GrapheneOS

GrapheneOS is a privacy- and security-hardened mobile operating system built on Android, available only for Google Pixel phones. It is the practical “gold standard” recommendation in the Mobile Hardening Guide — stronger memory allocator, exploit mitigations, sandboxed Google services (optional), and per-app network/sensor controls, while keeping the relocked-bootloader / verified-boot chain intact.

Page status

This page is a living guide — built from the official docs plus 2026-current community consensus. Sections marked “TBD” will be filled in as we work through real-world setup. Open a wiki PR if you discover a banking app, MDM, or workflow worth adding to the compatibility notes.

---

Why GrapheneOS

• Hardened kernel and userspace — stronger memory allocator, sandboxing, exploit mitigations beyond stock Android.
• No Google services in the base OS — sandboxed Google Play is optional, runs as a normal unprivileged app, and can be installed only in a separate profile or Private Space.
• Per-app permission controls — network, sensors, storage, contacts can all be denied granularly. Network denial blocks even localhost.
• Verified boot maintained — unlike most custom ROMs, GrapheneOS keeps the relocked bootloader and the full verified-boot chain.
• Active security maintenance — patches typically released within days of upstream Android.

See the upstream features overview and FAQ.

---

Supported Devices

Pixel-only. The official device list is the source of truth. As a rule, only buy Pixels currently in their security-update window (Pixel 6 or newer at the time of writing).

Buying advice

• Buy unlocked, ideally new and direct from Google. Carrier-locked Pixels will not unlock the bootloader and cannot run GrapheneOS.
• Don’t buy a Pixel older than the 6 — most are out of upstream Android security support.
• Privacy-maximalist guides recommend buying in-store with cash to break the IMEI↔identity link. Threat-model dependent.

---

Installation

GrapheneOS has two official install methods:

1. Web Installer — runs in a Chromium-based browser via WebUSB. Recommended for most users.
2. Command-line installer — for environments where the web installer is not viable.

High-level web installer flow:

1. Enable Developer Options on stock Pixel, then enable OEM unlocking.
2. Reboot into the bootloader (adb reboot bootloader or hold Volume Down + Power).
3. Open the web installer in Chrome/Chromium, connect via USB-C, follow prompts: unlock bootloader → flash factory image → lock bootloader.
4. Reboot into GrapheneOS and complete first-boot setup.

The most common gotchas: forgetting to enable OEM unlocking before starting, using a flaky USB-C cable, or skipping the bootloader re-lock at the end.

---

Day-One Verification

These are mechanical steps. Do them before adding any accounts or signing into anything.

1. Compare the Verified Boot key hash displayed on the yellow boot screen (visible on Pixel 6 and newer) against the official published hash list. This catches a tampered or compromised flashing computer.

2. Confirm the bootloader is locked. The web installer’s final step does this; verify by checking the boot screen shows “verified” rather than “unlocked.” Per the FAQ, an unlocked-bootloader install is considered “incomplete” and unsupported.

3. Disable the “OEM unlocking” toggle. In GrapheneOS first-boot setup it is checked by default — uncheck it.

4. Verify the device with Auditor. Auditor is already installed in GrapheneOS (the icon is in your app drawer — no install needed). It confirms the phone’s hardware, firmware, and OS haven’t been tampered with. Pick one of these two paths:

   • Recommended for most people — remote verification via attestation.app. You only need a browser on any device you trust (laptop, tablet, an existing phone — does not need to be Android).
     1. Open attestation.app in a browser and create an account. A QR code appears.
     2. Open Auditor on the GrapheneOS phone and tap “Enable remote verification.”
     3. Scan the QR code from your browser with the phone.
     4. Set an alert email address on attestation.app. It will check the phone on a regular schedule and email you if the device’s state ever changes.
   • Advanced — local pairing with a second Android device. Only useful if you happen to have a second Android phone (running Android 13 or newer with a working camera) that you trust. Install Auditor on it from the Play Store or GitHub releases. On the second phone tap Auditor, on the GrapheneOS phone tap Auditee, and scan the QR codes back and forth as prompted. This gives you a one-time verification; for ongoing monitoring, use the remote-verification path instead.

