Jailbreaking an iOS test deviceTest device you own.

Jailbreak guides assume a lot of vocabulary. If you have never done this before, skim the glossary below once; every later step uses these terms. You do not need to understand how the exploits work — only which tool fits your device and what each step is doing.

The short version of the whole process: (1) find out which chip and iOS version your iPhone has, (2) that decides whether you use palera1n (runs from a computer) or Dopamine (an app on the phone), (3) run it, (4) install a few packages, (5) install your app and see whether it notices.

1. 01A dedicated test iPhone or iPad that you are allowed to wipe. Never your daily phone — you may need to erase it.
2. 02A computer. For palera1n: a Mac or a Linux PC (not a virtual machine, and not Windows — Windows users boot a palen1x USB stick instead). For Dopamine: any Mac, Windows, or Linux PC to sideload the app once.
3. 03The right cable. For palera1n, a USB-A to Lightning cable plugged directly into the computer. USB-C to Lightning cables and USB hubs are the most common reason DFU mode fails, especially on Apple Silicon Macs (use a USB-C to USB-A adapter if needed).
4. 04An Apple Account to sign apps with. A free one works. Ideally make a separate throwaway account for test devices, so a test device problem never touches your real account.
5. 05Time and battery. Plan an hour for the first attempt. Charge the device above 50%.
6. 06A backup if there is anything on it you care about (Finder → your device → Back Up). Assume the device may need erasing.

On Android you pick a method and go. On iOS you must work backwards from what your specific device + iOS build can run. The newest iPhone on the latest iOS usually cannot be jailbroken for months (or ever).

Two things decide your fate: (1) Chip — A11 and earlier vs A12 and later. This is the single biggest fork. (2) iOS version — exploits cover specific version ranges; once Apple patches and you update, the door closes.

1. 01Find your exact model and build: Settings → General → About. Write down the Model Name (e.g. iPhone 11) and the iOS Version (e.g. 18.6). Tap the version once to reveal the build number (e.g. 22G86).
2. 02Turn the model into a chip with the tables in the next section.
3. 03Look up the chip + version in the table below, then confirm on a live tracker — AppleDB or the ios.cfw.guide device picker are the most current.
4. 04Check which iOS versions Apple will still install on your model at ipsw.me (signed = installable). If the only signed version is newer than any jailbreak, updating can only lose you coverage, never gain it.
5. 05Do not update iOS while deciding. Turn off Settings → General → Software Update → Automatic Updates now. An update almost always removes the possibility, and you cannot downgrade once Apple stops signing a version.

The A-number is the Apple-designed system-on-chip (SoC) inside the device: A9, A10 Fusion, A11 Bionic, A12 Bionic, and so on, one generation per year. Apple never prints it on the box, so you map from the model name to the chip. "A9–A11" means every device built on the A9, A10, or A11 chip, including the X variants used in iPads (A9X, A10X). "A12+" means the A12 and every chip after it.

The line sits between A11 and A12 for two hardware reasons. First, checkm8 is a bug in the bootrom (SecureROM), the read-only code the chip runs first at power-on. It affects every chip from A5 through A11. Apple fixed it in the A12's bootrom, and a bootrom fix can only ship in new silicon, so older chips stay exploitable forever and newer ones never were. Second, the A12 introduced arm64e with Pointer Authentication (PAC), and later chips added PPL and SPTM kernel-memory protections. Without a bootrom bug, a jailbreak on A12+ has to defeat the running kernel and these mitigations, which takes a fresh exploit chain for each iOS range.

In practice: A9–A11 means jailbreakable on any iOS the device can run, but those devices max out on old iOS (iPhone 8/X stop at iOS 16). A12+ means current iOS and current App Attest behaviour, but you only get a jailbreak if a kernel exploit exists for your exact build.

