Beginning with devices using an , Apple introduced nonce entanglement . This security measure means that when saving SHSH blobs, a nonce generator produces a different APNonce for each device. For these devices, you must find a generator-APNonce pair for your device and reuse that pair whenever saving SHSH blobs.
: Every blob is unique to your specific device's ECID (Exclusive Chip ID). You cannot use someone else's blobs for your phone.
By providing a comprehensive guide to SHSH blobs, we hope to have shed light on this complex and fascinating topic. Whether you're an iOS enthusiast or a developer, understanding SHSH blobs is essential for working with the iOS ecosystem.
Even if you think you will never downgrade, Use the TSS Saver website. It takes 30 seconds. One day, a jailbreak for your current version might drop after Apple stops signing it. If you have the blobs, you can use a tool like FutureRestore to jump back.
Many jailbreaks are only available for specific iOS versions. By saving SHSH blobs, users can downgrade to a jailbreakable version of iOS even after Apple has stopped signing it. The SHSH blob makes it easier—or sometimes possible—for jailbreaks to work because it allows the older iOS version (when the jailbreak was effective) to be installed. shsh blobs
Download the target unsigned .ipsw firmware file for your device.
The process of generating SHSH blobs involves a complex series of steps:
SHSH blobs (also known as or digital signatures) are unique files that Apple uses to control which iOS versions you can install on your device. By saving these "signatures" while Apple is still officially "signing" a firmware version, you can potentially downgrade or restore to that version later using tools like FutureRestore, even after Apple stops signing it. How SHSH Blobs Work
Blobsaver is an open-source desktop application available for macOS, Windows, and Linux. It simplifies the process by reading your device information automatically. Download and open . Connect your iOS device via USB. Beginning with devices using an , Apple introduced
Usually a few weeks after a new iOS update drops, Apple "closes the signing window" on the older version. Once closed, the TSS server will refuse to generate SHSH blobs for that version forever.
The request includes your device's ECID (Exclusive Chip ID) and a Nonce (a random number generated by your device's bootloader to prevent replay attacks).
: Introduced in iOS 16, this adds another layer of unique nonces (random numbers) that further complicates the restoration process.
An SHSH blob (Signature HaSh blob) is a unique, device-specific digital signature. When you attempt to restore or update an iOS device using an .ipsw firmware file, iTunes or Finder does not perform the installation locally without validation. Instead, your device initiates a challenge-response process with Apple's servers. : Every blob is unique to your specific
This system prevents users from downgrading to older, potentially less secure, or jailbreakable versions of iOS. Why You Need Them
In the early days of jailbreaking (prior to iOS 5), users could easily bypass restrictions by capturing a valid SHSH blob once and "replaying" it later using local custom servers. Because the request data was fixed, the cached signature remained permanently valid for that specific device.
Blobsaver is a cross-platform GUI and CLI application for automatically saving SHSH blobs. It supports macOS, Windows, and Linux, and offers these features: