Most privacy advice asks you to change a setting. This one asks you to replace the operating system on your phone. That is a real ask, so this guide spends as much time on what you give up as on what you gain, and it tells you plainly when the answer is do not bother.
GrapheneOS is a free, open-source version of Android, built by a security-focused non-profit, that runs only on Google Pixel phones. It removes Google from the operating system, adds permissions Android does not have (a per-app internet switch, a sensors switch, fake-empty storage and contacts), hardens the parts of Android that attackers exploit, and adds seizure-specific defences, a PIN that wipes the phone, automatic reboot back into a fully encrypted state, and blocking the USB port while locked. Installation takes about twenty minutes from a web browser.
01What it actually fixes
It is easy to list features. It is more useful to start from the four ways a phone gets people in trouble, and see what each one is answered with.
Threat: the phone is taken from you
At a checkpoint, in a raid, at a border. Forensic extraction tools sold to police and intelligence services worldwide work best against a phone that is powered on and has been unlocked at least once since boot, in that state a large part of your data is already decrypted in memory and the operating system has a lot of attack surface exposed. A phone that has been rebooted and not yet unlocked is a far harder target: the encryption keys are simply not there.
GrapheneOS attacks this directly:
- Automatic reboot. If the phone is not unlocked for a set period, it reboots itself back into that strongly-encrypted pre-unlock state. Configurable, and it can be set as low as ten minutes. A phone confiscated in the morning and taken to a lab in the afternoon arrives cold.
- Duress PIN. You set a second PIN or password. Entering it looks like a normal unlock attempt and instead irrecoverably wipes the device — data partition and eSIMs, by destroying the keys. It works from the lock screen and from anywhere the device asks for your credential.
- USB port control. The port can be restricted to charging only, or disabled entirely, while the device is locked. Forensic tools generally arrive over USB.
- PIN scrambling and no fingerprint fallback traps. The keypad layout can be randomised so a shoulder-surfer or a ceiling camera cannot learn your PIN, and the failed-attempt handling is stricter than stock Android.
Understand the legal exposure. Deliberately destroying data during a search is a criminal offence in many jurisdictions, and using it can turn a device search into an obstruction charge. It is a tool for a specific situation, a hostile non-legal seizure where the contents would endanger other people, not a default. Decide in advance, calmly, whether it applies to you, and never configure one you might enter by accident.
Threat: the apps on your own phone
On stock Android an app that can read your storage can read all of it. An app with contacts permission takes your whole social graph. And every app that is installed has internet access automatically — Android has never had a permission to refuse it.
- Network permission. GrapheneOS adds one. You can install an app and simply not let it talk to the internet, a camera app, a PDF reader, a metadata scrubber, an offline map. This single toggle kills most telemetry outright.
- Sensors permission. Blocks the accelerometer, gyroscope, compass, barometer and other sensors Android exposes with no permission at all. Those sensors are enough to fingerprint a device and, in published research, to infer typing and movement.
- Storage Scopes. Instead of refusing an app storage access and watching it break, you tell it storage is empty, then grant individual files or folders. The app believes it has full access and sees only what you chose.
- Contact Scopes. The same trick for your contacts. A messaging app can be shown exactly three people instead of your whole address book.
Threat: Google itself
On a standard Android phone, Google Play Services runs with sweeping privileged access baked into the operating system. It cannot meaningfully be removed, restricted or audited, and it is a lawful-access target — Google receives and answers geofence and account requests.
GrapheneOS ships with no Google code at all. If you need the Play Store, you can install sandboxed Google Play: the ordinary Google apps, running as a normal unprivileged app in whichever profile you choose, subject to every permission above, including the network toggle. Most apps that need Play Services simply work. Google gets what any other app gets: what you allow it.
Threat: someone attacking the phone remotely
Mercenary spyware, the Pegasus/Predator class of tooling, has been used repeatedly against journalists and human-rights workers in this region. No phone is immune. But these exploit chains are built and tested against stock operating systems, and GrapheneOS changes the ground underneath them: a hardened memory allocator, a hardened kernel and libc, stricter compiler mitigations, and aggressive attack-surface reduction. Several documented exploit chains have failed against it incidentally, simply because assumptions the exploit relied on were no longer true.