   Why day one matters: whichever path you pick, the first verification establishes a baseline (“this is what a clean device looks like”). Future verifications compare against that baseline — so doing it before installing apps or signing into accounts means your baseline reflects an untouched OS. Skip day one and you bake whatever state the phone is in into the baseline.

---

Hardening Defaults

Most GrapheneOS defaults are already good. The list below is what to set/confirm immediately.

Setting	Recommended	Why
Screen-lock credential	6-digit random PIN minimum, or ~90-bit passphrase	Secure element throttles brute force at the hardware level. Pattern unlock is intentionally not offered.
PIN scrambling	On	Defeats shoulder-surfers and smudge-attack camera capture.
Auto-reboot	12–18 hours (default 18h)	Returns the device to Before-First-Unlock (BFU) state — data-at-rest encryption keys are evicted from RAM. Critical if the phone is ever seized while locked.
SIM PIN	Set (separate from screen PIN)	Prevents your SIM being used in another device.
2G	Disabled	Defeats most stingray/IMSI-catcher downgrade attacks.
Sensors permission	Audit per-app, deny by default	Blocks motion-based fingerprinting and side-channel sensor abuse. Returns zeroed data when denied.
Network permission	Audit per-app	Denial blocks direct and indirect network access — including localhost.
USB-C when locked	”Charging-only” (default)	Blocks new USB connections while locked. Optionally tighten to “Charging-only (always)” for very high threat models.
Wi-Fi / Bluetooth scanning	Off (default)	GrapheneOS disables these by default unlike stock Android — confirm they’re still off.

Optional but worth knowing:

• Duress PIN/password — entering it irreversibly wipes the device (and any installed eSIMs). Useful if you may be compelled to unlock under duress.
• Wi-Fi auto-off after inactivity — Side of Burritos recommends 10 minutes.
• Bluetooth timeout — 2 minutes if you only use it for occasional file transfer.

---

Sandboxed Google Play

GrapheneOS does not ship Google services. Its sandboxed Google Play lets you install Play Services as a normal unprivileged app — you get most app compatibility back without giving Google the privileged system access it has on stock Android.

The 2026 consensus across Privacy Guides, Techlore, Side of Burritos, and the GrapheneOS forum: for most people, install sandboxed Play. Going fully Google-free is possible and worthwhile if you’re a journalist, activist, or have a specific threat model — but for most users, full de-Google causes enough friction to drive them back to stock Android.

Where to install it:

• Android 15+ (Pixel 8 and newer with current GrapheneOS): use Private Space. Same isolation as a separate profile, drastically less switching friction. This is the current recommendation across multiple 2026 sources.
• Older devices: use a separate secondary user profile. The legacy “work profile via Shelter” pattern is no longer recommended — Shelter has known issues and GrapheneOS explicitly suggests Private Space or a real secondary profile instead.
• Avoid installing sandboxed Play in the Owner profile if you can — keeps Google out of your primary identity.

Install order (do all three from the GrapheneOS App Store):

1. Google Services Framework (GSF)
2. Google Play Services
3. Google Play Store

Operational notes:

• Use a throwaway / burner Google account for the Play Store, not your primary one.
• Don’t toggle Play Services on/off to save battery. Apps that check at launch will silently lose notifications and break in subtle ways. Recurring footgun.
• Don’t install MicroG — incompatible with GrapheneOS’s sandbox model. Community consensus is unanimous on this.

---

Profile Strategy

GrapheneOS supports multiple full user profiles, each with its own disk-encryption key. Profiles are the strongest available identity separation on Android — apps in one profile cannot communicate with apps in another.

Don’t over-engineer on day one

The single most common “I wish I hadn’t” item across 2026 community retrospectives is over-engineering profiles on day one — setting up Owner / Work / Social / Banking / Burner all at once, then giving up two weeks later because switching is constant friction.

Recommended: start with the Owner profile only. Add Private Space (Android 15+) the first time an app actually forces it (typically: sandboxed Play). Add full secondary profiles only when you have a concrete reason — strong identity separation for a specific use case.

When you do segment:

• Private Space (Android 15+) — best default for “everyday Google apps in a sandbox.” Faster than profile-switching, locks separately, hides from launcher. See the App Isolation on Android section of the Mobile Hardening Guide for the full comparison and Private Space footguns (system-search discoverability, no SMS, one-per-device).
• Secondary user profile — strongest separation. Use for genuinely separate identities (e.g., work device for a specific employer, persona for travel, burner for a single high-risk task). Each profile has its own disk-encryption key.
• Owner profile — keep this for the identity you actually live in. It must stay logged in after reboot.

