If you landed here looking for a way to replace KingRoot with SuperSU, we’ve got news that’s going to save you a lot of wasted time: both of those tools are dead. KingRoot stopped working on modern Android years ago, and SuperSU, the app everyone used to migrate to, was sold off and abandoned around 2018. This article used to walk you through a terminal script that ripped out KingUser and dropped SuperSU in its place. In 2026, following that guide would either do nothing or leave an old phone half-rooted and unstable. So we’ve rewritten it to tell you what actually happened to these apps, and what the safe path looks like today.
The quick answer: Don’t replace KingRoot with SuperSU: replace both with Magisk, or with nothing at all. KingRoot was a one-tap rooting app that worked by exploiting security holes in old Android versions, and it bundled its own superuser manager called KingUser, which was bloated, ad-ridden, and phoned home to servers in China. SuperSU was the trusted alternative back then, but its developer sold it to a company called CCMT and development stopped in 2018. Neither app works on, or is safe for, any phone made in the last eight years. If you have an old device still running KingRoot, fully unroot it first, then decide whether you want proper root at all. Modern rooting means unlocking your bootloader and flashing a Magisk-patched boot image. A process that requires a computer and a phone whose manufacturer allows unlocking.
| Tool | Status in 2026 | Method |
|---|---|---|
| KingRoot / KingUser | Dead, relies on exploits patched out years ago | One-tap kernel exploit, no computer needed |
| SuperSU | Dead, unmaintained since 2017 | Systemless root, installed via an app |
| Magisk | Active, the only option that matters | Unlock bootloader, flash a patched boot image over fastboot |
What KingRoot and SuperSU actually were
A quick history lesson helps this make sense. Back in the mid-2010s, there were two very different ways to root an Android phone.
The easy way was a one-tap app like KingRoot. You installed an APK, tapped a button, and the app ran a kernel exploit, literally the same kind of security bug malware uses, to gain system access and install root. No computer, no bootloader unlock, no technical knowledge. It felt like magic, and on Android 4 and 5 it often worked.
The catch was what KingRoot left behind: KingUser, its own superuser manager. This is the app that decides which of your other apps get root access, which makes it the single most powerful app on a rooted phone. And KingUser was a mess. It served ads, installed promotional junk, resisted removal, and communicated with remote servers that nobody outside the company could audit. Handing that much power to an opaque, ad-funded app made a lot of people rightly nervous.
SuperSU, built by the well-known developer Chainfire, was the respectable alternative. It was a clean, trusted superuser manager with no adware, and it pioneered “systemless” root: installing root without permanently modifying the system partition, which made updates and unrooting far less painful. That’s why guides like the original version of this one existed: people rooted with KingRoot because it was easy, then immediately wanted to evict KingUser and hand the keys to SuperSU instead.
Why people wanted off KingRoot in the first place
If you’re wondering whether the migration was overblown, it wasn’t. The reasons people scrambled to replace KingUser still read as a fair warning about “free” root apps today:
- Adware and bloat. KingRoot installed its own “purifier” companion apps and pushed notifications and promotions you never asked for.
- Opaque permissions. KingUser could grant root silently, meaning any app on your phone could potentially get system-level access without a clear prompt.
- Unaudited remote servers. The rooting process and the manager both talked to servers in China, and nobody could verify what was being sent. On a rooted phone, that’s a serious trust problem.
- It fought removal. Uninstalling KingUser cleanly was genuinely difficult: hence the terminal scripts, like the one this article used to host, that forcibly deleted it and swapped in SuperSU’s binaries.
The migration scripts were always a hack, though. They worked by brute-force deleting KingRoot’s files from a running system and copying SuperSU’s in their place. Sometimes it worked, sometimes you got a phone with broken root, and occasionally you got a boot loop. It was a symptom of the era: root obtained through an exploit was always fragile.
Why both apps are dead now
KingRoot died because Android got hardened. One-tap root apps depended on unpatched kernel vulnerabilities. From 2015 onward, Google shipped monthly security patches, enforced SELinux, and introduced Verified Boot, which detects any tampering with system partitions at startup. The supply of usable exploits dried up, and no one-tap app has been able to root anything running Android 7 or newer. Today’s phones ship with Android 16. The “KingRoot 2026” APKs still circulating on download sites don’t root anything. They’re adware and malware wearing a familiar name.
SuperSU died differently: it was sold, then abandoned. Chainfire transferred SuperSU to a company called Coding Code Mobile Technology (CCMT) in 2015 and stepped away from development entirely in 2017. The last release, v2.82 SR5, arrived in late 2017, and the project has been silent since. An abandoned superuser manager isn’t just outdated. It’s a security liability, because it will never receive fixes and can’t cope with how modern Android boots. The community mourned it briefly and moved on.
What everyone moved on to is Magisk.
