Keybox Repository

Android Keybox Repository

Free keybox.xml files for TrickyStore. Each one is checked against Google's attestation revocation list every time this page loads, so what you download is usable right now. New keyboxes are mirrored automatically from the @keyboxstrong Telegram channel.

Current keybox served at /key
Loading…
Published — Size — SHA-256 —
Download keybox.xml Telegram post

All keyboxes

checking Google's revocation list…

Sorted by grade, then newest first. Revoked keyboxes stay listed at the bottom for reference and testing. Serial numbers are compared with android.googleapis.com/attestation/status.

KeyboxGradePublishedSizeCerts

Stop replacing keyboxes by hand

AlwaysStrong – Magisk / KernelSU / APatch module

Every time a key is revoked you would normally hunt for a new one and copy it over yourself. AlwaysStrong pulls the newest keybox from this repository straight into /data/adb/tricky_store/keybox.xml with one tap of the module's action button. It bundles TEESimulator-RS and PlayIntegrityFork, so a fresh install can reach STRONG in one go.

View AlwaysStrong on GitHub

How to install a keybox with TrickyStore

You need a rooted device (Magisk, KernelSU or APatch) with Zygisk enabled and the TrickyStore module installed. Config files take effect immediately, no reboot needed. Full walkthrough: TrickyStore keybox setup guide.

  1. Download a valid keybox

    Take the newest entry marked Strong in the table above. Save it as keybox.xml.

  2. Copy it into the TrickyStore folder

    Use any root file manager, or a shell:

    su
cp /sdcard/Download/keybox.xml /data/adb/tricky_store/keybox.xml
chmod 644 /data/adb/tricky_store/keybox.xml

  3. List the apps that should see the spoofed attestation

    One package name per line in /data/adb/tricky_store/target.txt. Append ! to force certificate-generation mode, or ? to force leaf-certificate hack mode. No suffix lets TrickyStore choose.

    com.google.android.gms
com.android.vending
io.github.vvb2060.keyattestation
com.yourbank.app!

    The Tricky Addon WebUI manages this list for you.

  4. Optional: pin the security patch level

    If your ROM is old, write a recent date to /data/adb/tricky_store/security_patch.txt (for example 20260801) so the attested patch level is not the thing that fails you.

  5. Verify

    Open Key Attestation and check that the certificate chain is trusted and not revoked, then run a Play Integrity checker. A working key returns MEETS_STRONG_INTEGRITY. If it drops to BASIC or DEVICE, the key was probably just revoked: come back and grab the next one.

What the grades mean

The dots on each channel post encode the maintainer's attestation test. Google's revocation list can override any grade to Revoked.

DotsGradeMeaning
StrongPasses hardware-backed (STRONG) attestation. Banking apps, Google Wallet and the strongest Play Integrity verdict work.
Soft-bannedTwo green, one red. Still functional but flagged by some services. A fallback when no strong key is available.
BasicOne green. Only BASIC integrity. Enough for light root hiding, not for strong-attestation apps.
RevokedOn Google's revocation list. Fails attestation regardless of certificate expiry; kept for reference only.

Frequently asked questions

What is a keybox.xml?
An XML file that holds an Android attestation private key plus its certificate chain. TrickyStore uses it to answer hardware key-attestation challenges so a rooted device can pass Play Integrity. Longer explanation: What is a keybox?
Why did a “Strong” keybox stop working?
Google periodically revokes leaked keyboxes. A key that graded Strong yesterday can land on the revocation list at any time. This page re-checks on every visit and moves revoked keys to the archive automatically; when that happens, download the newest valid one. See why keyboxes get revoked.
Is “valid” the same as “not expired”?
No, and this is the most common mistake. A keybox's certificates can be valid for years yet already be revoked for key compromise. Valid here means not on Google's revocation list plus the maintainer's attestation grade, not the certificate expiry date.
How often is the repository updated?
Whenever a new keybox is posted to the Telegram channel it appears here within about a minute. Revocation status is evaluated live every time you load the page.
Where do the keyboxes come from? Is this safe?
Keyboxes are community-sourced and shared for research and root hiding on your own devices. Files are provided as-is; verify anything important yourself. This project only mirrors and grades them and does not generate keys.
Can I fetch the keybox automatically?
Yes. AlwaysStrong pulls the newest keybox on demand. Scripts can use the raw endpoints: /key (base64 of the current keybox), /meta.json, /status and /keys.json.

From the blog

All posts