Maybe you’ve heard about GrapheneOS and want to understand what it actually is. Or maybe you’ve already decided to install it but don’t know where to start. Or perhaps you’re simply tired of owning a smartphone that knows more about you than you’d like it to.

In all three cases, you’re in the right place.

This guide walks you from beginning to end: from the actual installation all the way to day-to-day configuration, taking in the system’s most interesting features and the practical tips you usually only discover after weeks of use. You don’t need to be a computer expert. All you need is a little patience and the desire to understand how things work.

What GrapheneOS is and why it exists

Before you get your hands on the phone, it’s worth understanding what you’re installing and why someone went to the trouble of building it.

GrapheneOS is a smartphone operating system based on Android, but with one fundamental difference: it’s designed from the ground up to minimize data collection and maximize the security of the device. It’s not a “modified” Android in the amateur sense of the term — it’s a serious project, developed by an international team of engineers, entirely open source, and updated at a pace that puts many commercial smartphone manufacturers to shame.

The developers’ stated goal is a single one: to reduce the attack surface. Put simply, to make the smartphone the hardest possible target for anyone who wants to access it without permission — whether that’s a nosy app, a bad actor with physical access to the device, or a company harvesting data in the background.

But GrapheneOS isn’t for everyone, in the sense that it isn’t suited to someone who wants to install it and forget about it. It requires some initial configuration and a certain awareness of how things work. In return, it gives you something no iPhone and no ordinary Android can offer: real control over what happens inside your smartphone.

Why a Google Pixel specifically?

GrapheneOS runs exclusively on Google Pixel devices. This may seem counterintuitive — installing an alternative system on a Google phone — but there’s a precise reason.

Pixels are the only Android smartphones that let you unlock the bootloader, install an alternative operating system, and then relock the bootloader with the new system. This technical detail is crucial: it means the smartphone can operate with all its hardware protections active even with GrapheneOS installed, on a par with a phone running the original system.

No other Android manufacturer offers this possibility. That’s why Pixels are the only compatible choice.

What you need before you start

Before you begin, make sure you have everything you need. The installation itself is straightforward, but finding yourself unprepared halfway through the process is frustrating.

The hardware

  • A Google Pixel (the 6 series onward is recommended, but it also works on supported earlier models). Check the up-to-date list of compatible devices on the official GrapheneOS website. Compatibility is updated periodically as new models are added or old models leave support.
  • The Pixel’s original cable (USB-C / USB-C). If you’re using a computer without a USB-C port, you’ll need a high-quality USB-C / USB-A cable — not the first one you find in a drawer. Poor cables cause installation errors that seem inexplicable. This is the single most common problem for people who struggle with the installation.
  • A second device for the installation: you can use another Android smartphone (running at least Android 12) or a computer. In this guide we’ll use a smartphone, which is the most accessible method. If you choose a computer, the process is identical but the extra Reconnect device button won’t appear.
  • A charged battery: both the Pixel and the second device should have at least 50% battery. A sudden interruption during the flash isn’t fatal — the system can be restored — but it’s an avoidable hassle.

The software

If you use a computer, keep in mind that the browser you use for the installation must be Chromium-based. Google Chrome, Brave (with Shields disabled), Microsoft Edge, and Chromium all work. Firefox does not work, nor do other Firefox-based browsers. Don’t use private/incognito mode and, on Linux, avoid snap or flatpak versions of the browser.

The computer needs at least 32 GB of free space and 2 GB of RAM, with an up-to-date operating system from among the supported ones: Windows 10/11, macOS Monterey or higher, the main Linux distributions (Debian, Ubuntu, Arch), or ChromeOS.

On Windows you may need to install the Google USB Drivers so the Pixel is recognized in Fastboot mode. You’ll find them on the official Android website. On macOS and Linux nothing extra is usually needed.

One important thing first

Installing GrapheneOS completely wipes all data on the Pixel. If you’re currently using the phone and have data to keep, make a backup before you start. There’s no way to recover the data after installation. If the Pixel is brand new out of the box, there’s no problem: you can proceed right away.

Step-by-step installation

Let’s begin. Keep the Pixel and the second device (or the computer) close to you, with both devices charged.

Step 1 — Initial Pixel setup

Turn on the Pixel for the first time (or after a factory reset). Android’s initial setup wizard will appear. The goal here is to reach the home screen as quickly as possible, without configuring anything. You just need a minute of the original operating system to unlock one setting.

In the setup wizard:

  • Select the language (you can choose English)
  • Skip the WiFi setup: don’t connect the phone to the internet
  • Skip the SIM: don’t insert the card
  • Skip the unlock method: no PIN, no fingerprint
  • Skip the Google account: no sign-in
  • Skip all additional apps and features

The goal is to reach the home screen with the app icons, no matter how bare it looks. Everything will be wiped shortly.

Step 2 — Unlocking the developer options

Now that you’re on the home screen, go to Settings → About phone → Build number.

Tap the Build number text repeatedly, seven times in a row. After the fifth or sixth tap, the system will start showing you a counter. After the seventh, a message will appear telling you that you’ve unlocked the developer options.

This is a hidden mechanism Google has built into every Android to enable advanced features. It does nothing harmful — it simply unlocks an additional menu in the settings.

Step 3 — Enabling OEM unlocking

Go back to the main settings and navigate to Settings → System → Developer options. Find the OEM unlocking entry and enable it.

If you haven’t set any screen lock, it activates immediately. If you have a PIN, it will ask you for it.

Note: if this entry appears greyed out and can’t be enabled, it means the phone isn’t connected to the internet. Connect it to WiFi, wait for any system updates, then perform a factory reset and repeat the procedure from the beginning. It’s a Google security step that requires the device to have made at least one connection.

The bootloader: what it is and why it matters

Before moving on to the next step, it’s worth understanding what the bootloader is. It’s the program that starts first when you turn on the smartphone, even before the operating system. You can think of it as a computer’s BIOS: that screen that appears for a second before the system loads.

On every smartphone on the market, the bootloader is locked from the factory: it doesn’t allow you to boot an operating system other than the original one. This is a security mechanism designed to prevent unauthorized installations.

Pixels are the only Android smartphones that allow you to unlock the bootloader, install an alternative system, and then relock the bootloader with the new system installed. This second lock is crucial: it means GrapheneOS runs with all hardware protections active, exactly as the original Android would. On no other Android smartphone is this possible so completely.

