crisp-looking display and powerful hardware. I am just trying to provide you with some context of what you’re dealing with.

The Bootloader on Samsung Galaxy Devices

Have you wondered why you cannot flash partition image files with Fastboot to a Samsung device in the first place? or why is there no “Fastboot Mode” to begin with?

That’s because Samsung (again!) chooses to use its own flavored bootloader implementation. I came around this very interesting discussion on Reddit from a few years ago. A fellow Redditor (u/aliniazi) in that thread stated that Samsung uses its own layered bootloader system. Hmm.. that’s interesting as I never knew that myself and neither am I sure if it stands correct, but it does make sense.

Samsung Galaxy devices have their own “Download Mode” (or “Odin Mode”). If you’re not yet familiar, Download Mode is a special interface that allows your device to communicate with a computer for flashing official firmware and custom binaries (such as Magisk-patched AP firmware) through Odin or Heimdall tool.

Samsung and Bootloader Unlocking

First stage: For a long time, users could root, install custom recoveries like TWRP, and flash custom binaries to Samsung Galaxy devices without having to unlock the bootloader at all. I think that’s not a common exception.

Second stage: Later on, starting with Galaxy S7 (I think) the devices included the OEM unlock (or OEM unlocking) switch, which needed to be enabled in order to flash custom binaries. It seemed like just flipping a switch in the Settings menu was all you needed to do to get started with software modding.

In my opinion, that’s not exactly a good approach either. It was never clear to me if turning on OEM unlock back then actually unlocked the bootloader. Or did it enable the bootloader to accept custom binaries and the bootloader was always unlocked?

Third stage: Moreover, Samsung introduced RMM/KG state around the same time, leading to the missing OEM unlock issue. If triggered, the Prenormal RMM/KG state would prevent the device from booting if a modification was detected.

Prenormal KG/RMM state on Samsung devices disables OEM unlocking

Upon which, you’d need to restore the stock Samsung firmware and wait for a period of 7 days before you could attempt to flash custom binaries again. Thanks to some awesome developers at XDA, a patch was released to help bypass KG/RMM state when dealing with software modifications.

So up until this stage, you didn’t have to actually unlock the bootloader to get started with things like rooting, custom ROMs, recoveries, etc.

Fourth (current) stage: This brings us down to the current scenario. With the launch of the Galaxy S10 series and devices thereafter, Samsung finally introduced a proper way to unlock the bootloader.

The good part about it was that the bootloader on Samsung Galaxy devices can be unlocked on the device itself, without needing a computer. It’s comparatively convenient than using Fastboot to unlock the bootloader on Google Pixel devices and OnePlus devices or using a dedicated tool like Mi Unlock Tool in the case of Xiaomi devices.

Wait, that’s not it. Magisk’s creator John Wu pointed out that Samsung introduced another one of their “special features” again, known as “VaultKeeper“. VaultKeeper service in Samsung devices is basically another lock on top of the OEM lock that would automatically relock the bootloader after the /data partition is wiped (which happens when you unlock the bootloader).

To deal with this, users will need to go through the initial setup and connect the device to the internet after unlocking the bootloader. After doing so, VaultKeeper will change the bootloader status from “locked” to “unlocked”.

And that sums up the current status of bootloader unlocking on Samsung Galaxy devices. With that aside, let us now move on to the instructions and guide you on how to properly unlock the bootloader on Samsung Galaxy smartphones and tablets.

Which Devices are Supported?

This guide is applicable to all latest Samsung Galaxy smartphones and tablets launched alongside or after the Galaxy S10 with the new VaultKeeper service. If you own a device launched prior to that, you could simply enable OEM unlocking and call it a day.

Below is a list of some known Samsung devices that are supported by this guide.

  • Galaxy S22, Galaxy S22+, and Galaxy S22 Ultra
  • Galaxy S21, Galaxy S21+, Galaxy S21 Ultra, and Galaxy S21 FE
  • Galaxy S20, Galaxy S20+, Galaxy S20 Ultra, and Galaxy S20 FE
  • Galaxy S10, Galaxy S10+, and Galaxy S10e
  • Galaxy Note 20 and Note 20 Ultra
  • Galaxy Note 10 and Note 10+
  • Galaxy Tab A 8.4 (2019)
  • Galaxy Tab A 10.1 (2019)
  • Galaxy Tab A7 10.4 (2020)
  • Galaxy Tab S5e
  • Galaxy Tab S8, S8+, and S8 Ultra
  • Galaxy Tab S7 and Tab S7+
  • Galaxy Tab S6 and Galaxy Tab S6 Lite
  • Galaxy Z Fold4
  • Galaxy Z Flip4
  • Galaxy Fold

Again, this is not a complete list.

