What encryption keys are and why Suyu needs them

Encryption keys are files that let Suyu — a Nintendo Switch emulator — decrypt and run Switch games on your computer. Without them, Suyu cannot read the game files you own, even if you have legally purchased them. The keys are tied to your specific Switch console and are not included with Suyu itself.

Suyu needs these keys because Nintendo encrypts all Switch game data. The encryption protects the games from being copied or modified. When you run a game on an actual Switch, the console uses its built-in keys to decrypt the game automatically. Suyu has no built-in keys, so you must provide them yourself.

The keys come from your own Switch console — not from Suyu, not from any website, and not from any third party. Extracting them is legal in most jurisdictions because you own the console. This guide explains how to get those keys into Suyu so your games will run.

Key Takeaways

  • Encryption keys come from your own Nintendo Switch console and must be extracted using a tool like Lockpick_RCM or HacKit.
  • You need a way to run custom code on your Switch — usually a USB cable, a computer, and a jig or paperclip to enter Recovery Mode.
  • Once extracted, the keys go into a file called prod.keys or dev.keys in Suyu's configuration folder.
  • The exact folder location depends on your operating system: %APPDATA%\suyu\keys on Windows, ~/.config/suyu/keys on Linux, and ~/Library/process Support/suyu/keys on macOS.
  • If you cannot extract keys from your own console, you cannot legally use them in Suyu, and the emulator will not run encrypted games.

What you need before you start

You need physical access to a Nintendo Switch console that you own. The console does not need to be modified or jailbroken — you only need to put it into Recovery Mode temporarily to extract the keys. You will also need a computer with a USB cable that can connect to the Switch.

On the computer side, you need extraction software. Lockpick_RCM is the most common tool and works on any Switch model. It runs as a payload, which means you send it to the Switch over USB without permanently changing the console. HacKit is another option that works similarly. Both are free and open-source.

To send a payload to your Switch, you need a way to trigger Recovery Mode. This requires either a USB jig (a small device you can buy online for under $10) or a paperclip bent into a specific shape. The jig or paperclip shorts two pins on the right Joy-Con connector, which tells the Switch to boot into Recovery Mode instead of starting normally.

Extracting keys from your Switch console

Start by downloading Lockpick_RCM from its GitHub repository. You will get a file called Lockpick_RCM.bin. You will also need a tool to send this file to your Switch — TegraRcmGUI on Windows or Tegra RCM Loader on Linux and macOS are the standard choices.

Power off your Switch completely. Insert the USB jig into the right Joy-Con rail, or use a paperclip to short pins 1 and 10 on the right Joy-Con connector. While holding the jig or paperclip in place, press and hold Volume Up, then press Power. The screen will stay black — this is correct. The Switch is now in Recovery Mode.

Connect the Switch to your computer with a USB-C cable. Open TegraRcmGUI (or your chosen loader tool) and select the Lockpick_RCM.bin file. Click the button to send the payload. Lockpick will run on the Switch and display the extracted keys on the screen. Take a screenshot or write them down — you will need them in the next step.

Once Lockpick finishes, power off the Switch by holding Power for 10 seconds. Remove the jig or paperclip. The Switch is back to normal and has not been permanently changed. The keys you extracted are unique to that console and cannot be used with any other Switch.

Creating the keys file for Suyu

The keys Lockpick extracted need to go into a plain text file called prod.keys. Open Notepad (Windows), gedit (Linux), or TextEdit (macOS) and paste the keys exactly as they appeared in Lockpick's output. Each key should be on its own line in the format keyname = hexadecimal_value.

Save this file as prod.keys — not prod.keys.txt, not prod.txt, just prod.keys. The file extension matters. If your text editor automatically adds .txt, you must rename the file after saving or change the file type dropdown to "All Files" before saving.

Do not edit or modify the keys. Copy them exactly as Lockpick displayed them. A single wrong character will make the keys invalid and Suyu will not recognize them.