Keeping the bootloader unlocked during everyday use has concrete drawbacks:

  • Some banking apps refuse to work (they check the bootloader’s status for security reasons)
  • Verified Boot isn’t active: this feature checks the integrity of the operating system at every startup, preventing malware from surviving reboots
  • A bad actor with physical access to the device could install any software

That’s why the fourth and final step of the installation consists of relocking the bootloader. With GrapheneOS installed and the bootloader relocked, you have the best of both worlds: an alternative system and all hardware protections active.

Step 4 — Entering Fastboot mode

Turn off the Pixel. Before turning it back on, hold down the volume-down button and, without releasing it, press the power button. Keep holding volume down until the Fastboot mode screen appears.

In this mode the touchscreen doesn’t work. You move between entries using the volume-up and volume-down buttons, and confirm with the power button. The screen shows some information about the device and a Start entry at the top.

The Pixel is now ready for installation.

Step 5 — Installation via browser (the simplest method)

Take the second Android smartphone and open the Chrome browser (or Brave with Shields disabled). Navigate to:

https://grapheneos.org/install/web

This is the official GrapheneOS Web Installer. It’s a tool developed directly by the GrapheneOS team, and it automates the entire procedure that would otherwise have to be carried out manually from a terminal. No other alternative operating system offers anything comparable.

Beware of automatic translation: if you use the page’s translation feature, some entries are translated incorrectly. For example, “Unlock bootloader” becomes something garbled. It’s best to leave the page in English, or use it as a visual reference while keeping this warning in mind.

Connect the two smartphones with the USB-C / USB-C cable.

On the Web Installer page you’ll find four buttons to press in sequence. Press each one only after the previous one has completed its task.

Button 1 — Unlock bootloader

Press the button. A list of devices connected to your smartphone will appear: select the Google Pixel and tap Connect. Then confirm access to the device.

Now switch to the Pixel: use the volume buttons to move the cursor to the Unlock the bootloader entry and confirm by pressing the power button. The Pixel will restart automatically and return to the Fastboot screen.

You’ll need to reconnect it: the browser on the second smartphone will show you the device selection popup again. Connect once more.

Button 2 — Download release

Press the second button. The browser will download the GrapheneOS operating system. You’ll see a progress bar. It depends on your connection speed, but it usually takes a few minutes.

Button 3 — Flash release

This is the heart of the installation. Press the button and wait. The Web Installer will automatically flash the operating system onto the Pixel.

When you install using a smartphone (instead of a computer), an additional button appears during the process: Reconnect device. It must be pressed every time it appears, selecting the Pixel again in the popup. This happens several times during the flash, because the Pixel restarts at various stages.

Keep an eye on the text below the buttons: it tells you in real time what’s happening. The installation is complete when you read something like:

Flashed [device-name]-[date].zip to the device.

Button 4 — Lock bootloader

The final step. Press the button, then on the Pixel use the volume buttons to select Lock the bootloader and confirm. The Pixel will restart one last time.

When it boots, you’ll see a yellow warning signaling the presence of an alternative operating system. This is normal, it will appear at every startup, and it shouldn’t be removed. It doesn’t mean anything went wrong — it’s simply the visual signal that the bootloader is locked with GrapheneOS installed (and not Google’s original system).

Congratulations. GrapheneOS is installed.

Problems during installation?

It happens. Here are the most common causes:

  • A poor-quality cable: this is problem number one. Use the Pixel’s original cable or a certified one.
  • A USB port on the computer that isn’t working 100%: try another port, preferably USB-A 3.0 or USB-C directly.
  • Drivers not installed on Windows: Windows sometimes doesn’t recognize the Pixel in Fastboot mode. Download and install the Google USB Drivers from the official Android website.
  • An outdated browser: make sure you’re using the latest version of Chrome or Brave.
  • Carelessness in following the official guide: every step matters. If an operation isn’t confirmed on the Pixel, the process stalls.

If the problem persists despite everything, the official community (in English) at discuss.grapheneos.org and the unofficial Italian Telegram group (@GrapheneOSITA) are the best places to ask for help.

The first boot: what to do right away

The first time GrapheneOS boots, a simple, quick setup wizard will appear. No Privacy Policy to accept, no account to create, no endless list of features to enable.

You set up the WiFi network, the time, a couple of preferences, and you’re up and running.

The most important setting of the first boot

On the last screen of the setup wizard, you’ll find a checkbox for Disable OEM unlocking. Leave it enabled. It’s the same setting you unlocked at the start of the procedure — now it goes back in its place.

Keeping it enabled means that no one can unlock your phone’s bootloader without first entering the correct PIN. In practice, even if someone had physical access to your Pixel, they couldn’t install anything without knowing your code.

Every time the Pixel boots, a long alphanumeric code appears in the yellow warning. You can compare it with the one published on the official GrapheneOS website for your model. For the Pixel 8a, for example, the code is:

096b8bd6d44527a24ac1564b308839f67e78202185cbff9cfdcb10e63250bc5e

For a more thorough check, GrapheneOS includes the Auditor app pre-installed. Open the app on the Pixel and use it together with a second device (which can download Auditor from the Play Store) for a cryptographic verification of the system’s authenticity.

Overview: what GrapheneOS looks like right after installation

The first thing you notice when you open GrapheneOS for the first time is its almost aggressive minimalism. Black background, very few icons, no Google Play Store, no Google apps. It looks like a half-finished phone.

This isn’t a flaw — it’s a deliberate choice by the developers. GrapheneOS provides the bare minimum needed to make the smartphone work. Everything else is up to you: which apps to install, which account to use (if you want to use one at all), how to organize things.

This approach has a huge advantage: you have nothing to remove. On ordinary phones, you arrive with dozens of pre-installed apps you didn’t choose, running in the background, collecting data. Here you start from scratch.

The features that make GrapheneOS unique

GrapheneOS isn’t simply “Android without Google.” It’s an operating system that has added, modified, and hardened dozens of components compared to standard Android. Here are the most important ones for everyday use.

Network permission for every single app

On a normal Android, every installed app can connect to the internet without your knowledge. That’s how data collection works: the app gathers information about your usage and sends it to the company’s servers in the background.

On GrapheneOS you can revoke network permission from any app, even before you’ve configured it. You can use an app in fully offline mode, or configure it with the internet on and then cut it off. Control is total.