Your Samsung Galaxy device may support this new bootloader unlock method and VaultKeeper service if:

  • It was released around the same time as the Galaxy S10 or after that.
  • It was launched with Android 9 Pie, Android 10, Android 11, or Android 12 out-of-the-box.

Before You Proceed

Requirements: The only thing you’ll need to follow this tutorial would be your Samsung Galaxy smartphone/tablet itself. However, you may also need a compatible USB cable and a computer in order to enter Device Unlock Mode/Download Mode on more recent devices.

Take a backup: Unlocking the bootloader will erase all the data stored on it. It includes the installed apps and their data, messages, call logs, photos, videos, music, and everything stored on the device’s internal storage.

So, make sure to take a complete backup of all your important data beforehand. The easiest way to do so is by using Samsung’s own Smart Switch software. If you feel handsy, you can do it manually as well. For guidance, see our Android backup guide.

Important Notes:

  • Only unlocking the bootloader of your Samsung Galaxy device will not trip the KNOX counter.
  • However, flashing a custom binary such as TWRP or Magisk patched AP firmware will instantly trip it. This may have an effect on your device’s official warranty, so make sure that you check with your regional Samsung support if you’re concerned.
  • Furthermore, apps like Secure Folder, Samsung Pay, etc rely on KNOX integrity to function. Once KNOX is tripped (that’s after you flash a custom binary), such apps will stop working.
  • Samsung Galaxy devices with a Snapdragon chipset that are sold in the USA and Canada come with a non-unlockable bootloader. The only way to unlock the bootloader on US Snapdragon devices is by using a paid service such as UNSAMLOCK.

How to Unlock Bootloader on Samsung Galaxy Phones and Tablets

The process of unlocking the bootloader on Samsung Galaxy devices is a tried and true one. In brief, you first have to enable OEM unlocking, then boot the device into Unlock Mode and unlock the bootloader, and finally finish the initial setup and verify the bootloader status to disable VaultKeeper.

Easy enough? No? Don’t worry, the instructions below will take you through the complete process in detail. I have split the instructions into five major steps so that it’s easier for you to understand.

Let’s begin!

Step 1: Enable Developer Options

The OEM unlocking option that’s needed for bootloader unlocking resides inside the “Developer options” menu in your device Settings. This menu is hidden by default on all Android devices running Android JellyBean and above to prevent the users from accessing them unknowingly.

Enable Developer Options on Samsung Galaxy device

To enable Developer Options on your Samsung Galaxy device:

  1. Go to the app drawer and open the “Settings” app.
  2. Scroll down to the very bottom of the screen and select “About phone” or “About tablet“.
  3. Tap “Software information“.
  4. Repeatedly tap the “Build number” section five times.
  5. Enter your device’s lock screen PIN/Password/Pattern when prompted.
  6. You should now see the “Developer mode has been enabled!” toast notification on the screen.

Step 2: Enable OEM Unlocking on your Samsung Galaxy Device

To unlock the bootloader, it is very important to first turn on the OEM unlocking option on your Samsung Galaxy device.

Now that you have turned on Developer Options, navigate to “Settings” > “Developer options” on your device. Then scroll down until you find “OEM unlocking” and press the toggle next to it. You should then see a prompt on your device’s screen to “Allow OEM unlocking“, so select “Enable“.

Enable OEM unlocking on Samsung Galaxy devices

If the OEM unlocking toggle is missing:

  • Make sure that your Samsung Galaxy device is connected to the internet and re-check. The device needs to communicate with Samsung servers for identification.
  • Samsung Galaxy devices that are sold in the USA with a Qualcomm Snapdragon SoC come with non-unlockable bootloaders (officially). And so, the OEM unlocking option does not exist on such devices.

Step 3: Enter Device Unlock Mode

Turning ON OEM unlocking enables a special mode known as “Device Unlock Mode“. This mode can be accessed while booting into Download Mode and you will be utilizing it to unlock the bootloader on your Samsung Galaxy device (it can be used to relock the bootloader as well).

