How to check if an Android phone is rooted: step-by-step guide

Obtaining root access on Android opens up the user with advanced options for customizing the system, but at the same time creates risks for the security and stability of the device. It is not always obvious whether a smartphone has been rooted previously - especially if you buy it second-hand or borrow it from friends. In some cases root access can be hidden (for example, through Magisk with the function MagiskHide), which complicates verification using standard methods.

In this article we will analyze 7 reliable ways to identify a rooted device, including visual signs, checking through settings, specialized applications and commands ADB. You will learn how to distinguish the official firmware from the modified one, which system files indicate root, and why some methods can give false positive results. The instructions are relevant for all versions of Android - from Android 8 Oreo to Android 15 (2026).

1. Visual signs of a rooted phone

Before diving into technical details, pay attention to indirect signs that may indicate the presence of root access. They do not give a 100% guarantee, but they will help to suspect changes in the system.

• 🔧 Unknown applications in the menu: SuperSU, Magisk Manager, KingRoot or other tools for managing root access. Even if they are hidden, traces may remain in Settings → Applications.
• 📱 Changed boot screen: on rooted devices a warning often appears Unlocked or Custom when turned on (for example, on Samsung or Pixel).
• 🔄 Non-standard updates: the phone stops receiving OTA updates or offers installation of firmware from third-party sources.
• 🛡️ Lack of Google services: some banking applications (SberBank Online, Tinkoff) or games (Pokémon GO) refuse to work, citing an "uncertified device".

If you noticed at least 2-3 of these signs, the probability of root is high. However, some of them can also appear on devices with unlocked bootloader (bootloader), but without actual root access. To make sure, proceed to the following methods.

2. Checking through Android settings

The easiest way is to look into the standard system settings. On some devices, information about the status of root access is displayed publicly.

Open Settings → About phone (or About tablet) and find the section Software information or Device status. Look for the following parameters:

• 🔓 Bootloader status: if specified Unlocked — bootloader unlocked (but this does not always mean the presence of root).
• 📋 Google Certification: in the section Google Play Protection there may be a note "The device is not certified."
• 🔧 Kernel version: non-standard designations (for example, Magisk or Custom in the name) indicate modification.

Parameter	Value on stock Android	Value on rooted Android
Bootloader status	Locked	Unlocked or Relocked
Google Certification	Certified	Not certified or missing
Kernel version	Standard name (for example, 4.19.157-android12-9)	Tags are added Magisk, KSU or Custom
Updates systems	OTA updates are available	Custom firmware is missing or offered

If there are no explicit indications of root in the settings, this does not guarantee its absence Modern rooting methods (for example, Magisk c. module MagiskHide) can hide traces from system checks. For deeper diagnostics, use specialized applications.

3. Using applications to check root

There are utilities that scan the system for root access, modified binaries and traces of popular rooting tools. We recommend the following applications (all are free and available. v Google Play):

• 📱 Root Checker (from joeykrim) - the simplest solution with a minimalistic interface. Checks the presence of subinary and access to it.
• 🔍 Root Validator - analyzes system paths and identifies hidden root (including Magisk).
• 🛡️ SafetyNet Test —checks the status SafetyNet (if the test fails, this indirectly indicates the root).

Instructions for using Root Checker:

1. Download and install the application from Google Play.
2. Run it and click Verify Root (or a similar button).
3. Wait for the result: if a message appears Root access is properly installed on this device!, the device is rooted.

Please note: some applications may show false positive results on devices with an unlocked bootloader or custom recovery (TWRP). For accuracy, use 2-3 utilities at the same time.

4. Verification via ADB (for advanced users)

If you have access to a computer, the most reliable way is to use Android Debug Bridge (ADB). This method bypasses most disguises and shows the real state of the system.

You will need:

• 💻 A computer with ADB installed and Fastboot.
• 📱 Enabled USB debugging on the phone (Settings → System → For developers → USB debugging).
• 🔌 USB cable for connection.

Commands for checks:

adb shell
su --version

If after entering su --version the version is displayed (for example, su: version 2.52), root access is confirmed. If the command is not found (su: not found), there is no root or it is hidden at the kernel level (for example, via Magisk s MagiskHide).

For a deeper check, use:

adb shell ls -l /system/bin/su
adb shell ls -l /system/xbin/su
adb shell getprop ro.boot.verifiedbootstate

If in the response to the last command you see orange or yellow —the bootloader is unlocked, which indirectly indicates a possible root.