System-level permission for sensors, microphone, and camera

In the notification panel (the shade at the top) you can add quick toggles to disable the microphone, camera, and sensors at the system level. This means that even if an app already has permission to access the microphone, when you press that toggle nothing will hear it — the operating system itself blocks hardware access.

It’s a protection that goes beyond the normal app permissions.

Granular control of contacts and files

Have an app that wants to access your address book, and you can’t figure out why? On GrapheneOS you can show it an empty address book, or only the contacts you decide on. The same goes for files: you can grant access only to specific folders, not to your entire storage.

An always-random MAC address

Every time your phone connects to a WiFi network, it sends a unique identifier called a MAC address. Normally, this makes it possible to track the device over time across different networks.

GrapheneOS not only randomizes it for each network (something other systems now do too), but randomizes it with every connection, even to the same network. If you connect to your home WiFi every day, your Pixel presents a different identifier each time.

WiFi and Bluetooth turn themselves off

When you leave home and disconnect from your WiFi router, the WiFi module turns off automatically after a few minutes. The same goes for Bluetooth when you stop using it. This reduces the window of exposure to wireless attacks and saves battery.

Quick settings not accessible from the lock screen

On many Android phones you can enable airplane mode or turn off WiFi or Bluetooth even without unlocking the phone, simply by pulling down the notification shade. On GrapheneOS this isn’t possible: the quick settings are protected by the screen lock.

Automatic reboot when not in use

GrapheneOS can automatically reboot after a configurable period of inactivity. The reason is technical but important: the first time you unlock the phone after powering it on, your data is decrypted. On subsequent unlocks the data stays in plaintext in memory. An automatic reboot puts everything back into an encrypted state, making the device much harder to analyze in the event of unauthorized physical access.

Randomized number positions for the PIN

If you enable this option, the numeric keypad for entering the PIN changes its layout with every unlock. Anyone watching over your shoulder while you enter the code can’t figure out what you’re pressing based on your finger’s position.

A duress PIN

For extreme situations: you can configure a second PIN that, instead of unlocking the phone, reboots it and wipes all the data. To be used with extreme caution and only if you truly need it.

One of the most secure pre-installed browsers on Android

Vanadium is the browser included in GrapheneOS. At first glance it looks like Chrome (it has the same grey icon), but it has been modified to increase security: it isolates each website from the others, includes a built-in ad blocker, and reduces the amount of data sent to Google’s servers.

Photos and screenshots without sensitive metadata

Photos taken with the GrapheneOS camera app don’t contain EXIF metadata with your GPS location, phone model, or shooting settings. When you share a photo, you’re not inadvertently sharing information about where you were and which device you used.

A secure PDF viewer

PDFs can contain executable code or malicious links. The PDF viewer built into GrapheneOS opens them in an isolated environment, reducing the risk that an infected PDF could compromise the system.

Sandboxed Google apps: the most important feature

One of GrapheneOS’s most ingenious choices concerns Google’s apps — the so-called GAPPS (Google Apps). On a normal Android, GAPPS are installed at the system level: they have complete access to everything that happens on the phone, run in the background around the clock, and collect data constantly.

On GrapheneOS you can install GAPPS as normal apps, without system privileges. They work like any other app — they can only do what you’ve explicitly granted permission for.

How to install them

Open the App Store app (already present in GrapheneOS) and search for Google Play Services. Press Install. All the necessary components will be installed automatically: Google Play Services, Google Services Framework, and Google Play Store. It takes a few minutes.

Once the installation is complete, the Play Store icon will appear. You can sign in with your Google account and use it exactly as on a normal phone — with the difference that the Google apps no longer have privileged access to the system.

A few tips

After installing the GAPPS, disable battery optimization for Google Play Services. Push notifications for many apps go through Google Play Services, and if this is suspended in the background, notifications arrive late or don’t arrive at all.

To do this: Settings → Apps → See all apps → Google Play Services → Battery usage → Allow background usage.

Also, when you sign in with your Google account, syncing doesn’t start automatically as on a normal phone. You’ll have to manually enable permissions for syncing contacts, calendar, and photos. GrapheneOS will notify you when something needs a specific permission.

Don’t want to use your real Google account?

You can create a new Google account, not tied to your identity, to use exclusively for the Play Store. Creating one works well from a public or private WiFi network that isn’t associated with you. If you try from a VPN or over Tor, Google will ask for a phone number for verification.

Multi-user, private space, and work profile

One of the most powerful — and least known — features of GrapheneOS is its compartmentalization system. You can divide the phone into separate, independent sections, each with its own apps, its own data, and its own settings.

On standard Android this feature exists but is limited. On GrapheneOS it has been significantly enhanced.

Multi-user

Just like on a Windows computer, you can have multiple users on the same smartphone. Each user has their own apps, their own address book, their own files. If you’re in one user, the others are completely inaccessible — and this also applies to a thief or to someone who finds the phone turned on.

GrapheneOS takes multi-user to another level with some exclusive features:

  • You can receive a notification in the user you’re using when an app in another user has received a notification (without seeing its content)
  • You can end a user’s session with a single tap — like switching off a profile without switching off the phone
  • You can install apps in the administrator user and make them available to other users without having to install them multiple times
  • You can prevent a user from installing apps on their own
  • You can create up to 32 users (versus the 4 on a standard Android)

The private space

Introduced from Android 15 onward, the private space is an area separate from the main user that opens with a different PIN. Apps in the private space don’t appear on the home screen and can be “switched off” with a single gesture — they stop running in the background and consume no battery nor send any data until you turn them back on.

The work profile

Activated through third-party apps such as Shelter or Insular, it creates a second isolated space with its own icon (usually a folder) that groups the “work” apps together. You can turn it on and off quickly. It has a few more capabilities than the private space when it comes to sharing files between the two profiles.

How to configure GrapheneOS: practical examples

The flexibility of GrapheneOS can feel disorienting at first. Here are some concrete configuration examples, from the simplest to the most advanced.

Configuration 1 — An almost-normal smartphone (with GAPPS)

You want a phone that works like a classic Android but with more privacy and security under the hood. You don’t want to change your habits.

How to do it: install the GAPPS from the App Store, sign in with your Google account, and enable the syncing you need. Install the missing Google apps from the Play Store. Choose a launcher such as Nova Launcher or Lawnchair to recreate the familiar Pixel look. Set up automatic shut-off for WiFi and Bluetooth. Done.