What replaced them: Magisk and the modern root landscape
Magisk, an open-source project by developer topjohnwu, is the only root solution that matters in 2026. It took SuperSU’s systemless idea and went further: instead of touching the system partition at all, Magisk lives inside a patched boot image. Your system partition stays byte-for-byte stock, which keeps OTA updates manageable and makes unrooting as simple as restoring the original boot image.
A few things worth knowing about the modern landscape before you dive in:
- Root is now something you flash, not something an app grants itself. There’s no exploit involved. You unlock the bootloader through an official manufacturer-sanctioned switch, patch your phone’s boot image with the Magisk app, and flash it back via fastboot. Because bootloader unlocking and flashing happen over fastboot, you can’t root a modern phone without a PC. The computer is structural, not optional.
- Hiding root got much harder. Magisk used to include MagiskHide, a feature that masked root from banking apps. It was removed in 2021. Its successor, the DenyList, hides Magisk from specific apps, but it’s deliberately not a full cloaking system. Google’s Play Integrity checks now use hardware-backed attestation, so banking apps, Google Wallet tap-to-pay, and some streaming services can detect an unlocked bootloader regardless of what you hide. Passing those checks is an endless cat-and-mouse game that you should expect to lose eventually.
- Not every phone qualifies. Samsung devices sold in the US and Canada have permanently locked bootloaders, and Huawei stopped issuing unlock codes years ago. Pixels, Motorola, Nothing, and OnePlus are the friendliest brands; Xiaomi allows unlocking but makes you wait out an approval period.
Still running KingRoot on an old phone? Here’s the safe path
If you’ve got an aging device with KingRoot or KingUser still on it, don’t try to migrate to SuperSU. You’d be swapping one dead app for another. Do this instead:
- Back up everything. Photos, messages, app data. The steps below can end in a factory reset, and if you later unlock the bootloader, a full wipe is guaranteed.
- Fully unroot. Open KingRoot and look for the “remove root permission” or full-unroot option in its settings. If the app is too old to function, the most reliable clean-up for an exploit-rooted phone is to reflash the stock firmware for your exact model, which removes every trace of KingUser in one shot.
- Verify root is gone. A root-checker app from the Play Store, or simply the absence of KingUser and any su binary, is enough confirmation.
- Decide if you still need root. Much of what people rooted for in 2017 (ad blocking, debloating, screen recording, themes) is possible without root now, via Private DNS, ADB, and tools like Shizuku.
- If you do want root, do it properly with Magisk. That means enabling OEM unlocking, unlocking the bootloader from a computer with fastboot, patching your firmware’s boot image with the Magisk app, and flashing it back. Get Magisk only from its official GitHub repository: never from an APK download site, and never as a “Magisk no PC” one-tap tool, because no such legitimate thing exists.
One firm rule: don’t download KingRoot, KingUser, SuperSU, or any “root APK” from third-party download sites in 2026. The original developers are long gone from those brands, and what’s being distributed under those names now is bait for adware, subscription fraud, and spyware.
FAQ
Is SuperSU still safe to use in 2026?
No. SuperSU hasn’t been updated since 2017, its ownership passed to a company that never continued development, and it can’t handle the way modern Android versions boot. On an old device it may technically still run, but an unmaintained superuser manager is a permanent security hole. Magisk is the maintained, open-source replacement.
Does KingRoot work on Android 14, 15, or 16?
No, and it can’t. KingRoot relied on kernel exploits that were patched out of Android nearly a decade ago. Anything claiming to be a working KingRoot for modern Android is fake, and installing it hands deep permissions to an app whose only real function is showing you ads, or worse.
Can I install Magisk without a PC, the way KingRoot worked?
No. Magisk isn’t an exploit. It needs an unlocked bootloader and a patched boot image flashed over fastboot, and both of those steps require a computer. Any app or site promising one-tap, no-PC Magisk root is lying to you.
Will my banking apps work after rooting with Magisk?
Assume some won’t. With MagiskHide gone and Play Integrity using hardware-backed checks, an unlocked bootloader is detectable no matter how carefully you configure the DenyList. Some banking apps still run fine, others refuse outright, and Google Wallet tap-to-pay is a frequent casualty. If mobile payments are essential to you, think hard before unlocking.
The era this article was written for (exploit-based root, KingUser evictions, SuperSU zip files on file-hosting sites) is over, and honestly, good riddance. Root in 2026 is smaller, safer, and more deliberate. If that’s a trade you still want to make, make it with Magisk, from official sources, with your eyes open.
Hello, folks, my name is Akshay, and from the beginning, I like to play with the latest phones, gaming consoles, PCs, Laptops’s and whatnot. When I get spare time, I like to do Photography, and you will always find me playing with Photoshop, Lightroom, Premiere Pro, etc. In Love with Gadgets, my gear Motorola Moto G5 Plus. You can contact him on akshaydua[@]theleaker.com.