What to do if ADB does not recognize the device?

Make sure that USB debugging is enabled and the drivers for your phone model are installed. On Windows, you may need to manually install drivers through Device Manager. On macOS/Linux, check the port access rights (lsusb And chmod).

5. Checking the integrity of system files

Rooting always makes changes to system files, even if they are well hidden. You can manually check the key paths where traces of root access is usually located.

Where to look:

• 📁 /system/bin/su — standard location of the binary su.
• 📁 /system/xbin/su — alternative path for su.
• 📁 /system/app/SuperSU or /system/priv-app/SuperSU — folder with the root control application.
• 📁 /data/adb/magisk — hidden directory Magisk (visible only from root access or via ADB).

To check for the presence of these files without root access, use ADB:

adb shell ls /system/bin/su
adb shell ls /system/xbin/su

If the files exist, the device is rooted. If the command shell displays Permission denied, this does not mean there is no root - perhaps access is simply limited.

⚠️ Attention: Some custom firmware (for example, LineageOS) may contain the file su, but do not provide root access by default. In this case, the root must be activated manually through the firmware settings.

6. Checking through SafetyNet and banking applications

Google SafetyNet is a device integrity check mechanism that banking applications, games and services use to identify modified systems. If SafetyNet fails, this indirectly indicates root, unlocked bootloader or custom firmware.

How to check SafetyNet:

1. Install the application SafetyNet Test (for example, from iknow).
2. Run the test Basic Integrity i CTS Profile Match.
3. If at least one test fails (False), the device is modified.

You can also use the command ADB:

adb shell su -c "snet sample"

Please note: Magisk can bypass SafetyNet with using the module MagiskHide or Universal SafetyNet Fix. If SafetyNet is passed, but you suspect root, use other verification methods.

⚠️ Attention: Some manufacturers (for example, Xiaomi or Huawei) block SafetyNet on devices with with an unlocked bootloader, even if there is no root access. This is a false positive result.

7. Checking through custom recovery (TWRP)

The presence of custom recovery (TWRP, OrangeFox) almost always means that the device rooted or ready for rooting. Even if root access is disabled, the very presence of custom recovery indicates a modification of the system.

How to check:

1. Turn off the phone.
2. Hold down the button combination to enter recovery (usually Power + Volume Up, but may differ for different models).
3. If instead of the standard menu you see a color interface with touch control (for example, TWRP), the device is modified.

In TWRP you can additionally check the availability root access:

• Go to section Advanced → File Manager.
• Try to open /system or /data —if access is allowed, root is active.

If the device has stock recovery, but you suspect root, try rebooting into fastboot and run the command:

fastboot getvar unlocked

If the answer is unlocked: yes, the bootloader is unlocked, which increases the likelihood of root.

FAQ: Frequently asked questions about checking root access

Is it possible to check root without a computer?

Yes, it is enough to install one of the applications for checking root (for example, Root Checker) or look into the system settings. However, for maximum accuracy, it is recommended to use ADB or checking through custom recovery.

Why do banking applications not work if there is no root?

This may be due to an unlocked bootloader, custom firmware, or an unsuccessful attempt to hide the root (for example, through MagiskHide).Some manufacturers (for example Samsung) block Google services for any modifications to the system, even without actual root.

How to hide root from applications, if there is one?

To do this, use Magisk s modules MagiskHide or Universal SafetyNet Fix. You can also try Hide My Applist (Xposed) or Island to isolate applications. However, some banks (for example, SberBank) have learned to detect such bypasses.

Is it possible to cancel the root and return everything as it was?

Technically yes, but it depends on the device model. For most smartphones you need to:

1. Remove the root manager (Magisk or SuperSU).
2. Restore stock recovery (via fastboot flash recovery stock_recovery.img).
3. Flash stock firmware via Odin (for Samsung) or Fastboot.
4. Lock the bootloader (fastboot oem lock — attention, this will erase all data!).

On some devices (for example, Google Pixel) there is an official tool for returning to stock firmware - Android Flash Tool.

Why doesn’t the phone turn on after rooting?

This may be caused by:

• Incompatible version Magisk or SuperSU with your firmware.
• Damage boot.img during patching.
• Modules conflict Magisk (if additional patches were installed).

Solution: reflash boot.img via fastboot flash boot stock_boot.img or restore the backup via TWRP.