This is the technical detail that separates GrapheneOS from nearly every other custom Android ROM, and it is worth understanding. Most custom ROMs require you to leave the bootloader unlocked, which permanently disables verified boot: the phone will then start any operating system anyone puts on it, and tampering becomes undetectable. GrapheneOS supports re-locking the bootloader with its own signing key, so the full hardware chain of trust stays intact. You keep the Pixel's hardware security and get the hardened OS. You are not trading one for the other.
02Why it is Pixel-only, and which one to buy
The Pixel requirement frustrates people, and it is not favouritism. It follows from the verified-boot point above. Google Pixels are, in practice, the only widely available phones that let a third-party operating system re-lock the bootloader with its own key and keep full verified boot and hardware-backed attestation. They also ship a dedicated secure element and receive long, predictable firmware support, and firmware is the one layer no OS project can fix for you.
A Pixel is only as secure as its firmware updates. Pixel 8 and later ship with seven years of guaranteed updates from release; earlier models had shorter windows and some have already ended. Check the current supported-devices list on grapheneos.org before you buy anything, new or used, an out-of-support Pixel running GrapheneOS still has unpatched firmware underneath it, and that is exactly the layer that matters most.
Buying without creating a paper trail
If your threat model includes someone establishing that you own a hardened phone, the purchase is the weak point, not the device.
- Cash, in person, second-hand is the cleanest. Check IMEI blacklist status before paying.
- Do not buy carrier-locked or carrier-branded stock, some carrier variants cannot be unlocked for installation at all.
- Buy the phone and the SIM from different places, ideally on different days.
- A brand-new sealed phone from a big retailer paid in cash is also fine, and removes any worry about what a previous owner did to it.
03What you give up
Every guide that skips this section is selling you something. Here is the real list.
| Thing | Status | Detail |
|---|---|---|
| Contactless payments | Broken | Google Wallet tap-to-pay does not work and is not expected to. Carry a card. This is the single most common reason people switch back. |
| Banking & government apps | Mixed | Most work with sandboxed Play; some need the permissions or settings they expect, such as location, notifications or network access. A minority hard-fail on device-integrity checks. Test your specific bank before relying on it. |
| Some streaming in HD | Mixed | Certain services drop to lower resolution over DRM certification. |
| Carrier voicemail & RCS | Mixed | Varies by carrier. Standard calls, SMS and mobile data are unaffected. |
| Your warranty | Depends | Consumer law in the EU and UK generally protects you; elsewhere assume unlocking the bootloader may be treated as voiding it. Installation is fully reversible either way. |
| Not standing out | Cost | Discussed below. Read it. |
| Everyday usability | Fine | It is Android. The interface, the Play Store, your apps, notifications, all normal. Most people stop noticing within a week. |
A hardened phone can itself attract attention. At a checkpoint, an officer who does not recognise your operating system may treat that as suspicious in itself, and in some places running unusual software is read as evidence of something to hide.
This is a genuine trade-off with no universal answer. Two mitigations are worth knowing: GrapheneOS looks like ordinary Android to anyone glancing at the screen, and you can keep a normal-looking owner profile with mundane apps while your sensitive work lives in a separate user profile with its own encryption. If you live somewhere that device inspection is routine, weigh this carefully, and read the checkpoint guide when it is published.
04Installing it
The official web installer does the whole thing from a browser. It is the easiest custom-OS installation in existence, and it is very hard to permanently break a Pixel this way, a failed install can be recovered by starting over.
Installation wipes everything. Back up your photos, your two-factor authenticator seeds and your Signal account transfer first, and confirm you can actually restore them. Authenticator apps are what people lose, if your 2FA codes live only on this phone, sort that out before you begin or you will lock yourself out of your own accounts.
-
Get the official instructions in front of you
Open grapheneos.org/install/web and follow it alongside this page. The official guide is authoritative and kept current; this one explains the reasoning and the decisions the installer does not make for you. Type the address by hand, do not reach it through a search engine, where lookalike domains buy ads.
-
Use a Chromium-based browser on a computer
The installer needs WebUSB, which means Chrome, Edge, Vanadium or similar. Firefox and Safari will not work. Use a good-quality USB-C cable, the one that came with the phone is ideal. Most installation failures people report are a bad cable or a flaky hub, so plug directly into the machine.