You still have more security and less data collection than a normal Android, without changing anything about how you use the phone.

Configuration 2 — No GAPPS (the minimalist path)

You don’t have any apps that depend on Google Play Services. You want a smartphone that’s completely independent from Google.

How to do it: install apps from F-Droid (open source apps) and from the Aurora Store (for closed-source apps without a Google account). Sync contacts and calendar via CardDAV/CalDAV with a service like EteSync or Nextcloud. Use your favorite cloud for files and photos.

Configuration 3 — GAPPS only in the private space (recommended for general use)

You want to have the Google apps available when you need them, but you don’t want them running in the background all day. This is probably the most balanced configuration for most people.

How to do it: in the main profile install only apps that don’t require the GAPPS. In the private space install the GAPPS and all the apps that depend on them (including social media, games, Meta’s apps, and so on). When you’re done using them, close the private space with a gesture: all those apps cease to exist until you reopen it. Battery savings guaranteed, and your “Google life” is kept separate from the rest.

Configuration 4 — Two separate users

You want complete isolation between the Google apps and everything else. You create two users: one without GAPPS for everyday use, one with GAPPS for when you need it. You switch users from the notification panel in a few seconds.

The added advantage: with multi-user active, if the phone is stolen while it’s on, the thief only sees the user active at that moment. The others stay protected by separate PINs.

Configuration 5 — Advanced multi-user

You create an “administrator” user that you use only to install and update apps, with no personal data inside it. You create one or more “operational” users for everyday use, to whom you distribute apps from the administrator user without letting them install new ones on their own. You further separate your financial apps into a dedicated user, accessible only when you need it.

This approach enormously reduces the attack surface for malware: the user you use every day has no access to system tools, has no App Store, and can’t do systemic damage even if an app behaves abnormally.

Where do I install apps from?

On Android you have far more freedom than on iOS when it comes to obtaining apps. You can use several sources at once, depending on the app you’re looking for.

Google Play Store

If you’ve installed the GAPPS and signed in with a Google account, you have access to the full catalog. It’s the simplest choice and the one with the greatest compatibility. The downside is privacy: Google knows which apps you’ve installed and when you use them.

Aurora Store

An alternative client for the Play Store that lets you download apps without a Google account. It’s used in anonymous mode. Some apps downloaded from the Aurora Store might not work correctly — in that case, downloading them directly from the Play Store (even with a dummy account) usually fixes the problem.

F-Droid

An alternative App Store that contains only open source apps. Ideal for those who want to reduce their dependence on proprietary software. The selection is more limited, but the average quality of the apps it offers is high.

Obtainium

An app that lets you install and update apps directly from developers’ repositories (GitHub, GitLab, etc.). Ideal for open source apps not available on F-Droid, or for those who want more control over versions.

Migrating data from your old smartphone

Migrating to GrapheneOS isn’t as instant as moving from one iPhone to another. It takes a bit of manual work, especially if you want to reduce your dependence on Google.

With a Google account (the simplest path)

If you install the GAPPS and sign in with your old @gmail account, most of your data comes back automatically: apps from the Play Store, contacts, calendar, email, photos. Individual app settings and data saved locally aren’t restored automatically, but the bulk of it is there.

Without a Google account (the more laborious path)

Go through every app on your old smartphone and look for the backup or export function in the settings. Most apps create a configuration file that you can save locally.

For contacts: the Contacts app on your old phone lets you export them in .vcf format. For Google Calendar: go to calendar.google.com from a computer and export from there. For the passwords saved on Google: you’ll find them in Settings → Google, and you can export them in .csv format to import them into the password manager of your choice.

Once you’ve gathered all the files, connect the two smartphones with the USB-C / USB-C cable. The Pixel will recognize the old phone as external storage in the Files app. Copy over everything you need.

Backup on GrapheneOS

Yes, backup is GrapheneOS’s sore point. There’s no all-in-one solution like iCloud backup or Google One backup. But there is something.

SeedVault — the built-in backup (with reservations)

GrapheneOS includes SeedVault, an open source backup system. The GrapheneOS developers themselves admit that the integration isn’t ideal: it doesn’t always manage to save the data of every app. But it’s better than nothing.

How to set it up:

  1. Create a folder called Backup in the Files app
  2. Install the AppList app and use it to generate a list of all installed apps, then save the file in the Backup folder
  3. Connect a USB stick (formatted as exFAT, at least 128 GB)
  4. Go to Settings → System → Backup
  5. Write down the 12 recovery words you’re given and keep them somewhere safe. Without them the backup is unusable
  6. Select the USB stick as the destination
  7. Enable the options: Back up my apps, Automatic restore, App backup, Back up my files
  8. Add the Backup folder and any other folders you want to save
  9. Start the backup from the three dots in the top right

If it fails on the first try, try again. It happens. It’s one of the system’s known limitations.

Important note: the backup must be run for each user separately. If you have three users, you have to repeat the procedure three times.

For contacts, calendar, and files

For these categories, the most robust solution is to rely on an external synchronization service via open protocols (CardDAV for contacts, CalDAV for calendar). Services like EteSync, Nextcloud, or Proton (which support these protocols) work great with GrapheneOS and don’t depend on Google.

For files and photos, any cloud that supports an Android client works: Nextcloud, Proton Drive, Tresorit, or even a USB stick for those who prefer not to use the cloud.

GrapheneOS comes with very few pre-installed apps. Here’s a considered selection to cover the most common needs, without needlessly bloating the phone.

Aves — Photo gallery. The gallery app pre-installed in GrapheneOS is dated. Aves is modern, fast, and privacy-respecting.

K-9 Mail — Email client. It manages multiple mailboxes in a single app and supports PGP encryption for those who want to go further.

AntennaPod — Podcasts. Open source, no account, no algorithms. Looking for a podcast about digital sovereignty? Start there.

NewPipe — YouTube without ads and without an account. You can also disable recommended content and comments, for a more controlled experience that’s less dependent on the algorithm. The downside: you can’t like or comment.

VLC — Media player. It plays any video and audio format. Stable, reliable, no data collection.

URLCheck — Before opening a suspicious link, this app shows you the structure of the URL, identifies tracking parameters, and lets you decide whether to proceed.

Read You — RSS feed reader. If you want to build a news stream without relying on algorithms that decide for you what to read, this is the answer.

Fossify Voice Recorder — A simple, open source voice recorder that automatically starts recording when you open the app.