1. 01A9, A10, or A11 device (iPhone 6s → X) on iOS 15 or later → use palera1n. Follow "Path A" below.
2. 02A12 or newer, on an iOS version listed in the coverage table → use Dopamine. Follow "Path B" below.
3. 03A12 or newer on a version that is not covered → you cannot jailbreak this device today. Do not update it (a future jailbreak may cover your build), and use a second, older device for jailbreak testing.
4. 04Buying a device for this? Get an iPhone 8 or X (A11, palera1n, unpatchable) for a reliable rig, plus, if you can find one on a covered build, an iPhone 11 or XS (A12/A13, Dopamine) to test modern rootless detection.

checkm8 is a bootrom exploit — burned into hardware, unpatchable by Apple. This makes older devices the gold standard for a reliable test rig: they jailbreak on essentially any iOS version they can run, forever.

palera1n is the modern checkm8 tool (successor to checkra1n). It runs on your computer, talks to the phone in DFU mode, and boots iOS with the jailbreak loaded. It is semi-tethered: after a reboot the device boots to normal stock iOS until you re-run palera1n from the computer. That is also its biggest safety feature — a reboot always gets you back to stock.

Modern devices have no bootrom exploit, so these jailbreaks chain kernel exploits and are tied to narrow iOS ranges. Dopamine (by opa334) is the main one: an app you install on the phone, open, and tap Jailbreak. Dopamine 3.0 (August 2026) added A12/A13 support on iOS 17.4–18.7.1 and 26.0–26.0.1, on top of all devices on iOS 15.0–17.3.1.

It is semi-untethered: after every reboot the device is stock again until you open Dopamine and tap Jailbreak. No computer needed after the first install.

Jailbreaks for a new iOS major usually land many months after release (iOS 26 took 326 days), and often never for the newest hardware. Always check the tracker before assuming.

For app-resilience testing, this trichotomy is the test: the same app may detect a rootful jailbreak instantly, miss a plain rootless one, and fail entirely against roothide. Both palera1n (in the -l mode used here) and Dopamine are rootless.

1. 01Update nothing. Keep Automatic Updates off (Settings → General → Software Update → Automatic Updates).
2. 02Back up anything you need, then sign in to iCloud only with the test Apple Account (or not at all).
3. 03A11 + palera1n only: remove the passcode (Settings → Face ID & Passcode → Turn Passcode Off). On iOS 16, if a passcode was ever set since the last erase, do Settings → General → Transfer or Reset iPhone → Erase All Content and Settings, and set up again without a passcode.
4. 04Dopamine only: you will enable Developer Mode after sideloading (the option only appears once a sideloaded app exists).
5. 05Unlock the phone, connect it to the computer, and tap Trust on the "Trust This Computer?" prompt.

Open Terminal (macOS: Spotlight → "Terminal"). Paste the install command below and press Enter. It downloads the palera1n program to /usr/local/bin; you may be asked for your computer password (typing shows nothing — that is normal).

On Linux, first stop the system usbmuxd and run it in the foreground in a second terminal, as shown, then run the installer.

# macOS and Linux — official installer
/bin/sh -c "$(curl -fsSL https://static.palera.in/scripts/install.sh)"

# Linux only, in a separate terminal BEFORE running palera1n:
sudo systemctl stop usbmuxd
sudo usbmuxd -f -p

# Check it installed
palera1n --version

Run palera1n -l (-l = rootless; Linux needs sudo palera1n -l). palera1n first reboots the phone into Recovery mode on its own, then asks you to press Enter and shows a countdown telling you which buttons to hold. Follow the countdown exactly — the timing matters, and getting it wrong just means trying again.

When DFU works, the phone screen stays completely black and the terminal continues on its own. The phone then shows scrolling boot text, reboots, and comes back to the home screen — jailbroken.

palera1n -l          # macOS (rootless)
sudo palera1n -l     # Linux

# Press Enter when asked, then hold buttons as the countdown says.

1. 01A new app called palera1n (the loader) appears on the home screen. Open it.
2. 02Tap Sileo to install the package manager.
3. 03When asked, set a password. This is the terminal (sudo) password for the mobile user — pick something you will remember and write it down; you need it for SSH later.
4. 04Sileo appears on the home screen. Open it and let it refresh its sources.
5. 05After every reboot: the device is stock again. Plug it in and run palera1n -l again (same DFU steps). Your packages are still there; they just need the jailbreak to load.