-
Enable developer options and unlock the bootloader
On the phone: Settings → About phone → tap Build number seven times. Then Settings → System → Developer options → enable OEM unlocking and USB debugging.
If OEM unlocking is greyed outThe phone is carrier-locked, or too new to the account. Connect it to the internet and leave it for a while, or resolve the carrier lock. Do not force it, a carrier-locked Pixel may not be installable at all, which is why the buying advice above says avoid them.
-
Run the web installer
Work through the page in order: unlock the bootloader, download the release, flash it. The browser will ask you to select the device — pick the Pixel when the dialog appears. The whole flashing stage is typically ten to fifteen minutes on a decent connection. Do not unplug it.
-
Re-lock the bootloader, do not skip this
The final installer step. Skipping it leaves your phone permanently vulnerable to anyone with physical access and throws away one of the main reasons to run GrapheneOS at all. The installer will not let you lock a broken install, so if the command succeeds, you are fine.
-
Confirm the boot state
On first boot you should see the yellow verified-boot notice showing GrapheneOS's own signing key, then the setup wizard. Yellow with the GrapheneOS key is correct and expected. Orange means the bootloader is still unlocked — go back and lock it.
05The first hour: settings that matter
Installing it is most of the work, but the defaults are deliberately moderate so that ordinary people are not locked out of their own phones. These are the changes worth making immediately.
-
Set a real passphrase, not a 4-digit PIN
This is the single highest-value thing on this page. Every other protection ultimately rests on your credential. Six random words, or a PIN of at least eight digits. Enable PIN scrambling while you are in there.
-
Turn on automatic reboot and shorten it
Settings → Security. Choose a window that matches your life. If you are somewhere seizure is a live risk, a few hours or less. The trade-off is that after a reboot, alarms and notifications do not arrive until you unlock, which is precisely the point.
-
Restrict the USB port while locked
Settings → Security → USB. Charging-only when locked at minimum; fully disabled if you can live with it.
-
Disable 2G
Legacy 2G has broken encryption, and IMSI catchers work by forcing your phone down onto it. GrapheneOS lets you refuse. There is also an LTE-only mode. Turn 2G off unless you are somewhere with genuinely no other coverage.
-
Decide about Google before you install anything
If you can live without the Play Store, do — get apps from F-Droid, from Accrescent, or directly from developers, and enjoy a phone with no Google code on it. If you need Play Services, install sandboxed Google Play from the built-in Apps repository, but put it in a secondary user profile, not your main one, so it is walled off from your sensitive work.
-
Make apps work with sandboxed Google Play
Open the GrapheneOS Apps app in the profile where you want to use an app, then install Google Play services. It installs both Play services and the Play Store. Install the app in that same profile: sandboxed Play cannot provide services to an app in another profile. Keep Play services, the Play Store, and the app updated through the Apps app and Play Store.
If an app opens but sign-in, notifications, maps, purchases, or background refresh do not work, check these before giving it broader access:
- Profile: confirm the app and sandboxed Google Play are installed in the same user profile.
- Battery: in the Google Play services app settings, allow it to run without battery optimisation so it can deliver background notifications. Do the same for the app only if it still needs it.
- App permissions: enable only the permission the failed feature needs — commonly Notifications, Location, Nearby devices, Camera, or Files. Start narrow, test, then add another only when necessary.
- Location: give the app location permission if it needs location. GrapheneOS's default location rerouting is usually enough; only change the Google location settings if ordinary location use actually fails.
- Updates and restart: update all three components, force-close and reopen the app, then reinstall it if an update left it stuck.
A small number of apps reject GrapheneOS because they demand a particular device-integrity verdict. That is the app maker's restriction, not a missing permission; no setting should be weakened just to bypass it.
-
Set up profiles
Separate user profiles have separate encryption keys. A practical split:
- Owner, nothing but setup. You rarely use it.
- Personal — ordinary life, Play Services if you need them, banking, maps.
- Work — documentation, Signal, camera, the archive. No Google.
A profile you are not logged into is at rest and encrypted. You can also configure profiles to end their session automatically when you switch away.