Now, there are two methods that you could follow to get your Samsung Galaxy smartphone or tablet into Download Mode.

  • This method is generally what we usually follow. It involves pressing a dedicated physical key combination while the device is turned OFF. Well, this method is also hard to demonstrate as the key combination may vary from device to device.
  • The second method is by executing an ADB command from your computer. If you’re experienced with ADB or couldn’t find your device’s specific key combination to enter Download Mode, then this is the method I would suggest using.

Below is the link to our detailed guide that will help you boot your device into Download Mode using the said methods:

Access Device Unlock Mode

After you have done this, your Samsung Galaxy smartphone/tablet should show a blue-colored “Warning” screen as shown in the image below.

Device Unlock Mode on Samsung Galaxy devices

I usually like to refer to this “Warning” screen as the Bootloader Mode. This is because this screen gives you the option to boot your device into other modes, just like the Bootloader/Fastboot mode on other OEM devices.

This screen will list three options/actions for you:

  1. Volume up: Continue
  2. Volume up long press: Device unlock mode
  3. Volume down: Cancel (restart device)

Generally, you would press the Volume Up key to enter Download Mode to flash firmware binaries using the Odin tool. But since we’re here for unlocking the bootloader, long press and hold the Volume Up key to enter Device Unlock Mode on your Galaxy device.

Step 4: Unlock the Bootloader on your Samsung Galaxy Device

Once in Device Unlock Mode, you should see a confirmation prompt to unlock the bootloader. On the top, you should see a short warning message along with the information that unlocking the bootloader will perform a factory data reset and erase all your personal data from your device to prevent unauthorized access.

At the very bottom of the screen, you will see the following two options:

  • Volume up: Yes
    Unlock bootloader (may void warranty)
  • Volume down: No
    Do not unlock bootloader and restart device

Press Volume Up to confirm and unlock bootloader on Samsung Galaxy device

I suppose you know what to do here. Just press the Volume Up key to confirm and finally unlock the bootloader on your Samsung Galaxy smartphone/tablet.

Once the bootloader is unlocked and a factory data reset has been performed, your device will automatically reboot into the operating system.

During the initial phase of the booting process, you should see an obligatory warning message notifying you that the bootloader of your device is unlocked. Do not worry, it’s normal and you’ll get used to the message in a while.

Unlocked bootloader warning message during boot on Samsung Galaxy devices

Before you ask, the only way to remove this warning message is to relock the bootloader. And that’s not what you’re here for, right?

The first boot after unlocking the bootloader may take a few minutes. So be patient.

Step 5: Verify Bootloader Status and Disable VaultKeeper Service

Now while you may think that your device’s bootloader is completely unlocked, it’s actually not. Remember, how I mentioned the VaultKeeper service will relock the bootloader after a factory reset? No? Go back and read the “Samsung and Bootloader Unlocking” section.

To properly unlock the bootloader of your Samsung Galaxy device, you need to disable the VaultKeeper service from relocking the bootloader again. To do this, go through the initial setup and connect your device to the internet. You do not necessarily need to log into your Google or Samsung accounts, but you can do that as well if you want.

Once you have finished the setup, enable Developer Options on your device (See step #1 if you don’t remember how). Then go to “Settings” > “Developer options” and find the “OEM unlocking” option (if it’s missing, close Settings and re-try).

You should see the “OEM unlocking” option greyed out in an ON position stating – “Bootloader already unlocked“.

Verify OEM unlocking to disable VaultKeeper service on Samsung Galaxy

And…that’s it!

Verdict

So by now, you have learned how to properly unlock the bootloader on Samsung Galaxy smartphones and tablets by disabling the VaultKeeper service.

The part of the unlocking process where you deal with VaultKeeper is extremely important and is also something that the users could easily miss, which may result in the bootloader being relocked.

Unlike most other OEM Android devices, the bootloader on the latest Galaxy devices can be unlocked without the need for a computer, which is definitely a plus in my opinion

That aside, with your Samsung Galaxy device’s bootloader now unlocked, you can move onto things like rooting with Magisk, installing TWRP custom recovery, and more. And in case you need guidance for that, you could refer to your device-specific tutorial published on this blog (Use the search form).

If you have any questions regarding bootloader unlocking on Samsung Galaxy devices, or encounter any problems while performing the instructions, let me know through the comments.

