GrapheneOS: The Complete Guide to the Best Privacy OS

TL;DR — In this guide, you will learn:

• Why GrapheneOS is the gold standard for mobile privacy and how to choose the right Pixel.
• How to install and configure GrapheneOS from scratch.
• How to leverage user profiles, sandboxed Google Play Services, and advanced security settings.
• Troubleshooting: resolving common app compatibility and geolocation issues.

What is GrapheneOS and who is it for?

GrapheneOS is a secure, open-source Android operating system focused on privacy and security. It is designed for individuals who want to minimize data collection, enhance application isolation, and maintain compatibility with standard Android apps. This compatibility is achieved by running Google Play Services inside an unprivileged sandbox.

Primary Sources: Official GrapheneOS documentation, project FAQs, the Android Open Source Project (AOSP), and hands-on testing on supported Pixel hardware.

Your smartphone is your most intimate device, tracking your location, communications, and daily habits. Stock Android and iOS operating systems constantly transmit telemetry to Google and Apple. GrapheneOS is the premier open-source alternative that offers enterprise-grade security without compromising user privacy. This guide covers everything from hardware selection to advanced configuration.

GrapheneOS is a Free and Open Source Software (FOSS) operating system based on the Android Open Source Project (AOSP) , built to enhance privacy and security. It represents the current gold standard for custom mobile operating systems.

This guide compiles technical knowledge regarding mobile privacy and security as implemented by the GrapheneOS project, drawing inspiration from security researchers like PatrickD .

This resource is entirely free, non-profit, and does not track users or serve ads. If you find this guide helpful, please share it on Telegram channels, X (Twitter), or other communities to support privacy awareness.

Choosing a Device

The most common question for newcomers is: why does GrapheneOS support so few devices, and why are they all Google Pixel phones?

Why only Pixel devices?

According to GrapheneOS, Pixel devices are currently the only viable option. This is not due to an exclusive contract with Google, nor because Pixels are inherently flawless, but rather because all other OEM alternatives fail to meet GrapheneOS’s hardware security requirements. The project maintains a list of requirements for supported devices; currently, only Pixels meet these standards.

Pixel devices provide robust support for custom operating systems because they serve as the reference platform for Android development. They receive regular firmware updates and offer advanced hardware security features, such as Memory Tagging (MTE) and custom key installation for verified boot, which remain functional even when running custom ROMs.

Most other OEM manufacturers treat alternative operating system support as a non-professional hobby feature. They frequently omit basic hardware security measures, delay critical firmware updates, and expand the device’s attack surface through invasive proprietary system modifications.

Extended device support would force GrapheneOS to compromise on its security baseline by supporting devices that lack verified boot or hardware isolation. Developing hardware-specific security features for insecure devices would divert critical development resources away from hardening the core OS.

Are there alternatives?

While there are various alternative operating systems for Android devices, none match GrapheneOS’s security hardening.

A primary criticism leveled by the GrapheneOS team against other custom ROM projects is their delay in implementing upstream Android security patches.

• LineageOS : Focuses on device longevity and broad compatibility rather than strict security. It typically lacks verified boot, leaving devices vulnerable to physical tampering.
• /e/OS : market-positioned as a “de-Googled” mobile ecosystem, but it is built on top of LineageOS and includes custom applications that introduce additional security risks.
• CalyxOS : Frequently falls behind on security patches and has historically faced criticism for reporting incorrect patch levels. It also has had implementation bugs in core security features, such as emergency data-wipe routines.

Note: For a detailed comparison of Android-based operating systems, consult this third-party Android Comparison Table .

• CopperheadOS : The commercial entity under which GrapheneOS was originally developed. Following a hostile internal split, GrapheneOS transitioned into an independent, fully open-source project. CopperheadOS is now a closed-source commercial fork, which is generally not recommended.
• Purism (Librem 5) : Promises hardware privacy via physical kill switches. However, GrapheneOS criticizes the Librem 5’s hardware components, firmware update mechanisms, and dependency on closed-source blobs. GrapheneOS argues that a locked-down iOS device in Lockdown Mode provides a superior security posture compared to boutique Linux phones.

GrapheneOS focuses on substantive, verifiable security rather than marketing buzzwords, making it an openly technical project.

Can Google hardware be trusted?

It may seem counterintuitive to use Google-manufactured hardware for a privacy-focused setup. However, because Pixels are the reference devices for Android security, they receive intense scrutiny from external security researchers. Under these circumstances, hiding intentional hardware backdoors without detection would be extremely difficult.

It is also easier for adversaries to compromise the supply chain of niche, boutique hardware manufacturers than to intercept the global logistics network of a major manufacturer like Google. Furthermore, leaks from forensic extraction firms (such as Cellebrite) show no evidence of hardware-level backdoors in modern Pixel chips. If you wish to avoid Google entirely, the next best alternative is an Apple iPhone configured in Lockdown Mode.