-
Audit permissions app by app
Every app you install: does it need the internet? Sensors? Real storage, or a scope with three files in it? Assume no by default and turn things on when something visibly breaks. This takes twenty minutes once and pays out permanently.
-
Verify the install is genuine
Install the GrapheneOS Auditor app and pair it with a second device, or use the official attest service. It cryptographically confirms your phone is running a genuine, unmodified GrapheneOS with a locked bootloader, and can keep verifying it over time, which is how you would detect tampering after the phone left your sight.
- Download only from
grapheneos.org, typed by hand - Re-lock the bootloader
- Use a long passphrase
- Keep the phone updated — installs are automatic and frequent
- Separate identities into separate profiles
- Test your bank's app before you depend on it
- Install builds from forums, Telegram or YouTube links
- Root it — rooting destroys the security model you came for
- Add a Google account in your sensitive profile
- Assume it defeats a targeted state operation
- Set a duress PIN you have not thought through legally
- Leave the bootloader unlocked "for now"
06What it does not protect you from
Being clear about this is what makes the rest of the guide trustworthy.
- The network knows you exist. Your carrier still sees which towers you connect to. That is how cellular works. Only leaving the phone behind fixes it.
- What you send still leaves. Posting to a platform, or messaging someone whose own phone is compromised, is not protected by your operating system.
- Metadata in your files is untouched. A video you film still carries GPS and device details unless you strip them.
- Coercion. No software resists someone who can detain you until you unlock it.
- Firmware and baseband. The cellular modem runs its own proprietary code. GrapheneOS isolates it as far as Android allows; it cannot replace it.
- You. Reusing a username, logging into a personal account from a work profile, or posting a photo with a recognisable window in it will undo all of this. Most people are identified through habits, not exploits.
07Questions people actually ask
Is it legal to use?
Installing a different operating system on hardware you own is legal in the overwhelming majority of countries, and GrapheneOS is an openly developed non-profit project. That said, in some jurisdictions and at some borders, encryption or unusual software attracts pressure regardless of legality. Know your own situation.
Is it hard to use day to day?
No. It is Android with a plain interface and no preinstalled clutter. The learning curve is the permission model, and that is a week at most. The genuine friction is tap-to-pay and the occasional stubborn app, not the OS.
Can I put it back to normal Android?
Yes. Google publishes official factory images and the process is the same kind of flashing in reverse, ending with the bootloader locked again. Nothing here is permanent.
Why not LineageOS, /e/OS, or CalyxOS?
They are different trade-offs. The decisive question is verified boot: most alternatives require leaving the bootloader unlocked, which means the phone will boot anything and tampering cannot be detected. If your threat model includes anyone getting physical access to your device, which is exactly the threat model this site's contributors have, that is disqualifying.
CalyxOS does support relocking on Pixels and is a reasonable choice for someone who wants a gentler setup. It does not go nearly as far on hardening or on the seizure-specific features described above.
Does it hurt battery life or performance?
Battery life is generally the same or better, mostly because Google Play Services is not running in the background unless you asked for it. The hardened memory allocator costs a few percent of performance in benchmarks and is not noticeable in use.
I cannot afford a Pixel. What do I do?
Then do the rest. A stock phone with a long passphrase, Signal, careful permissions, a VPN, and disciplined habits beats a GrapheneOS phone used carelessly. Hardware is one layer. Behaviour is the one that catches most people, and it is free. A second-hand in-support Pixel is also cheaper than most people assume.
How is the project funded?
Donations and grants, as a registered non-profit. No advertising, no data collection, no vendor deals. The source is public and the builds are reproducible, which means anyone can verify that the released binary matches the published source.
08Sources and further reading
- GrapheneOS — official site grapheneos.org
- Full feature and hardening list grapheneos.org/features
- Official web installer grapheneos.org/install/web
- Supported devices and end-of-life dates, check before buying grapheneos.org/faq#device-support
- Duress PIN documentation grapheneos.org/usage#duress
- Amnesty International Security Lab — Pegasus forensic methodology amnesty.org · background on the mercenary-spyware threat
- The Citizen Lab — ongoing targeted-surveillance research citizenlab.ca
Last reviewed: 25 September 2026