Dopamine is an .ipa you install yourself. The simplest tool is Impactor (PlumeImpactor), a free app for macOS, Windows, and Linux that signs an IPA with your Apple Account and installs it over USB. Sideloadly and AltStore do the same job if you already know them. Windows users also need iTunes (from Apple, not the Microsoft Store) installed for the USB driver.

1. 01Download the latest Dopamine.ipa from opa334/Dopamine releases — the only official source. Ignore sites offering "online jailbreak" installs or profiles; they are scams.
2. 02Download Impactor from claration/Impactor releases (v2.6.5) — the official GitHub source. Pick the file for your computer: macOS → Impactor-macos-universal.dmg (open it and drag Impactor to Applications); Windows → the Impactor-windows-…exe matching your CPU (x64 for most PCs, arm64 for Snapdragon laptops), plus iTunes from Apple for the USB driver; Linux → the Impactor-linux-…AppImage for your CPU, then chmod +x it, and make sure usbmuxd is installed. Ignore the plumesign-… files — that is the command-line version.
3. 03Connect the phone by USB, unlock it, and tap Trust if asked.
4. 04Open Impactor, sign in with your (test) Apple Account in its settings.
5. 05Drag Dopamine.ipa into Impactor and click Install. Wait for it to finish; the Dopamine icon appears on the phone.
6. 06On the phone: Settings → General → VPN & Device Management → tap your Apple Account email → Trust.
7. 07iOS 16 and later: Settings → Privacy & Security → Developer Mode → on. The phone reboots; after it starts, tap Turn On and enter the passcode.

1. 01Reboot the phone first (fewer failures on a fresh boot), then unlock it.
2. 02Open Dopamine. Leave the default settings (Sileo as the package manager is fine).
3. 03Tap Jailbreak. It runs the kernel exploit — this can take from seconds to a minute. Do not touch the phone.
4. 04If prompted, set a password for the mobile user and write it down (used for sudo and SSH).
5. 05The phone resprings (home screen restarts) and Sileo appears on the home screen. You are jailbroken.
6. 06If the phone instead reboots or freezes (a kernel panic), that is normal for exploits — it is stock again; just open Dopamine and tap Jailbreak once more. A few attempts is not unusual.
7. 07After every reboot: open Dopamine and tap Jailbreak again. No computer needed.

Open Sileo. The default sources (Procursus, Havoc, Chariz) are enough to start. Tap a package → Get → it goes into a queue → tap the Queued bar at the bottom → Confirm. Sileo may ask to respring when done.

1. 01Install ElleKit (the tweak-injection engine on rootless) and PreferenceLoader (lets tweaks add settings panes). Most tweaks need both.
2. 02Install NewTerm 3 for a terminal on the phone, and OpenSSH so you can log in from your computer.
3. 03For Frida testing: Sileo → Sources → + → add https://build.frida.re → install Frida. It starts frida-server on the device automatically.
4. 04Respring when asked.

# Find the phone's IP: Settings → Wi-Fi → (i) next to the network
ssh mobile@192.168.1.50        # password = the one you set
sudo -i                        # become root (same password)
ls /var/jb                     # rootless jailbreak files live here

# Frida (pip install frida-tools on the computer, phone on USB)
frida-ps -U                    # lists processes on the phone = working

1. 01Sileo opens and Refresh completes without errors.
2. 02A simple tweak installs and visibly takes effect after a respring.
3. 03ssh mobile@<ip> logs in and sudo -i gives a root prompt (#).
4. 04ls /var/jb shows usr, Library, etc. (rootless). If it does not exist, the jailbreak is not active — re-run palera1n or Dopamine.
5. 05If testing Frida: frida-ps -U lists processes.

