What is a keybox.xml?

A keybox.xml is an XML file that holds an Android attestation private key and its certificate chain. TrickyStore uses it to answer hardware key-attestation challenges so a rooted device can pass Play Integrity.

Is a valid keybox the same as a non-expired one?

No. A keybox's certificates can be years from expiry and still be revoked. Valid here means the certificate serials are not on Google's revocation list and the keybox passed the maintainer's attestation test.

Where do the keyboxes come from and are they safe?

They are community-sourced files shared for research and for root hiding on your own devices, provided as-is. This site only mirrors and grades them; it does not generate keys.

Keybox Repository

Q: Why did a Strong keybox stop working?

Google regularly revokes leaked keyboxes. This page re-checks every keybox against Google's attestation revocation list on every visit and moves revoked ones to the archive; download the newest valid one when that happens.

Q: How often is the repository updated?

Whenever a new keybox is posted to the @keyboxstrong Telegram channel it appears here within about a minute. Revocation status is evaluated live on every page load.

Q: Can I fetch the keybox automatically?

Yes. The AlwaysStrong module pulls the newest keybox from this repository on demand, and the raw index is available as JSON at /keys.json.

Live-verified keybox.xml files for TrickyStore, checked against Google’s attestation revocation list on every page load. Mirrored from @keyboxstrong.

Download latest Check yours Submit a keybox

Active — usable keys

Tracked — total keyboxes

Revoked — archived

CRL Status checking… revocation list

Active keybox served at /key

Loading…

Published — Size — SHA-256 —

Download keybox.xml Telegram post

All keyboxes

Sorted by grade, then newest first. Serials are compared with android.googleapis.com/attestation/status; the root and expiry come from the certificates. Check your own or add one.

					Actions

Automate it

AlwaysStrong — Magisk / KernelSU / APatch module

Pulls the newest keybox from this repository straight into /data/adb/tricky_store/keybox.xml with one tap. Bundles TEESimulator-RS and PlayIntegrityFork so a fresh install reaches STRONG in one go.

View on GitLab

Installation guide

Rooted device (Magisk, KernelSU or APatch) with Zygisk + TrickyStore installed. No reboot needed. Full walkthrough: TrickyStore keybox setup guide.

Download a valid keybox
Take the newest entry marked Strong above. Save as keybox.xml.

Copy it into the TrickyStore folder

Use any root file manager, or a shell:

su
cp /sdcard/Download/keybox.xml /data/adb/tricky_store/keybox.xml
chmod 644 /data/adb/tricky_store/keybox.xml

List the apps that should see the spoofed attestation
One package name per line in /data/adb/tricky_store/target.txt. Append ! to force certificate-generation mode, or ? for leaf-certificate hack mode.
```
com.google.android.gms
com.android.vending
io.github.vvb2060.keyattestation
com.yourbank.app!
```
The Tricky Addon WebUI manages this list for you.
Optional: pin the security patch level
If your ROM is old, write a recent date to /data/adb/tricky_store/security_patch.txt (e.g. 20260801) so the attested patch level is not the thing that fails you.
Verify
Open Key Attestation and check the chain is trusted, then run a Play Integrity checker. A working key returns MEETS_STRONG_INTEGRITY. If it drops to BASIC or DEVICE, the key was probably just revoked: come back and grab the next one.

Grade reference

The dots on each channel post encode the maintainer's attestation test. Facts override the dots: once Google lists a key, or its certificates expire, the entry shows three red here regardless.

Dots	Grade	Meaning
	Strong	Passes hardware-backed (STRONG) attestation. Banking apps, Google Wallet and the strongest Play Integrity verdict work.
	Soft-banned	Two green, one red. Still functional but flagged by some services. A fallback when no strong key is available.
	Basic	One green. Only BASIC integrity. Enough for light root hiding, not for strong-attestation apps.
	Community	Submitted through the checker by a visitor. Verified against Google's root, chain and revocation list on the way in, but not device-tested.
	Banned	Three red. The maintainer tested it and it no longer passes, but Google has not listed it.
	Revoked	On Google's revocation list. Fails attestation regardless of certificate expiry; kept for reference only.
	Expired	A certificate in the chain is past its `notAfter` date. RKP keyboxes reach this within weeks by design.

FAQ

Why did a “Strong” keybox stop working?

Google periodically revokes leaked keyboxes. This page re-checks on every visit and moves revoked keys to the archive automatically; download the newest valid one. See why keyboxes get revoked.

Is “valid” the same as “not expired”?

No. A keybox's certificates can be valid for years yet already be revoked for key compromise. Valid here means not on Google's revocation list plus the maintainer's attestation grade.

What is an RKP keybox?

Newer keyboxes chain to Google's Remote Key Provisioning root (Key Attestation CA1) instead of the classic hardware root. Their leaf certificates last about two weeks. Confirm which root any keybox uses with the checker.

How often is the repository updated?

Whenever a new keybox is posted to the Telegram channel it appears here within about a minute. Revocation status is evaluated live on every page load.

Where do the keyboxes come from?

Community-sourced and shared for research and root hiding on your own devices. Files are provided as-is. This project only mirrors and grades them.

Can I fetch the keybox automatically?

Yes. AlwaysStrong pulls the newest keybox on demand. Scripts can use /key, /meta.json, /status and /keys.json.

From the blog

All posts

Sep 6, 2026
What is a keybox.xml? Android key attestation explained
The file, the certificate chain inside it, and why leaked factory keys exist at all.
Sep 6, 2026
Why keyboxes get revoked, and how to check yours
Google's revocation list, the reasons behind fast bans, and how to make a key last longer.
Sep 6, 2026
TrickyStore keybox setup: the complete guide
keybox.xml, target.txt, security_patch.txt and verifying the result step by step.
Sep 6, 2026
BASIC vs DEVICE vs STRONG: Play Integrity verdicts explained
What each verdict requires and where a keybox fits in.

Got a working keybox?

Drop a file or pick one — it is verified in your browser (root certificate, chain signatures, private key, expiry, revocation list). Only passing keyboxes are published under a community name.

Only check it