Don’t use Shelter / Insular / Island on GrapheneOS

GrapheneOS explicitly recommends against third-party Device Admin isolation apps in 2026 — Private Space and full secondary profiles provide stronger isolation with proper encryption-key handling. See the Mobile Hardening Guide’s isolation section for the full picture (those apps are still relevant for stock Android 14 and earlier, just not for GrapheneOS).

---

App Sources

GrapheneOS App Store (built-in)

For first-party GrapheneOS apps — Auditor, the Apps repository, and the sandboxed Google Play components (Services, Framework, Store) when you want them. You’ll use this on day one to install Auditor; everything else here is optional. Not a general app catalog.

Where to get everything else

In rough order of preference for most apps:

1. F-Droid — the recommended source for open-source Android apps. Large, curated catalog, every app reproducibly built and signed by F-Droid. Pair with Obtainium for faster updates pulled directly from upstream GitHub/GitLab releases (avoids F-Droid’s build queue, which can lag the upstream release by days).

2. Aurora Store — proxy to the Google Play Store. Use it for proprietary apps without going through Play directly. Two modes:

   • Anonymous — Aurora signs you in to a shared throwaway Google account. Simplest path. Caveats: rate-limited (you’ll occasionally hit “try later”), can’t see paid/region-restricted apps, and no app-specific entitlements.
   • Personal Google account — sign in with your own (or a burner) account. More reliable; unlocks paid apps you’ve purchased and region-restricted apps. Your credentials go through Aurora’s proxy.
   • Either way, Aurora pings Google’s infrastructure. Apps that require Play Services at runtime (banking, Google Maps, Uber, most “big” apps) won’t function from Aurora alone — they need sandboxed Play.

3. Accrescent — a newer app store with stronger update-integrity and signing model than F-Droid. Currently in alpha with a small catalog (a few dozen apps). Worth checking for any specific app you care about, but F-Droid covers the vast majority of FOSS needs today. Watch this project — it may eventually displace F-Droid for many users.

4. Sandboxed Play Store — for apps that require Play-signed installation, in-app purchases, or runtime Play Services (most banking, Google Maps, Uber, streaming). Install in Private Space or a secondary profile, not the Owner profile.

Where to install each app

• App is FOSS and on F-Droid → F-Droid (or Obtainium against the upstream repo for faster updates)
• App is proprietary but works without Google attestation (most utility apps, many indie apps) → Aurora Store (anonymous mode is usually enough; sign in if you’ve paid for the app or it’s region-restricted)
• App needs Play Services at runtime, in-app purchases, or Play-signed installation (banking, Google Maps, Uber, Spotify) → sandboxed Play Store in Private Space or a secondary profile
• App is in both Accrescent and F-Droid → either works; F-Droid is usually the more familiar path

---

App Compatibility (Community-Reported)

Category	Status	Notes
Most US/EU banking apps	✅ Works under sandboxed Play	Chase, Amex, Discover, Navy Federal, Vanguard, PayPal, ING frequently confirmed. Always check PrivSec-dev banking compat tracker before assuming.
Google Wallet / tap-to-pay	❌ Permanently broken	Google blocks at hardware attestation. Will not be fixed.
Curve Pay (UK/EU NFC)	✅ Works	Most-recommended NFC payment workaround in UK; £100 contactless cap.
US tap-to-pay alternatives	⚠️ Sparse	PayPal QR, some regional bank native NFC apps. Genuinely a sore spot.
Android Auto	✅ Works	Through sandboxed Play with documented permissions.
Signal, Element X, Molly, Tusky	✅ Native UnifiedPush	Best citizens of FOSS push notifications.
Tesla, Uber, Lyft, Spotify, Netflix, Disney+	✅ Works under sandboxed Play	Consistent reports.
Strict MDM / corporate enterprise apps	❌ Often broken	Play Integrity / hardware attestation failures. No reliable workaround.
Snapchat	⚠️ Historically flaky	Improved with sandboxed Play but periodic breakage.
Authy	❌ Broken	Account binding fails. Migrate to Aegis or Ente Auth before you wipe your old phone.
Gboard, Google Camera	✅ Works	Common pattern: install in secondary profile with network permission denied.