Which Pixel should you choose?

For maximum security, select a recently released Pixel model. In 2026, this means choosing a model from the Pixel 9 or Pixel 10 family. These newer devices feature advanced hardware security mitigations like Memory Tagging (MTE), faster secure elements, and modern cellular modems. If you plan to use multiple concurrent user profiles, the Pro models equipped with 16 GB of RAM are highly recommended.

If you are looking for the best budget option, the Pixel 9a is a practical choice. The Pixel 8 series also remains a solid baseline if you already own one. Always check the official Device Lifetime Table before purchasing a device.

Once a device reaches its End-of-Life (EOL) date, it stops receiving critical proprietary firmware and driver patches from the chip manufacturers (like Google or Broadcom). Even if GrapheneOS continues to provide legacy OS updates, the device remains vulnerable to hardware-level exploits.

Installation

GrapheneOS can be installed securely using the official WebUSB Installer from a compatible browser (like Chromium-based browsers on Linux, macOS, or Windows). The installer handles unlocking the bootloader, flashing the firmware, and re-locking the bootloader automatically.

Protection Against Tampering

Verified Boot Key Hash

When your device boots with GrapheneOS, a warning screen will inform you that it is running a custom operating system. This screen displays a cryptographic fingerprint (hash) representing the public signing key used to sign the custom OS. You should match this hash against the official values to confirm the system’s integrity:

Compare the hash displayed on your boot screen with the Official Web Installer Reference Hash to ensure your system firmware has not been modified.

Auditor App & Attestation

GrapheneOS includes a pre-installed Auditor app. This utility uses hardware-based attestation to cryptographically verify the integrity of the operating system. You can verify your device locally using a second phone, or automate the verification process using the official attestation.app service. This service will notify you via email if your device fails to perform a scheduled remote attestation check, signaling potential tampering.

Hardening Through Settings

GrapheneOS provides extensive local controls to harden your system, minimize your attack surface, and sandbox applications.

Secure Lock Screen

GrapheneOS encrypts user data with keys derived from your lock screen passcode. The hardware secure element (Titan M2) enforces escalating delays between incorrect attempts, making brute-force attacks infeasible.

• Passcode Strength: Use a strong PIN (at least 6 digits) or an alphanumeric passphrase. GrapheneOS disables weak unlock patterns by default.
• PIN Scrambling: Enable PIN scrambling to randomize the layout of the entry pad, preventing adversaries from guessing your code via fingerprint smudges or shoulder surfing.
• Biometrics: Biometric unlock (fingerprint) can be enabled, but for high-security threat models, limit fingerprint access to in-app authentication and require a PIN/password to unlock the device. GrapheneOS also supports two-factor unlock (requiring both fingerprint and passcode).
• Panic Trigger: You can define a “Panic PIN/Password” under the lock screen settings. Entering this specific passcode at the lock screen will trigger a hardware factory reset, purging all decryption keys and shutting down the device.

Auto Reboot

When a device is unlocked, its decryption keys remain in memory. If the device is stolen in this state (After First Unlock or AFU), forensic tools can extract data from the device RAM.

To mitigate this, GrapheneOS features an Auto Reboot timer. If the device remains locked without being opened for a specified duration (adjustable from 10 minutes to several hours), it will restart automatically. Restarting returns the device to the Before First Unlock (BFU) state, fully encrypting the filesystem.

USB Port Restrictions

Forensic extraction tools often exploit vulnerabilities in USB interface drivers to bypass lock screens. GrapheneOS offers hardware-level control over the USB-C interface.

By default, the system rejects new USB data connections while the screen is locked. You can configure the USB port to be completely disabled at the data level while the OS is running, allowing only charging.

Wireless Attack Surface

To minimize the wireless attack surface:

• Wi-Fi and Bluetooth Timers: Configure Wi-Fi and Bluetooth to turn off automatically when disconnected for a set period.
• LTE-Only Mode: Set your cellular preferences to LTE-only. This disables legacy 2G/3G protocols (which are vulnerable to fake cell tower IMSI-catcher attacks) and avoids the complex codebase of early 5G implementations.

Cellular Privacy Limitations

Cellular networks require your SIM card to authenticate using a unique hardware identifier (IMSI) linked to your real identity. To prevent tracking:

• Avoid Cellular Calls and SMS: Use end-to-end encrypted internet protocols (like Signal or SimpleX) instead of standard carrier routing.
• Cellular Hotspots: Routing your traffic through a secondary Wi-Fi hotspot does not hide your location; it simply shifts the cellular tracking signature to the hotspot hardware, which is often less secure than your Pixel’s isolated baseband processor.
• Airplane Mode: Airplane mode completely disables the baseband transmitter. You can safely toggle Wi-Fi back on while cellular functions remain disabled.

