Disable Forced-Encryption and Decrypt Nexus 5X

Decrypt Nexus 5X

Security is an attribute that is taken very seriously nowadays. Especially when there’s a lot of advanced technology all around, it is an imperative task to preserve personal data. Google, about two years now, introduced the concept of forced-encryption for the its upcoming lineup. Starting off with devices like the Nexus 6 and Nexus 9, the forced-encryption protocol made its way to Google’s latest – Nexus 6P and 5X. While we already covered an article on how you can decrypt the Nexus 6P, we are here today to help you disable forced-encryption and finally decrypt Nexus 5X, running Android Marshmallow or Android N Developer Preview.

What is forced-encryption & why should I decrypt?

Forced-encryption on Android is implemented through the kernel, which triggers the encryption process on your complete /data partition, on the first boot.

The idea of forced-encryption hooked up a lot of users, seeing this as a one-more-added step towards security. But when it came to the custom users, like you and me, who like to customize their device (A LOT!), it is not so much useful. In contrary, it creates a barricade, preventing any kind of modifications.

In order to successfully disable forced-encryption and decrypt your Nexus 5X, you will first need a modified boot.img, that has dm-verity check disabled. By flashing this boot.img (kernel), you will ensure that your storage doesn’t get encrypted all-the-way, during the first boot. Also, it is a pretty high chance that you have your storage encrypted now, so flashing the modified boot alone won’t decrypt your device (Think logically, it just disables FE on first boot, either after you bought the device, or did a factory reset).

In order to decrypt, you will need to format the entire userdata partition on your Nexus 5X, so that the encryption wears-off instantly.

Disable forced-encryption and decrypt Nexus 5X

Appreciations to XDA Recognized Contributor – Tigerstown, who has brought us the modified boot image files for the Nexus 5X, with dm-verity disabled. The modified boot images work on both, latest Marshmallow and Android N Developer Preview (If you need it for a previous build or DP1, let us know via comments).

Before you begin


  1. Once you have downloaded the modified kernel (boot.img), you are ready to go.
  2. To begin, boot your Nexus 5X into bootloader mode — Power down your 5X completely. Now, press and hold the Volume Down and Power keys, until you see the bootloader screen on your 5X (Below is the image of bootloader mode on Nexus 6P, which is pretty much similar to that of the 5X).
  3. While your 5X is in bootloader mode, connect it to the PC using a USB Type-C cable.
  4. On your computer, open the folder (directory), where the boot.img file was downloaded. Inside that folder, press SHIFT key and right-click on an empty space. Then, select Open command window here from the pop-up menu. A new command-prompt/CMD window should open, which will already be pointing to the current folder.
  5. Type in the following command to confirm whether your device has been detected successfully.
    fastboot devices

    The command should return a device ID along with the current mode – ‘fastboot‘. If it doesn’t, make sure that your 5X is connected to the PC while in bootloader mode, and that you have properly setup fastboot.

  6. Once you have your device detected successfully, enter the command below to flash the modified kernel (boot.img):
    fastboot flash boot boot.img
  7. Now it’s time to decrypt the device, by formatting the complete data partition. Enter:
    fastboot format userdata
    fastboot format cache
  8. Finally, when everything is done, you can reboot your Nexus 5X, that has now been decrypted.
    fastboot reboot

Now that you have successfully disabled forced-encryption, and decrypted your 5X, you can go on installing TWRP or even root N Developer Preview, if you’re running it.

Are you a Linux or OS X user? If you want to write a tutorial with specific instructions, to work on the following operating systems, let us know through the comments. If you have issues, during or after the process, or any prior questions, you can ask us directly.

  • John Li

    Any updates for N Developer Preview 5 (NPD90G)?

    • Hello John Li. First off, apologies for the late update.
      The post has been updated. Kindly refer to the download links above. If you have any other questions, please feel free to comment or contact us directly.

      • John Li

        Thanks, it’s working. I’m wondering how these modified boot images are created? Would I be able to create these myself?

        • We will surely cover a guide for the same, so that users power users can do this much easily. For now, you can try and get in touch with the developer – Tigerstown, on XDA-Developers.

  • Level380

    So will I get OTA updates if I do this? Any other issues?

  • Rezanur Rahman RaHat (BluewisH

    Very helpful . Need modified boot.img for official android 7.0 dude.I’m counting on you.

    • You can expect it soon after the factory image for the 5X is up. Thank you for putting up your faith in us.

      • Level380

        factory images are out now for 5x! 🙂

  • Pavel Mishurov

    Can I lock the bootloader safely after this procedure? Coz leaving the bootloader unlocked together with unecrypted data makes the data easily accessible without any passwords/pin/fingerprintes.

    • Yes you can. But before you lock the bootloader, kindly make sure that your phone is able to boot into OS. Also, locking the bootloader doesn’t make much difference.

      • Pavel Mishurov

        Why no difference? I meant, when bootloader is unlocked, one can easily flash custom recovery and read user data, of coz if this data is not encrypted. You saying that it is possible to read unencrypted user data even with locked bootloader and without password? Only one option comes into my head – disassemble the device, solder out the flash memory and solder it onto some other device reading the data (which is not encrypted) from the flash.

  • Naman

    Boot image for N public

    • Boot image for N final release (NRD90M) are up! Thanks to Tigerstown.

      • Level380

        Already on a modified 6.x boot image. So can I flash the final 7.0 boot image and then do a OTA upgrade?

        • IMO, pick up the OTA zip corresponding to your build number, and the modified boot, and flash them through FlashFire.
          Make sure to add both of them to the list. If the phone reboots after flashing the OTA without the modified boot, it might encrypt your device.

          • Level380

            Thanks… I’ll give it a go that way then. I really wished Google just allowed a simple option to stop allowing device encryption if they user requests. Toss up a splash screen etc to warn the user on booting etc.

            Would make it so much easier!

          • Yes of course, that would do wonders. 🙂

        • Or, there is another method that users have reported to be working.
          1) Download the full OTA update zip and flash it through TWRP: https://developers.google.com/android/nexus/ota
          2) Don’t reboot yet. Also flash the SuperSU zip or modified boot image. You can flash either, it will disable the forced-encryption.

  • Mahfoud bouabdallah

    thanks for useful info
    how about other devices “i have Condor P8 with MT6753 CPU (it’s Algerian)”
    can i modified boot image by my self

    sorry for my english

    • Thank you for the appreciation Mahfoud. These modified boot images are provided by a friendly developer at XDA forums. I would try to get in touch with him and ask him how he does it. Hopefully, will be able to get an article about this on the blog.

      If not, you can personally stay in touch with us via Facebook, Google+, or Twitter. And we will make sure to let you know ASAP.

  • Benji


    • Hello Benji, we have updated the article with the appropriate link to NBD90W Nougat boot.img. The credits go to [email protected] Thank you.

  • Sterpu Mihai


    Any modified boot.img for the MTC20K build?

    • Hello, currently Tigerstown has no modified boot.img for MTC20K. But there is another way that could help you decrypt. It requires TWRP though and you need to backup your storage, since decrypting will erase all data.