GrayKey

Technical capabilities

GrayKey is a dedicated passcode-bypass and data-extraction appliance for iOS and Android devices. It runs as a physical desktop or rack unit and connects to a target device over Lightning or USB-C. Magnet Forensics, which acquired the product through its purchase of Grayshift in March 2024, markets it for both Before First Unlock (BFU) and After First Unlock (AFU) operations.

The toolset performs brute force against numeric and short alphanumeric passcodes by exploiting vulnerabilities in the iOS Secure Enclave processor or its Android equivalent. Successful unlock provides a full file-system extraction. Capability against current iOS versions is updated through Magnet’s subscription model. Public Grayshift technical claims and 404 Media reporting on leaked support matrices confirm iterative capability against most production iPhone models, although iOS 18 has not been publicly documented as fully supported as of May 2026.

Operational scope

GrayKey is sold under restricted licensing. Each unit is geographically and customer locked. Vice / Motherboard first reported the existence of the product in 2018 based on a leaked Grayshift internal document and a private discussion forum.

FOIA requests filed by Upturn, ACLU, the Surveillance Technology Oversight Project (STOP) and others have surfaced contracts for GrayKey with the US Secret Service, US Drug Enforcement Administration, US Federal Bureau of Investigation, US Postal Inspection Service, the Department of Defense, and state and local police forces. International sales are reportedly limited to Five Eyes allies plus a select group of NATO partners.

Customer states

Confirmed US federal customers per FOIA disclosures and procurement databases: FBI, DEA, USSS, USPIS, ICE, US Marshals Service, DoD components. Confirmed state and local US customers include New York Police Department, Maryland State Police, North Carolina State Bureau of Investigation and dozens of others.

International customers per public reporting and procurement records: United Kingdom (Metropolitan Police, regional forces), Canada (RCMP), Australia (AFP and state police), New Zealand (NZ Police), and confirmed Western European partners. Unlike Pegasus or Predator, no documented operational use has surfaced against journalists or political dissidents.

Legal and procurement status

• Not on the US Department of Commerce Entity List.
• Magnet Forensics is publicly traded on Toronto Stock Exchange under MAGT until taken private by Thoma Bravo in April 2023 for approximately CAD 1.8B.
• Grayshift acquisition by Magnet Forensics announced March 19, 2024, closed shortly after.
• Use in US LE is subject to Fourth Amendment constraints and warrant requirements. Multiple federal court decisions (Riley v. California 2014, Carpenter v. United States 2018) frame the constitutional limits.

Technical countermeasures

• Powered-off state (BFU): cryptographic keys for user data are not derived until first unlock after boot. Current iOS and Pixel devices in BFU are significantly more resistant to brute force.
• iOS 18 auto-reboot: locked devices reboot automatically after 72 hours of inactivity, restoring BFU state.
• Strong passcode: alphanumeric passphrase of at least 10 characters exponentially increases brute force time.
• USB Restricted Mode (iOS): disables USB data accessories after one hour of being locked. Enabled by default since iOS 12.
• GrapheneOS on Pixel 6/7/8: per the GrapheneOS project, powered-off Pixel devices on GrapheneOS were not brute-forceable per the April 2024 Cellebrite leak. The same constraints apply to GrayKey.
• Lockdown Mode (iOS 16+): not specifically a counter to forensic unlocking but reduces the device’s attack surface in After First Unlock state.

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.