App Exploit Protection

Under Settings » Security, GrapheneOS offers advanced exploit mitigations:

• Memory Allocator Hardening: Enforces strict memory protections for user applications, making buffer overflows harder to exploit.
• Disable JIT Compilation: Forces Ahead-Of-Time (AOT) app compilation. This improves security by removing the Just-In-Time compiler attack surface, though it increases app installation and update times.

Granular App Permissions

GrapheneOS enhances the standard Android permission model:

• Sensors Permission: Android allows apps to read the accelerometer, gyroscope, and compass without permission. GrapheneOS lets you toggle off sensor access globally or per-app to prevent device fingerprinting.
• Network Permission: You can revoke network access for local apps (like calculators or keyboards) during installation, preventing them from transmitting data.
• Storage Scoping: Instead of granting an app access to your entire storage directory, you can enable Storage Scopes to allow access only to specific files or folders.
• Contact Scopes: Allows you to share a curated list of contacts with an app rather than exposing your entire address book.

Backups

GrapheneOS includes Seedvault, an encrypted backup utility that can save system configurations and application data to a local USB drive or self-hosted Nextcloud server. For files, it is recommended to perform manual backups directly to a laptop via USB file transfer.

Secondary User Profiles

User profiles offer strict data compartmentalization. Each profile functions like a separate physical device, encrypting its data with its own unique keys.

• Background Profile Control: You can disable “Allow running in background” for secondary profiles. When you switch away, the profile’s user session ends, and its decryption keys are purged from memory.
• App Sharing: You can clone application binaries between profiles to save disk space, but the application databases and user data remain isolated.
• Private Space: A nested user profile inside the primary “Owner” profile. It integrates notifications and apps with the Owner profile while unlocked, but stops the user session and locks data when closed.
• Work Profiles: Ideal for separating work apps using local management utilities like Shelter without requiring a corporate MDM server.

Recommended Applications

GrapheneOS includes only a minimal set of secure, open-source default applications to limit the pre-installed attack surface.

• Camera: GrapheneOS’s default camera app is secure, offline, and automatically strips EXIF metadata from captured images.
• Pixel Camera: If you prefer Google’s proprietary camera features, you can install the Pixel Camera app from the Play Store and revoke its network permissions. Enable the “Special access to hardware accelerators for Google apps” toggle to ensure full image processing capability.
• Keyboard: GrapheneOS’s default keyboard is a legacy offline client. For a modern, open-source alternative with glide typing, install HeliBoard .
• Vanadium Browser: Based on Chromium, Vanadium is hardened against web exploits and is the recommended browser for GrapheneOS. Revoke its sensor permissions to prevent browser-based tracking.

App Compatibility

Almost all Android apps run on GrapheneOS. The primary exceptions are apps requiring Google’s Play Integrity API (formerly SafetyNet) with hardware-enforced certification. This may prevent some mobile banking apps and competitive multiplayer games (like Pokémon GO) from running. NFC payments via Google Pay are also unsupported.

Sandboxed Google Play Services

If an app requires Google Play Services, you can install them directly from the GrapheneOS App Store. On GrapheneOS, Google Play Services run as standard, unprivileged apps inside the normal application sandbox. They cannot access your hardware identifiers (IMEI, serial numbers) or override system permissions.

You can configure Play Services’ background network access under Settings » Apps » Sandboxed Google Play to balance notification reliability (via Firebase Cloud Messaging) with battery consumption.

Application Stores

• Accrescent : A security-focused app store designed for GrapheneOS, supporting developer-signed metadata and modern verification.
• Obtainium : Tracks and downloads app updates directly from official developer source repositories (like GitHub releases). Pair it with AppVerifier to confirm package integrity.
• Droid-ify : A modern, fast client for the F-Droid open-source repository.
• Aurora Store: A private client for the Google Play Store, useful for downloading proprietary apps without logging into a Google account.

Troubleshooting Common Issues

Geolocation Issues

By default, GrapheneOS routes location requests to GNSS (satellite) receivers, which can be slow indoors. To improve speed:

1. Enable A-GNSS assistance under Settings » Location.
2. If Sandboxed Google Play is installed, you can enable Google Location Accuracy under the Sandboxed Google Play settings (this requires granting Play Services background location and network permissions).

App Crashes

If an app crashes, check its permissions (such as network access) or temporarily disable exploit mitigations (like hardened memory allocation) for that specific app under its settings page.

Support the Project

The GrapheneOS project relies entirely on community support and donations. If you find this guide valuable, consider supporting their development directly at grapheneos.org/donate .

Related Guides

• De-Google Android: Complete Privacy Guide — Complete configuration for secure Android platforms.
• How to Build a Threat Model — Define your assets and threat boundaries.
• Self-Hosted VPN with Ad Blocking — Secure your mobile traffic using WireGuard and Pi-hole.
• Tor Relay Tutorial — Set up a Tor node to support anonymous communication.