Ios 9.3 6 Jailbreak Untethered !free! Online

As of April 2026, the primary untethered jailbreak for iOS 9.3.x (including 9.3.6) on 64-bit devices is kok3shi9. Unlike semi-untethered tools that require re-running an app after a reboot, an untethered jailbreak allows your device to boot directly into a jailbroken state. Current Jailbreak Options for iOS 9.3.6

Depending on your device architecture (32-bit vs. 64-bit), you have different options:

kok3shi9 (Untethered): This is specifically for 64-bit devices (e.g., iPhone 5s, iPad Air 1, iPad Mini 2) running iOS 9.2 through 9.3.x.

Phœnix (Semi-Untethered): This is the standard choice for 32-bit devices (e.g., iPhone 4s, iPad 2, iPad 3, iPad Mini 1) on iOS 9.3.5 or 9.3.6. It is semi-untethered, meaning you must re-jailbreak using the Phœnix app on the device every time you restart. Why Use a Jailbreak on iOS 9?

Since Apple and many third-party developers have dropped support for iOS 9, jailbreaking provides utility for aging hardware:

App Compatibility: You can use tweaks like "Checkmate, Store!" to force the App Store to download the last compatible version of apps for older firmware.

Performance Tweaks: Tools can help disable background daemons to speed up older iPads or iPhones. ios 9.3 6 jailbreak untethered

System Access: Allows running apps like VLC, Telegram (legacy versions), or specialized browsers that may no longer be available in the standard store.

For a general look at how jailbreaking removes Apple's restrictions to allow custom tweaks and apps, you can watch this overview: Unc0ver iPhone Jailbreak Works on All iOS Versions TWiT Tech Podcast Network YouTube• 29 May 2020

While there is no native "one-click" untethered jailbreak for iOS 9.3.6, you can achieve an untethered state by first installing a semi-untethered jailbreak like and then applying a specific "untether" tweak from Cydia.

Historically, iOS 9.3.6 was restricted to semi-untethered tools, meaning the jailbreak would deactivate every time you restarted the device. Recent developments, such as the EverPwnage

tool or specific untethering scripts, have made it possible to keep the device jailbroken through reboots. Part 1: The Jailbreak Foundation (Semi-Untethered) Most methods start by installing EverPwnage to establish the initial jailbreak.

Understanding the Firmware: What is iOS 9.3.6?

Before hunting for a jailbreak, you must understand the rarity of 9.3.6. As of April 2026, the primary untethered jailbreak

In 2019, Apple issued an unprecedented update for devices too old for iOS 10: iOS 9.3.6 (and 9.3.5 for iPod touch). This was not a feature update; it was a critical GPS bug fix. Specifically, 9.3.6 addressed the "GPS Week Number Rollover" issue that broke location services on aging 32-bit devices.

Key facts about 9.3.6:

Architecture: 32-bit (ARMv7s). This is the biggest hurdle.
Devices: Only A5 and A6X chips (iPhone 4s, iPad 2/3/mini 1).
Security: Patched the Pegasus 3 exploits used by earlier tools (like Phœnix).

Because Apple intentionally closed the jailbreak holes in 9.3.6 (released long after 9.3.5), finding an untethered method is extremely difficult.

1.2 Definitions

Tethered: Requires connection to a computer via USB every time the device reboots to re-inject the kernel patches.
Untethered: The jailbreak code is written to the filesystem and executes automatically upon boot without user intervention or computer assistance.
Semi-Untethered: The device can boot stock iOS, but a specific app must be launched to re-apply patches after a reboot.

5. Why No One Made an Untethered for 9.3.x (iPhone 6)

Exploit scarcity: The last public kernel exploit that allowed untethered persistence (CVE-2016-4655, 4656, 4657 — Trident) was patched in 9.3.5.
KPP + KTRR: A8 chip (iPhone 6) has hardware KTRR protection. Booting an untethered patch would require bypassing Apple’s secure boot chain — essentially a bootrom exploit. No bootrom exploit exists for A8 on iOS 9.3.x.
Developer focus shift: By late 2016, jailbreak developers moved to iOS 10 and 11. The effort to build an untethered for an already outdated iOS 9 on a 64-bit device was deemed pointless.
Sideloading ease: Semi-untethered tools like Phoenix are “good enough” for hobbyists and tweak developers. A fully untethered jailbreak adds risk of permanent boot loops.

Step 2: Convert to a "Semi-Untethered" Workflow

While you cannot make it untethered, you can reduce the pain:

Install ReProvision Reborn: This tweak will re-sign the Phoenix app automatically before the 7-day certificate expires. If you set this up correctly, you never need a computer again.
Disable Auto-Lock: Keep the phone unlocked when charging to avoid random deep reboots.
Avoid Low Power Mode: Deep discharge triggers a reboot. On a 9.3.6 device, the battery likely drains fast.

Debunking the YouTube Fakes

Search "iOS 9.3.6 jailbreak untethered" on YouTube today. You will see thousands of videos with a Download link in the description, a fake Cydia logo in the thumbnail, and a robotic voice claiming "100% working."

These are scams.

Do not download custom profiles from unknown URLs. Do not install "Jailbreak 2024" apps from random signing services. Here is how to spot the fakes:

The Text: They use "Untethered" incorrectly. They usually mean "Unsupported."
The File Size: A real iOS 9 jailbreak tool is roughly 10–20 MB. Many fakes are 200 KB HTML files.
The Verdict: If the video asks you to watch an ad before unlocking the download, close the tab.

2.2 Kernel Patching

On 32-bit devices running iOS 9, the kernel is not encrypted in a way that prevents runtime patching (unlike KPP on 64-bit devices). The exploit performs the following actions:

Obtain the Kernel Base: Using information leaks, the tool calculates the randomized kernel base address (KASLR slide).
Disable Security: Patches are applied to the kernel to disable code signing enforcement (AMFI patches).
Remount RootFS: The root filesystem is remounted as Read-Write (rw), allowing the installation of the Cydia package manager and system tweaks.

The "Almost" Untethered: The Checkm8/iPwnder32 Route

This is where hope enters the conversation. The checkm8 bootrom exploit (released in 2019) is permanent. It affects every A5, A6, A7, A8, A9, A10, and A11 chip. Because it is in the Read-Only Memory (ROM), Apple cannot patch it with a software update.

For iOS 9.3.6 devices (A5 chips), checkm8 allows for an untethered-like experience, but with a major caveat.

Using tools like iPwnder32 or Synackuk’s checkm8 loader, you can:

Connect your iPhone 4s to a Mac or Linux PC.
Pwn the device via USB (checkm8).
Boot a custom ramdisk that loads a jailbreak environment.

Is this untethered? No. Why? Because the pwn is lost on a hard reboot. You cannot boot an A5 device from a cold start into a jailbroken state without a computer injecting the exploit via USB. Understanding the Firmware: What is iOS 9

However, many users exploit this with "tethered" tweaks. You can downgrade your 9.3.6 device to 6.1.3 (tethered), but for 9.3.6 itself, checkm8 enables Tethered Jailbreaks, not Untethered.

The Best Real Setup for iOS 9.3.6 (Semi-Untethered)

Since an untethered jailbreak does not exist, let's optimize the semi-untethered experience. If you are stuck on iOS 9.3.6, here is the ultimate guide to making it tolerable.