Fastboot OEM Unlock: Commands, Risks, and What Actually Happens

Bootloader unlocking is a prerequisite for installing custom recoveries and modifying the system partition. The unlock commands look deceptively simple, but the process involves firmware-level checks, a factory wipe, and permanent changes to your device's security state. This guide explains each step technically so you understand what is happening, not just what to type.

Prerequisites Before Running Any Unlock Command

Before touching Fastboot, three things must be true:

1. Fastboot is installed and working. You need the fastboot binary from the Android SDK Platform-Tools package. Run fastboot --version to confirm it is available. Fastboot must be version 28.0.0 or later for the fastboot flashing unlock command syntax introduced in Android 6.0 to work reliably.

2. OEM Unlocking is enabled in Developer Options. This toggle writes a flag to a protected partition (usually frp or a dedicated persist area) that the bootloader checks before honoring the unlock command. Without it, the bootloader rejects the unlock attempt with a message like "FAILED (remote: 'Flashing Unlock is not allowed')." Enable it under Settings > System > Developer Options > OEM Unlocking. On some carrier-locked devices, this toggle is grayed out or absent entirely, meaning the carrier has disabled bootloader unlock for that variant.

3. Back up everything you want to keep. The unlock command triggers a factory reset. All user data, applications, accounts, photos, and settings stored in the phone's internal storage are wiped. This is enforced by the bootloader, not by Android, so it cannot be bypassed. Content on a removable SD card is typically preserved.

The Two Unlock Commands Explained

There are two Fastboot unlock commands in common use, and which one applies depends on your device's Android version and the manufacturer's Fastboot implementation.

fastboot oem unlock is the original command used on devices running Android 5.1 and earlier, and it remains the correct command for some manufacturers (notably older HTC and Sony devices) regardless of Android version. On Google Pixel devices before the Pixel 2, this was the unlock command. The response on success is OKAY followed by the bootloader rebooting into Android recovery or back into Fastboot depending on the device.

fastboot flashing unlock was introduced as the standardized replacement starting with Android 6.0. Google required OEM adoption of this command syntax as part of the Android Compatibility Definition Document (CDD) for devices shipping with Android 6.0 and later. Most modern devices from 2016 onward use this command. Some devices support both commands for backward compatibility.

To determine which to use: check the official unlock instructions for your specific device model. If the manufacturer's documentation does not specify, try fastboot flashing unlock first (it is the modern standard). If you receive an error like "unknown command" or "not supported," try fastboot oem unlock.

On Google Pixel devices the full sequence is:

fastboot flashing unlock

The device will display a confirmation screen asking you to use the volume buttons to select whether to unlock and the power button to confirm. If you do not interact with this screen within 30 seconds on most devices, it automatically cancels the unlock.

What the Firmware Does During Unlock

When the bootloader receives a valid unlock command with the OEM unlock flag set, the following sequence occurs inside the firmware:

1. The bootloader sets a persistent flag in a protected storage area (often the misc partition or a dedicated eFuse/anti-rollback register depending on the SoC) marking the device as unlocked.
2. The bootloader erases the userdata partition, which contains all user data and app data. It also erases the cache partition on devices that have a separate one.
3. On devices with Android Verified Boot (AVB), the bootloader updates its trust chain: instead of only booting images signed by the manufacturer, it now also accepts images signed by any key (or no key, depending on AVB policy). This is what makes it possible to boot a custom recovery image.
4. The device reboots. If an operating system is present on the system partition (which was not wiped), it boots into Android and prompts for initial setup as if the device is new.

The key point is that only userdata is wiped, not system. The Android operating system itself remains intact. You are returned to factory software with no user data, as if you had done a factory reset from Settings.

Verifying Lock State

To check whether a device is currently locked or unlocked without running the unlock command, boot into Fastboot mode and run:

fastboot oem device-info

On Motorola and some other devices, this prints lines including Device unlocked: true or Device unlocked: false. On Google Pixel devices, use:

fastboot getvar unlocked

The output will be unlocked: yes or unlocked: no. On Samsung devices using the Odin/Heimdall protocol rather than standard Fastboot, the equivalent is checked via Download Mode, which displays the warranty bit state on screen.

You can also check from within Android (while fully booted) by going to Settings > System > Developer Options. Many devices display the OEM lock state there. Additionally, some phones show a brief warning on the boot splash screen when the bootloader is unlocked — an orange warning on Google Pixels, a similar message on Sony Xperia devices.

Relocking the Bootloader

If you want to return the device to a locked state (for sale, trade-in, or warranty service), the relocking commands mirror the unlock commands:

fastboot flashing lock

or on older devices:

fastboot oem lock

Relocking also triggers a factory wipe on most devices, for the same security reason as unlocking — the bootloader cannot trust that the currently installed userdata was created by verified software. Relocking only succeeds if the device is running officially signed firmware; trying to relock with a custom ROM installed will usually result in a boot loop because AVB will verify and reject the unsigned system image.

For Pixel devices, flash the official factory image first, then relock. The factory image includes a script that does this in the correct order.

Carrier-Locked Devices and Unlock Restrictions

Many devices sold through carriers (AT&T, Verizon, T-Mobile, etc.) have the OEM Unlocking toggle permanently disabled by carrier policy. The bootloader on these variants includes a carrier lock flag that cannot be changed by the end user. Devices sold directly by manufacturers (SIM-free or unlocked variants) typically do not have this restriction.

Xiaomi, as noted separately, uses an account-based unlock approval system through Mi Unlock. Samsung uses Knox-based warranty fusing: once fastboot oem unlock is run on a Samsung device, a hardware security counter called the Knox Warranty Bit is incremented permanently and cannot be reset, which disables Samsung Pay and some Knox security features even if the bootloader is later relocked.