---

Hardware Security Keys (YubiKey, Nitrokey)

A common new-user question: “Can I use a YubiKey to unlock the phone?”

Short answer: no. Android does not support unlocking the lock screen with a FIDO2 hardware key, and GrapheneOS has explicitly closed the feature request as not planned. The closest workaround (programming a YubiKey OTP slot to type a static password over USB as if it were a keyboard) is exactly what GrapheneOS’s USB-C peripheral lockdown is designed to prevent — USB data is disabled whenever the phone is locked. Disabling that policy to enable YubiKey HID unlock trades real hardware-attack and forensic-extraction defense for a feature most users would invoke occasionally. Net: weaker overall security, not stronger.

The structural reason this isn’t easy to add: the lock-screen credential derives the disk-encryption key. A FIDO2 assertion is a challenge-response, not a stable secret, so it can’t directly key disk encryption without a framework-level wrapper layer AOSP doesn’t have. The realistic path to native support would require Google to ship it upstream — there’s no public signal they’re working on it.

What a YubiKey CAN do on GrapheneOS

All of these work without Google Play Services:

Use case	How
OATH-TOTP storage — keep your TOTP secrets on the key, not the phone	Yubico Authenticator app over USB-C or NFC tap
WebAuthn / FIDO2 sign-in to websites	Vanadium browser → USB-C or NFC tap. (Known Android 16 NFC quirk with the Yubico Authenticator app auto-launching; WebAuthn itself unaffected.)
Passkeys / FIDO2 second factor in apps	Bitwarden, Proton Pass, GitHub, etc. — the YubiKey acts as the FIDO2 authenticator
KeePassDX vault unlock	KeePassDX supports YubiKey OTP / HMAC-SHA1 challenge-response as a vault-unlock factor
GPG signing / SSH agent	OpenKeychain handles the OpenPGP applet for email signing and SSH-agent integration

See the MFA Guide → Hardware Security Keys for the broader 2026 buying guide (YubiKey 5C NFC, Nitrokey 3C NFC, Token2, blue Security Key C NFC), pricing, and two-key backup strategy. For deeper SSH/GPG setup — ed25519-sk keys, GPG-on-card commit signing, smartcard email — see SSH & GPG Keys.

The honest recommendation

Use the YubiKey for what it’s actually good at on GrapheneOS — WebAuthn in Vanadium, TOTP in Yubico Authenticator, FIDO2 second factor for apps that support it. Keep the phone secured by a strong PIN or alphanumeric passphrase plus fingerprint, leave USB-C on the strict Charging-only after first unlock setting from First-Boot Setup, and don’t try to bolt on YubiKey lock-screen unlock — the workarounds defeat protections you actually want.

---

Backups

Seedvault ships with GrapheneOS as the official backup service. Enable it on day one — the option is greyed out until you’ve configured a destination, and community reports put successful restore at ~90% first-try.

Destinations:

• USB-C drive — simplest, fully offline.
• Nextcloud via SAF — works well if you self-host.
• Any Storage Access Framework provider.

---

Push Notifications Without Google

If you go fully Google-free (no sandboxed Play in any profile), notifications come from:

• UnifiedPush with a self-hosted ntfy server — mature path. Element X, Molly, Tusky, Home Assistant all speak UnifiedPush natively.
• Long-polling — apps like Signal can run a persistent connection; battery cost is modest on modern Pixels.

For mainstream apps that only speak Firebase Cloud Messaging, sandboxed Play in a dedicated profile is the pragmatic answer.

---

Common Mistakes (Don’t Do This)

• Don’t toggle Play Services on/off to save battery — silently breaks notifications.
• Don’t modify permissions on system apps — recurring footgun, breaks things subtly.
• Don’t install MicroG — incompatible with the sandbox model.
• Don’t expect Google Wallet to work. It will not, ever, by design.
• Don’t use Shelter / Insular / Island on GrapheneOS — use Private Space or a real secondary profile. See App Isolation on Android for why these apps are still fine on stock Android 14 but not on GrapheneOS.
• Don’t skip the day-one Auditor verification. The first verification is the baseline that all future ones compare against. If you wait until after installing 50 apps and signing into accounts, you bake that state into the baseline — and lose the ability to detect tampering against a known-clean reference.
• Don’t migrate Authy tokens after wiping your old phone — move to Aegis/Ente Auth before the wipe.
• Don’t add Wi-Fi networks you don’t fully trust — GrapheneOS scrambles its MAC per network but pre-existing trusted networks reuse the same MAC.