Placing the keys file in Suyu's configuration folder

Suyu looks for keys in a specific folder that depends on your operating system. On Windows, the folder is %APPDATA%\suyu\keys. The easiest way to find it is to open File Explorer, paste %APPDATA%\suyu\keys into the address bar, and press Enter. If the folder does not exist, create it by right-clicking in the parent folder and selecting New Folder.

On Linux, the folder is ~/.config/suyu/keys. Open a file manager and press Ctrl+H to show hidden folders (folders starting with a dot are hidden by default). Navigate to .config, then suyu, then keys. Create the keys folder if it does not exist.

On macOS, the folder is ~/Library/process Support/suyu/keys. The Library folder is hidden by default. Open Finder, press Cmd+Shift+G, paste the path, and press Enter. Create the keys folder if needed.

Copy your prod.keys file into whichever folder matches your operating system. Do not rename it or move it after placing it there. Suyu will look for it by name in that exact location.

Verifying the keys are working

Open Suyu and load a game file. If the keys are correct, the game will load and run. If the keys are wrong or missing, Suyu will either refuse to load the game or display an error message saying the keys are invalid.

If you see an error, double-check that the prod.keys file is in the correct folder for your operating system and that the filename has no extra characters or extensions. Close Suyu completely and reopen it — sometimes Suyu needs to be restarted to recognize a new keys file.

If the keys still do not work, the most common cause is a typo when copying the keys from Lockpick's output. Go back to your Switch, extract the keys again, and compare them character by character with what you typed. Hexadecimal keys are case-insensitive (A and a are the same), but every digit must match exactly.

Troubleshooting common problems

The Switch will not enter Recovery Mode. Make sure you are holding Volume Up before pressing Power, and keep holding it while the screen is black. If using a paperclip, check that it is making firm contact with both pins. If using a jig, make sure it is fully inserted into the Joy-Con rail. Try a different USB cable — some cables do not support data transfer.

TegraRcmGUI does not detect the Switch. Install the correct USB drivers for your operating system. On Windows, read the driver package from the TegraRcmGUI repository. On Linux, you may need to add a udev rule. On macOS, drivers usually install automatically, but restart your computer if detection fails.

Lockpick runs but shows no keys. The Switch may not be in Recovery Mode correctly. Power off, remove the jig or paperclip, wait 10 seconds, and try again. If the screen stays completely black with no text, the payload did not load — try a different USB cable or a different computer.

Suyu says the keys are invalid. The most likely cause is a typo. Open prod.keys in a text editor and compare each key to Lockpick's output character by character. Also check that there are no extra spaces at the beginning or end of each line.

Frequently Asked Questions

Can I use someone else's extracted keys in Suyu?

Technically yes, but legally no in most places. Keys are tied to a specific console, and using keys extracted from a console you do not own violates the Digital Millennium Copyright Act in the United States and similar laws elsewhere. You must extract keys from a Switch you own.

Do I need to modify my Switch permanently to extract keys?

No. Lockpick_RCM runs as a temporary payload and does not install anything on the Switch. Once you power off, the console returns to its normal state. You can extract keys from an unmodified Switch without any permanent changes.

What if my Switch is patched and cannot enter Recovery Mode?

Newer Switch models have a hardware patch that prevents Recovery Mode exploitation. If your Switch cannot be put into Recovery Mode, you cannot extract keys from it. You would need an older, unpatched Switch model to proceed.

Do I need separate keys for different games?

No. The prod.keys file works for all Switch games. The keys decrypt the game format itself, not individual titles. One prod.keys file extracted from your console works for every game you run in Suyu.

Where do I find my Switch's serial number to verify which model I have?

The serial number is printed on the back of the console below the kickstand and also appears in System Settings under System Information. Older models (serial numbers starting with XAW, XAJ, or XAK) are unpatched and can enter Recovery Mode. Newer models cannot.