The jailbreak only matters if your app is on the device. Install it like any development build: from Xcode, or (for this library's example app) yarn example ios --device from the library repo. A jailbreak does not change how you install your own app.

1. 01In Xcode, open the app's .xcworkspace, select the target → Signing & Capabilities → choose your Team (a free Personal Team works).
2. 02Select the physical device in the toolbar and press Run. First time: trust the developer under Settings → General → VPN & Device Management.
3. 03Run the app once on the device before jailbreaking (or after a reboot, while stock) to record the clean baseline, then again with the jailbreak active.

This is usually the point for app QA — does your app (or a target app) notice the jailbreak, and does standard hiding defeat it? Classic detection checks for: presence of /Applications/Cydia.app, Sileo, /var/jb, /bin/bash, apt, etc.; ability to fork(), write outside the sandbox, or stat suspicious paths; URL scheme checks (cydia://, sileo://), dynamic linker (DYLD_INSERT_LIBRARIES) inspection; and jailbreak SDKs (e.g. commercial RASP / anti-tamper libraries).

Hiding on rootless: Dopamine has it built in — Dopamine → Settings → Hide Jailbreak (the button changes to Unhide Jailbreak when active). Choicy (in Sileo) disables tweak injection per app, which removes injected-library signals. roothide makes fixed paths like /var/jb disappear. The classic bypass tweaks (Liberty Lite, A-Bypass, KernBypass, vnodebypass) do not work on rootless jailbreaks.

A good test matrix: for each jailbreak type (rootful / rootless / roothide) × each hiding method, record whether your app launches / warns / blocks, and whether DeviceCheck / App Attest server-side signals still flag the device. Hardware-backed attestation (App Attest) generally still detects a compromised device — like Android's STRONG integrity, that is an expected and useful result.

Because iOS cannot cleanly unroot the way Android reflashes a boot image, plan the cycle around reboots and restores.

1. 01Stock baseline: reboot the device (both palera1n and Dopamine boot stock) and run the app. Record the result.
2. 02Jailbroken: re-run palera1n or Dopamine, run the app, record.
3. 03Hidden: enable Hide Jailbreak / Choicy for the app, run it, record.
4. 04Keep a results sheet: device · chip · iOS build · jailbreak type · hiding method · app launches / warns / blocks · App Attest passes?
5. 05Ideally use two devices — one A11 (palera1n) for broad coverage, one A12/A13 (Dopamine) for modern rootless testing.

1. 01Temporary stock: just reboot. Both palera1n and Dopamine leave a normal iOS after a reboot until you jailbreak again.
2. 02Remove palera1n (rootless): connect the phone and run palera1n --force-revert. It boots back to iOS with the jailbreak files removed — no restore needed.
3. 03Remove Dopamine: recent Dopamine versions removed the in-app "Remove Jailbreak" button as unstable, so the clean way is a full restore (below). For day-to-day testing, a reboot is enough.
4. 04Full restore: connect to a Mac (Finder → device) or Windows (Apple Devices app / iTunes) → Restore iPhone. This installs the latest signed iOS — which usually means the device can no longer be jailbroken. Only do this if you are done with the jailbreak on that device.
5. 05Boot loop / stuck on Apple logo: force-restart first (iPhone 8+: Volume Up, Volume Down, hold Side until the logo). Still stuck → enter Recovery or DFU mode and restore. checkm8 devices are very hard to permanently brick because the bootrom exploit is always available.

1. 01There is no bootloader unlock. Everything depends on an exploit existing for your exact device + iOS build. Check coverage before you plan anything.
2. 02Do not update iOS. Updates kill jailbreaks and downgrades are usually impossible once Apple stops signing.
3. 03A11-and-below (checkm8) devices are the reliable test rig — unpatchable, any iOS, easy recovery. Newest hardware is the worst choice.
4. 04Rootless/roothide is the modern detection battleground — that is where the interesting QA lives.
5. 05App Attest / DeviceCheck on a jailbroken device is meant to flag it — do not treat that as a failure to fix.