---

First-Boot Setup

Living log of the decisions we made on the device, with the menu path so they’re reproducible.

Radio auto-off timers

Turn off radios automatically after a window of inactivity. Reduces RF emissions when the phone is sitting on a table, and stops Wi-Fi probe-request broadcasts that can be used to fingerprint or track.

Setting	Path	Our value	Why
Turn off Wi-Fi automatically	Settings → Network & internet → Internet → ⚙ → Turn off Wi-Fi automatically	10 minutes	Long enough to avoid friction (you’re not constantly re-joining networks); short enough that an unattended phone in public stops advertising.
Turn off Bluetooth automatically	Settings → Connected devices → Connection preferences → Bluetooth → Turn off Bluetooth automatically	2 minutes	BT is rarely needed for more than a brief transfer or pairing — short timeout enforces “off by default.”

USB-C peripheral control

GrapheneOS extends Android’s USB control so the USB-C port can be locked down beyond what stock Android offers. Settings → Security & privacy → More security & privacy → USB-C.

Our choice: Charging-only after first unlock.

This means USB data is only carried while the phone is actively unlocked. The moment you re-lock the phone, USB data is blocked. BFU (Before First Unlock — i.e., after reboot, before the first credential entry) is always charging-only regardless of this setting — it’s not a configurable exception. The three options compared:

Setting	Unlocked	Locked (after first unlock)	BFU
Charging-only when locked (default)	Data ✅	Data ❌	Data ❌
Charging-only after first unlock (our choice)	Data ✅	Data ❌	Data ❌
Charging-only (always)	Data ❌	Data ❌	Data ❌

Why the middle option over the default: against a “phone-grabber / juice-jacking” threat at e.g. a conference, leaving the phone unlocked for any window — even briefly setting it down still unlocked — opens a USB-data window with the default. The stricter setting closes that window the moment the screen locks. Tradeoff: brief friction when transferring files or running ADB (have to keep the screen on).

Still TBD (fill in as we go)

• Locale / keyboard / accessibility choices
• Strong PIN configuration (test the hardware throttling behavior)
• Whether to add a fingerprint and under what policy
• First Wi-Fi network and confirming MAC randomization
• Setting up Auditor remote verification at attestation.app (now covered above in Day-One Verification)
• Setting up Seedvault destination
• Installing sandboxed Play in Private Space (vs deferring it)
• Migrating Aegis vault and Signal account from old phone

Daily-Driver Notes (TBD — fill in after a few weeks)

• Banking apps tested (with our specific banks, not just the generic compat list)
• Notifications behavior over time
• Battery life vs stock Android
• Android Auto, eSIM, casting
• Anything that surprised us, good or bad

---

Related

• Mobile Hardening Guide — broader mobile security context (iOS + Android), including the App Isolation on Android section.
• Data Removal and Opt-Out — reduce the data footprint your hardened phone has to protect.

References

Official:

• GrapheneOS — Official site
• GrapheneOS — Install (Web)
• GrapheneOS — Usage guide
• GrapheneOS — Features
• GrapheneOS — FAQ

Curated community:

• awesome-grapheneos-guide — de facto day-one checklist.
• Practical GrapheneOS for the Paranoid — Privacy Guides discussion thread.
• Privacy Guides — Android Overview
• davd.io — Back on GrapheneOS in 2026 — current retrospective.
• Side of Burritos — GrapheneOS tour + useful settings
• Side of Burritos — Private Space vs work profile

Tools & trackers:

• Auditor pairing tutorial (attestation.app)
• PrivSec-dev — Banking apps compatibility tracker
• Techlore Plexus — app compatibility lookup
• F-Droid — recommended FOSS app catalog
• Aurora Store — Play Store proxy (anonymous or signed-in)
• Accrescent App Store — newer alternative, currently in alpha
• Obtainium — direct-from-source app updater
• Aegis Authenticator (TOTP)