OpenKeychain — PGP key management directly on the smartphone. It integrates with K-9 Mail.

The golden rule: the fewer apps you install, the safer you are. Every app is a potential door. Only install the ones you truly need.

When an app doesn’t work

GrapheneOS applies stricter security protections than standard Android. Some apps, especially banking ones, don’t always appreciate them.

Here’s the debugging procedure, in order:

1. Check the permissions. Some apps won’t launch unless they have the Sensors permission enabled, even if they apparently wouldn’t need it.

2. Try installing it from the Play Store instead of the Aurora Store. Some apps have internal checks that make them refuse to work if they don’t come from the official channel.

3. Install the GAPPS (if you don’t have them already). Many apps depend on Google’s services to work. Sometimes just installing the Google Services Framework is enough, without the entire package.

4. Use exploit protection compatibility mode. Go to the app’s info (long-press the icon → App info) and enable the Exploit protection compatibility mode entry. If the app works, you can then try disabling the individual protections one by one to figure out which one is causing the conflict — or just leave compatibility mode on and stop worrying about it.

5. Accept the limitation. Some apps simply don’t work on alternative operating systems, because they use Google’s Play Integrity API to verify that the device is “certified.” This isn’t a GrapheneOS problem — it’s a choice by that app’s developers. The community has collected specific solutions for many banking apps: it’s worth searching for your bank’s name together with “GrapheneOS.”

How to get professional-quality photos

The camera app pre-installed with GrapheneOS (Secure Camera) takes good photos but doesn’t make the most of the Pixels’ hardware capabilities. For that, you can install Google’s official Pixel Camera.

GrapheneOS explicitly supports it: the developers have arranged for it to be used securely and allow it to access the hardware needed to process images. You can even revoke its network permission — it will work all the same.

The one shortcoming: Pixel Camera expects Google Photos to be installed in order to show a preview of the last photo taken. If you don’t want to install Google Photos, there’s a small app called Gcam Photos Preview that solves this specific problem.

Updates: don’t ignore them

GrapheneOS is updated very frequently — often several times a month. This isn’t a nuisance: it’s one of its main strengths. Every update fixes security holes that, on a less up-to-date system, would remain open.

The process is automatic and unobtrusive: the system downloads the update in the background and notifies you when it’s ready to install. All you have to do is tap the notification and the phone restarts, applying the update.

If an update should run into problems, GrapheneOS automatically restores the previous version. It’s a fail-safe system.

The same goes for apps: periodically check that they update, both the ones from the Play Store and the ones from F-Droid or Obtainium.

A quieter, less dependent phone

Once you’ve installed everything and configured GrapheneOS the way you want, you have a rare opportunity: the phone is a blank canvas. You can redesign your relationship with technology from scratch.

GrapheneOS is minimal by nature. No unsolicited notifications, no apps vying for your attention, no content selected by algorithms. If you decide to keep it that way, you’ll have a much quieter tool than any commercial smartphone.

A few practical tips for maintaining the minimalism:

Wallpaper and colors: go to Settings → Wallpaper & style, leave the wallpaper black, and choose the monochrome color scheme (white, grey, black). Fewer colors = fewer stimuli.

Lock screen: go to Settings → Display → Lock screen and disable Always show time and info, Lift to wake, and Wake screen for notifications. The goal is for the phone not to turn on the screen by itself to seek your attention.

Notifications: go to Settings → Sound & vibration and set the default notification sound to None. Then, for each installed app, manually configure the notifications you actually need — and only those.

Alternative launcher: consider the Kvaesitso app as a launcher, configured to show only useful information. The Whicons icon pack rounds out the monochrome aesthetic.

The end result is a smartphone that’s boring in appearance and rich in function. And that’s exactly what you should want.

Frequently asked questions

Does GrapheneOS work with banking apps?

It depends on the app. Most work, especially with the bootloader locked and the GAPPS installed. Some may require enabling exploit protection compatibility mode. A few may not work at all. The community keeps an up-to-date compatibility list for the main Italian and European banking apps.

Can I use Android Auto?

Yes. Install Android Auto from the GrapheneOS App Store. The recommended configuration is to have the GAPPS in the private space and use Android Auto from there: the private space is reachable from the main user, so you don’t have to switch users to use it in the car.

Can I use Google Pay?

Google Pay requires device certification via the Play Integrity API. On GrapheneOS this certification isn’t available by default, so Google Pay doesn’t work. It’s one of the known trade-offs.

How does geolocation work?

It works normally. GrapheneOS adds a location-access notification even when “low-precision” location (WiFi, Bluetooth, cell towers) is used, not just GPS. This gives you visibility over all location requests, not only the GPS ones.

Can I use Google’s Find My Device?

Yes, with some additional configuration. Install the official Find My Device app from the Play Store, give it the necessary permissions and the device administration permission. Grant Google Play Services the Allow all the time location permission. It will work, though for precise location you may need to remove the GrapheneOS proxy in the settings.

Does GrapheneOS support Wear OS or Android smartwatches?

No. Wear OS devices are not supported.

Useful resources

If you want to go deeper than this guide, here are the most useful references:

  • Official GrapheneOS website: grapheneos.org — the primary source for everything
  • Official browser installation guide: grapheneos.org/install/web
  • Official terminal installation guide: grapheneos.org/install/cli (for those who prefer the manual method)
  • Official forum: discuss.grapheneos.org
  • Italian community on Telegram: t.me/GrapheneOSITA
  • LeAlternative blog 🇮🇹: lealternative.net/2023/04/12/grapheneos/
  • Gianmarco’s macOS installation video guide 🇮🇹: gianmarco.gg/videos/grapheneosita/
  • Technical deep dive 🇮🇹: turtlecute.org/graphene/

GrapheneOS and the philosophy of privacy: understanding in order to use it better

Installing GrapheneOS is a technical act. But behind it lies a deeper question that’s worth understanding, at least in its essentials, because it shapes how you’ll configure the system and the choices you’ll make every day.

The problem with modern smartphones

Over the course of roughly fifteen years, the smartphone has become the most personal device that exists. It contains your address book, your correspondence, your photos, your real-time location, your searches, your purchases, your calendar. It’s an exact portrait of who you are, what you do, where you go, and who you talk to.

This has enormous economic value for the companies that build the operating systems that run it. Android is developed by Google, a company whose business model is based on collecting and selling data for targeted advertising. iOS is developed by Apple, which takes a different but not neutral approach.