When asking for help, please make sure to provide as much context about the situation as possible, like the device name/model, installed Android version, at what point did you face the issue, etc.

Comments

  1. I have a Samsung J7 Duo (SM-J720M) and even though I triple checked that OEM unlocking was switched on before rebooting into download mode, the Device Unlocking Mode option would not appear. Am I doing something wrong? I had to use a different key combination than what was mentioned (holding volume down + home button then connecting the usb cable) so I thought there may be a different way to do it with my phone. Also what may be important to note is that I enabled OEM unlocking years ago and I was thinking that maybe if I disable and reenable it then it might show up, but I don’t want to do it and then find out it doesn’t work and I just lose all my data without making any progress. Any help would be greatly appreciated.

    1. Martin, you’re doing everything correctly. The reason you’re not seeing the Device Unlock Mode on your Galaxy J7 Duo is because the new method, as well as the VaultKeeper service that we talk about in this article do not apply to your phone.

      I discussed three different stages when it comes to bootloader unlocking on Samsung devices. Your Galaxy J7 Duo falls under the second stage, wherein you just need to enable the OEM Unlocking switch and nothing else. With OEM Unlocking enabled, you essentially have the bootloader unlocked and ready for flashing. So if you want to install a custom recovery such as TWRP or root the phone, you can just go ahead with the respective process as the OEM Unlocking option is already enabled.

      Let me know if you have any further questions. I will be happy to answer.

  2. I use Samsung galaxy a32
    Bootloader successfully unlocked,but I really don’t want the annoying message that comes up,and can I try a system update? Because am stuck on android 11 here,please get back to me as soon as possible, I really need help,and what happens if I relock the Bootloader and how?

    1. Richards, after unlocking the bootloader, have you attempted to root your Galaxy A32? Let me know so that I can provide you with proper guidance.

  3. Tried the methods describe below to switch on OEM Unlock. Then I went into Download Mode, there is no option to access Device Unlock Mode. The OEM Unlock only appears for a few seconds before disappear again. I have to do a full reboot for it to appear again and then disappear. Any suggestion?

    1. Matt, please share the device name and model number.

      Device Unlock Mode will not appear until OEM unlocking is enabled.

  4. I have a unlocked Galaxy s10e. it doesn’t give OEM unlock option and download mode doesn’t give boot loader unlock option. It’s usa/Snapdragon. Any help?

    1. Chip, Snapdragon variants of the Galaxy S10e (and most other flagship Samsung Galaxy devices) sold in the USA do not support bootloader unlocking through the official method, as followed in this guide.

      Although, as I have mentioned in the article, if you REALLY want to unlock the bootloader on your Snapdragon Galaxy device, you will need to opt for a paid service such as UNSAMLOCK. Go through the original post of the thread for more information.

      Please note that I have personally not used the service. But several other users of the XDA-Developers community have.

  5. What a useful article I’ve found here!! Thanks a lot for your explanation!!

    Unfortunately my device (SM-A520F/DS) are in jail status with oem lock. I’m getting a headache because bypass this is very frustrating! I flashed a custom ROM which doesn’t matched my expectations and I flashed the stock ROM without take the precaution you mentioned above and because I was newbie doing this on these devices. In my case it’s a surprise this vault system works on Android 8.0… looks like a I need a graduation in how to unlock OEM on Samsung devices now.
    About my device, I just waited the damn 168 hours and nothing. What step should I take now?

    1. Yarkan, the issue you’re facing is not caused because of the VaultKeeper service, but due to the Prenormal RMM/KG State.

      This is something I have discussed in the following articles:

      1. Fix Misssing OEM Unlock Button on Samsung
      2. Prevent Prenormal KG/RMM State on Samsung Galaxy Devices (Guide)

      If I understand correctly, I believe you’re trying to move back to stock firmware, right? In that case, flashing the stock ROM shouldn’t be a problem at all. Just download the latest stock firmware using Frija or Samloader, and flash it via Odin. Once that is done, you might need to wait for 7 days (with your SIM card injected into the device and connected to the internet) for the KG State to return to Checking. The OEM Unlock toggle should then reappear, and you can turn it off.

Leave a Reply to Chip Cancel reply

Comment Policy: We welcome relevant and respectable comments. Only input your real first name and valid email address if you want your comment to appear. Read our comment policy fully before posting a comment.