It’s not a conspiracy: it’s simply how the smartphone market works. The device is often sold below cost or at an affordable price because the real product isn’t the phone — it’s you, your data, your attention.

GrapheneOS starts from a different premise: the phone belongs to whoever uses it, and whoever uses it decides what to do with their own data.

The difference between security and privacy

These two concepts are often confused, but they’re distinct.

Security concerns those who shouldn’t have access to your data: criminals, hackers, people with physical access to the device, malware. A secure system makes unauthorized access difficult.

Privacy concerns those who could have legitimate access but shouldn’t: apps that collect more data than necessary, companies that build behavioral profiles, mass surveillance systems.

An iPhone with recent updates is fairly secure. But Apple collects usage data, and many apps on the App Store do the same. The security is there; the privacy depends heavily on how you use the device and which apps you install.

GrapheneOS addresses both dimensions: it strengthens security with advanced technical measures and reduces data collection by removing the components that enable it.

The threat model: it’s not paranoia, it’s awareness

One of the key concepts in information security is the threat model. In practice: what do you want to protect yourself from? What is it worth putting certain measures in place against?

An ordinary person doesn’t need the same protections as a journalist working in a country with a repressive government. But that doesn’t mean it isn’t worth protecting yourself at all.

Some useful questions for defining your threat model:

  • Are you mainly worried about commercial tracking (apps that collect data for advertising)?
  • Are you concerned about the possibility that someone with physical access to your phone could extract its data?
  • Do you simply want a more up-to-date system that’s less exposed to known vulnerabilities?
  • Do you have particular needs tied to your work or your personal situation?

Depending on your answers, the GrapheneOS configuration that makes sense for you will change. Someone who just wants a more secure and up-to-date system can use it almost like a normal Android. Someone who wants maximum privacy will need more elaborate configurations.

The beauty of GrapheneOS is that it supports both extremes, and everything in between.

Advanced security: the technical protections of GrapheneOS

Beyond the features already described, GrapheneOS implements a series of technical improvements at the heart of the operating system that make it more resistant to attacks even without the user having to configure anything. These operate “under the hood,” but it’s useful to know about them in order to understand why GrapheneOS is considered the most secure system available for smartphones.

Hardening the execution environment

GrapheneOS has changed the way apps are executed, adding protections against a broad class of vulnerabilities. In practice, it makes it harder for malware to exploit flaws in an app’s code to gain additional privileges or access other parts of the system.

This translates into a practical effect you’ll notice: some apps — especially older ones or poorly developed ones — might not work on GrapheneOS, or might only work after disabling some protections. This isn’t a flaw. It’s a sign that those apps relied on behaviors that aren’t permitted on a secure system.

Strengthened app isolation

On standard Android, apps are already fairly isolated from one another. On GrapheneOS this isolation is further strengthened. It becomes more difficult for an app to collect unique device identifiers (such as the IMEI or serial number) or to communicate with other apps in an unauthorized way.

This has a direct impact on privacy: many advertising tracking systems rely precisely on these identifiers to build persistent user profiles. By making them less accessible, GrapheneOS makes these practices less effective.

A system proxy for internal network connections

Android, even without the Google apps installed, periodically contacts Google’s servers for system operations: checking the internet connection, syncing the time, obtaining approximate location data. These connections are harmless in themselves, but they let Google know that the device is online.

GrapheneOS steps in as a proxy: the system connections pass through GrapheneOS’s servers, which forward them to Google’s servers. In this way Google receives the responses to its requests, but can’t associate them with your specific device — it only sees the aggregated requests of all GrapheneOS devices, mixed together.

Advanced memory management

GrapheneOS uses memory-management techniques that make it harder to exploit “buffer overflow” vulnerabilities and the like. These are among the most common classes of vulnerabilities exploited by sophisticated malware. Making them harder to exploit significantly raises the level of protection against sophisticated attacks.

Everyday life with GrapheneOS: what really changes

After a few weeks of use, GrapheneOS no longer feels strange. The differences from a normal Android boil down to a few categories.

What works exactly as before

  • Phone calls and text messages
  • WhatsApp, Telegram, Signal, and most messaging apps
  • Navigation apps like Google Maps (installed from the Play Store) or OsmAnd (open source)
  • Spotify, Netflix, YouTube
  • Most productivity apps
  • Email with any client app
  • The browser (Vanadium or Chrome)
  • Photography (with the Pixel Camera app)

What requires a little extra configuration

  • Banking apps: most work, some require enabling exploit protection compatibility mode. A few also require the GAPPS to be installed.
  • Push notifications: they work, but they require Google Play Services to have permission to run in the background.
  • Android Auto: it works, but it has to be installed separately.
  • Accessibility features: they require downloading the STT and TTS engines from the Play Store.

What doesn’t work (or works poorly)

  • Google Pay and NFC payments via Google services: they don’t work, because they require Play Integrity certification.
  • Some gaming apps that use aggressive anti-cheat systems: they might not launch.
  • Wear OS: wearable devices running Wear OS are not supported.
  • Some AI features tied specifically to Pixel hardware: they might work partially or not at all, depending on the model.

In everyday practice, the difference from a normal Android is much smaller than you might imagine. Most people who switch to GrapheneOS find that almost everything works, and the few things that don’t are often replaceable with alternatives.

Buying a Pixel: which model to choose?

If you’re buying a Pixel specifically for GrapheneOS, here are some practical considerations.

The support factor

GrapheneOS supports only the models for which Google still provides hardware security updates. When Google stops updating a model, GrapheneOS removes it from the supported list. Support typically extends for 5–7 years from the device’s launch.

The currently newest models (Pixel 8, 8a, 8 Pro, 9, 9 Pro, and variants) have the longest support ahead of them. The Pixel 8a in particular represents an excellent compromise between price and performance.

International version vs. carrier version

Always buy the unlocked version of the Pixel, not one tied to a phone carrier. Some carrier-locked versions have a permanently locked bootloader, and it’s not possible to install GrapheneOS on them.

Where to buy

The Google Store, Amazon, and the main electronics retailers sell unlocked versions. Always check that the packaging specifies “unlocked.” There are also specialized online stores that sell Google Pixels with GrapheneOS already pre-installed and configured, for those who prefer not to do the installation themselves.

Privacy considerations in everyday use

Installing GrapheneOS is just the first step. The system gives you powerful tools, but the way you use them matters as much as the system settings.

The apps you install

GrapheneOS can’t protect you from an app you’ve chosen to install and given all the permissions to. If you install TikTok and give it access to the microphone, the camera, and your contacts, TikTok will use them — on GrapheneOS as on any other system.

The difference is that on GrapheneOS you can decide which permissions to grant and which not to, with far greater granularity than on standard Android. You can install TikTok in the private space, without network permission, and use it only offline to watch already-downloaded videos. You can give it access to only a few specific photos instead of your entire gallery.

Control is yours. But it requires awareness.

The network you use

A VPN can add a further layer of privacy by hiding your IP address from the site or app you’re using. It’s not a magic solution — the VPN provider sees your traffic — but it shifts the trust from many different parties to just one.

GrapheneOS lets you configure different VPNs for different users, or for different apps within the same user. You can have your banking apps connect directly (without a VPN, because the bank already knows your identity and a foreign IP might block access), while the other apps go through a VPN.

Communication metadata

Even when using Signal or encrypted messaging apps, some information remains visible: who you talk to, when, how often. This metadata is often more revealing than the content of the messages themselves.

GrapheneOS doesn’t solve the metadata problem — no system does so completely. But it gives you the tools to be aware of what you share and with whom.

When something goes wrong: troubleshooting common problems

With everyday use of GrapheneOS, sooner or later you’ll run into a problem. Here are the most common ones and how to tackle them.

The phone won’t connect to the mobile network

Check that the SIM is inserted correctly and that your carrier’s APN profile is configured. Go to Settings → Network & internet → SIMs → [your carrier’s name] → Access Point Names. If the list is empty, search online for “APN [carrier name] Android” and enter the data manually.

An app shows notifications late

It’s almost always a battery-saving issue. Go to the app’s info and disable battery optimizations for that specific app. If the GAPPS are installed, check that Google Play Services has permission to run in the background as described earlier.

The screen goes black during calls

That’s the proximity sensor working correctly (it turns off the screen when the phone is near your face). If the problem persists even away from your face, go to Settings → Accessibility and look for the options related to the proximity sensor during calls.

An update seems stuck

GrapheneOS updates are downloaded in the background. If an update notification sits there for a long time, check your WiFi connection and make sure you have enough free storage space. You can also check manually by going to Settings → System → System update.

The camera app isn’t saving photos

Check that the app has write permission for storage. If you’re using Pixel Camera instead of Secure Camera, check that it has access to the necessary folders. Restart the app after changing the permissions.

Maintaining GrapheneOS over time

Installing GrapheneOS is an event. Maintaining it well is a habit. Here’s what to do in the months after installation to keep benefiting from its qualities.

System updates: don’t put them off

Every time the “update available” notification appears, install it. Don’t wait days or weeks. GrapheneOS updates almost always contain security patches that fix known vulnerabilities. An up-to-date system is a significantly harder system to compromise.

The process is simple: a notification appears, you tap it, the system downloads and prepares the update (usually within a few minutes), then asks you to restart. The restart itself takes about a minute. That’s it.

Review app permissions periodically

Over time you accumulate a few extra apps, a few permissions you’d granted “temporarily” and forgotten. Every two or three months, go to Settings → Privacy → Permission manager and scroll through the various categories. For each app on the list, ask yourself: does it really need this permission? Does the way I use this app justify the access I’ve given it?

Often you’ll discover you’ve granted permissions that are no longer needed, or that you didn’t realize you’d granted.

Regular backups

Don’t wait until you lose your phone to realize that the last backup dates back months. Establish a cadence — once a month is reasonable for most people — and run SeedVault with the USB stick connected. Then verify that the backup succeeded by checking the notifications.

If you have particularly important data (photos, documents, conversations), consider a second copy on a cloud of your choice in addition to the local backup on the USB stick.

Stay informed

The GrapheneOS community is active and up to date. The official forum at discuss.grapheneos.org regularly publishes notes on new releases, known issues, and solutions. The Italian Telegram group (@GrapheneOSITA) is a good place to ask for help with specific problems.

You don’t need to read everything every day. But occasionally glancing at the release notes for the latest versions helps you understand what’s changed and whether there are new features you might want to enable.

When it makes sense to reinstall

GrapheneOS doesn’t require periodic reinstalls like some desktop systems. But there are situations where it makes sense to start over from scratch:

  • You’ve accumulated a lot of users and configurations you no longer use, and the system feels slow or cluttered
  • You’ve installed something you don’t trust and want to be sure you’ve removed everything
  • You’re selling or giving away the Pixel and want to leave it clean
  • You want to start over with a different configuration from the one you have

In all these cases, you can simply perform a factory reset from Settings → System → Reset options → Erase all data. GrapheneOS stays installed, but all the content is wiped. You start again from the initial setup wizard.

Terminal installation: for those who want total control

This guide has dealt mainly with the Web Installer installation method, which is the simplest and most accessible. But there’s also an alternative method: installation via the command line (terminal).

Why choose it? Two main reasons.

The first is trust: the Web Installer loads the operating system files from GrapheneOS’s servers. If for any reason you prefer not to depend on those servers during installation, you can download the files yourself, verify their authenticity via cryptographic signatures, and proceed manually.

The second is transparency: the terminal method shows exactly every command that’s run. There’s no “magic” behind the buttons — you see everything that happens.

The procedure is described in detail on the official website: grapheneos.org/install/cli. It requires some familiarity with the terminal (the Command Prompt on Windows, the Terminal on macOS and Linux) and with installing tools like adb and fastboot. It’s not complicated, but it requires attention and the willingness to follow every step precisely.

For beginners, the Web Installer is the better choice. For those who want to dig deeper, the terminal method is an excellent next step.

GrapheneOS isn’t only about privacy: it’s also liberation from excess

There’s an aspect of GrapheneOS that’s often overlooked in technical guides: its impact on the everyday relationship with the smartphone.

Modern smartphones are designed to capture and hold our attention. Every notification, every colorful banner, every vibration is meant to bring us back to the screen. Social media apps, games, even messaging apps — they all compete for the time we devote to the phone.

GrapheneOS is born with none of this. There are no unsolicited system notifications, there’s no voice assistant always listening and suggesting things, there are no animated widgets constantly changing. What you see on the screen is what you put there.

This initial silence can feel disorienting. We’re so used to the hyperactivity of commercial smartphones that a “boring” smartphone almost seems broken.

But over time, many people who use GrapheneOS report something interesting: the phone stops being the center of the day. You use it when you need to, you put it away when you don’t. It doesn’t call for your attention on its own.

It’s an unintended side effect of a system designed for security and privacy. But perhaps it’s one of the most concrete benefits you can expect from the installation.

In conclusion

GrapheneOS isn’t the right choice for someone who wants a plug-and-play phone without having to understand how it works. But it is the right choice for someone who wants to regain control of a device that, over the years, has become the most invasive piece of technology we carry with us every day.

You don’t need to become an information security expert. All you need is the willingness to devote a few hours to the initial configuration and the curiosity to explore the possibilities this system offers.

You can use it almost like a normal Android, with all the Google apps working. You can use it without any Google apps at all. You can divide it into separate users to separate work and personal life, trustworthy apps and less-trustworthy apps, different digital identities.

And as you use it, you’ll understand that the right question isn’t “what am I missing compared to my old phone?” but “what do I actually need?” Often the answer is: much less than you thought.

GrapheneOS gives you back something that modern smartphones tend to take away without your noticing: the sense that the device works for you, and not the other way around.

One step at a time

If you’ve made it this far without having installed GrapheneOS yet, don’t feel obligated to do everything at once. The best approach for many people is:

  1. Phase 1: Install GrapheneOS and set up the GAPPS with your Google account. Use the phone like a normal Android for a few weeks. Get used to the interface, explore the settings.

  2. Phase 2: Start exploring the security and privacy settings that interest you. Enable automatic shut-off for WiFi and Bluetooth. Check the app permissions. Add the quick toggles for microphone and camera.

  3. Phase 3: Consider whether you want to separate some apps into a private space or a second user. Explore open source alternatives for some apps you use often.

  4. Phase 4: Decide how far you want to push de-Googling, and proceed at your own pace.

There’s no fixed finish line. Everyone finds their own balance between convenience and control. What matters is that it’s a conscious choice.

The choice is yours — and that’s exactly what this is all about.

Contributing to the project

GrapheneOS is an open source project built entirely by volunteers and independent developers. It isn’t funded by any large company, it has no investors, it has no advertising. It survives thanks to community donations and the work of those who contribute with code, documentation, and support for other users.

If this system has been useful to you, consider:

  • Donating directly: grapheneos.org/donate
  • Taking part in the community: discuss.grapheneos.org, @GrapheneOSITA on Telegram
  • Helping other users: answer questions in the groups, share your experience
  • Reporting problems: if you find a bug or something that doesn’t work, report it on the official forum

Every contribution, large or small, helps keep this project alive and improve it for everyone.

Essential glossary

If some of the technical terms used in this guide left you with any doubts, here’s a quick reference.

AOSP — Android Open Source Project. The “base” version of Android, without Google’s apps and services. GrapheneOS is built on top of AOSP.

APK — The format of Android app installation files. Like an .exe file on Windows.

App Store (of GrapheneOS) — This isn’t Apple’s Play Store. It’s the app pre-installed on GrapheneOS that contains the system apps developed by the GrapheneOS team, including Vanadium, the PDF reader, and Google Play Services (to be installed optionally).

Aurora Store — An alternative client for the Google Play Store that lets you download apps without a Google account, in anonymous mode.

Bootloader — The program that starts before the operating system. Determining which operating system to load is its main job. On Pixels it can be unlocked and then relocked.

CardDAV / CalDAV — Open protocols for syncing the address book and calendar. They let you sync this data with any compatible service without depending on Google.

Cold storage / Cold wallet — In this context: keeping data (or cryptographic keys) on a device not connected to the internet.

exFAT — A file system format suitable for large USB sticks. Use it when you format the USB stick for a GrapheneOS backup.

EXIF — Metadata embedded in image files. It can contain the GPS location, the device model, the date and time of the shot, and much more.

F-Droid — An alternative App Store that contains only free open source apps.

Fastboot — A special boot mode on Android devices that allows communication with the device through a computer for low-level operations, such as installing an operating system.

Flash — In the context of installing operating systems on smartphones, “to flash” means writing the operating system to the device’s memory.

GAPPS — Google Apps. The package that includes Google Play Store, Google Play Services, and Google Services Framework. These three components work together to provide Google functionality on Android smartphones.

GSF — Google Services Framework. The “lightest” component of the GAPPS, often sufficient to make some apps work that normally require the entire Google package.

Hot wallet / Hot storage — A device or app connected to the internet. In this context it refers to mobile app wallets that are always online.

KYC — Know Your Customer. The identity verification process required by many financial platforms and exchanges. It involves providing your name, an identity document, and often a selfie.

MAC address — A unique identifier assigned to the network card of every device. GrapheneOS randomizes it with every WiFi connection to prevent tracking.

Multisig — Multi-signature. A configuration that requires multiple signatures (from different devices) to authorize an operation. Used for maximum security.

Obtainium — An app that lets you install and update applications directly from developers’ GitHub repositories.

OEM Unlock — OEM unlocking. The setting that allows unlocking the bootloader of an Android device. It must be enabled before proceeding with the installation of GrapheneOS.

Open source — Software whose source code is publicly available and can be examined, modified, and distributed by anyone. GrapheneOS is completely open source.

Play Integrity API — A Google system that lets apps check whether the device is “certified” (that is, running an operating system approved by Google). Some apps use it to refuse to work on alternative systems.

Proxy — An intermediary between a client and a server. GrapheneOS uses a proxy for system connections to Google, making the device unrecognizable.

Sandbox / Sandboxed — An isolated environment in which a program runs, preventing it from accessing resources outside that environment. The GAPPS on GrapheneOS run in sandboxed mode.

SeedVault — The backup system built into GrapheneOS. Open source but with known limitations regarding its ability to save the data of every app.

Shelter / Insular — Third-party apps for enabling the work profile on Android, including GrapheneOS.

STT / TTS — Speech-to-Text and Text-to-Speech. The engines that enable functions like voice recognition and reading aloud.

Vanadium — The browser pre-installed in GrapheneOS. Based on Chromium, but with additional security improvements and a built-in ad blocker.

Verified Boot — A security feature that checks the integrity of the operating system at every startup. Active only when the bootloader is locked.

Web Installer — The method for installing GrapheneOS via browser. Available at grapheneos.org/install/web. It automates the procedure that would otherwise have to be carried out manually from a terminal.