How to Install GrapheneOS — Complete End-to-End Guide (2026)

GrapheneOS is a hardened version of Android that runs only on Google Pixel phones. It strips out Google's privileged system services, hardens the kernel and app sandbox, adds privacy controls stock Android doesn't have, and keeps a verified boot chain that detects OS tampering — all while still running your normal apps. Installing it takes about 15 minutes with a browser-based installer: no root, no command line, no TWRP.

This guide takes you from "which Pixel do I buy" to a fully locked-down device. Two things cause almost every failed install, so they come first.

Key takeaways:

• GrapheneOS runs only on Pixels — they're the only phones with the security chip, custom-key verified boot, and unlocking support a trustworthy install needs.
• Buy the Pixel unlocked, straight from Google. Carrier Pixels can have bootloader unlocking permanently disabled, and there's no fix.
• Use the cable that came in the box, in a rear/direct USB port. Bad cables and hubs are the single most common cause of a failed flash.
• The web installer does the work — enable OEM unlocking, flash, re-lock. ~15 minutes.
• Re-locking the bootloader is mandatory, not optional — it's what turns verified boot back on.

Before you start: the two things that cause most failures

Nearly every "it didn't work" story comes down to one of these two. Sort them before you touch anything.

1. Don't use a carrier-locked Pixel. Pixels sold by carriers (especially US carriers like Verizon, AT&T, T-Mobile) can ship with OEM unlocking permanently disabled at the partition level. The phone can look and be advertised as "unlocked," show no warning, and only reveal the problem when the OEM unlocking toggle is greyed out with no way to enable it. There is no software fix — the carrier has to release it, and many won't. Buy the Pixel unlocked, directly from the Google Store.

2. Use a good USB cable, in a good port. GrapheneOS itself says broken cables and hubs are the most common source of install problems. Use the USB-C cable that came in the Pixel's box. Plug it into a rear port on a desktop or a port directly on a laptop — never a front-panel case port, hub, dock, or adapter. If the installer can't see the device, the cable is the first thing to swap, not the last.

Get those two right and the rest is mechanical.

Pre-flight checklist

Everything you need before you begin. If any box is unchecked, stop and fix it first.

Hardware

• A supported Pixel — Pixel 6 or newer (see the table below). Not sure? Check your model.
• Bought unlocked from Google, not a carrier.
• The in-box USB-C cable (or a known-good one).
• Pixel charged to at least 50%.

Computer

• Windows 10/11, macOS Sonoma+, or a supported Linux distro (Arch, Debian, Ubuntu, Linux Mint).
• A Chromium-based browser with WebUSB: Chrome, Edge, or Brave. Not Firefox or Safari (no WebUSB). On Ubuntu, not the Snap or Flatpak Chromium — install Chrome from Google's .deb.
• At least 32 GB free disk space and 2 GB free RAM.
• Rear/direct USB port available (no hub).

Device prep (on the Pixel, still on stock Android)

• Everything backed up — the install wipes the phone completely.
• Connected to Wi-Fi or mobile data (needed for the carrier-lock check when enabling OEM unlocking).
• Pixel 6a only: updated to June 2022 firmware or later, then factory reset (older firmware blocks OEM unlocking).

Time needed: about 15 minutes of active work once the checklist is green. Most of it is the flash running on its own.

Supported Devices

GrapheneOS tracks Google's firmware support timeline. When Google stops shipping firmware updates for a device, GrapheneOS can't fully patch it past that point — so device support is tied to Google's end-of-life (EOL) dates. A Pixel 8 or newer is the best buy: those carry a seven-year Google support commitment, so seven years of full GrapheneOS patching.

Currently supported as of February 2026:

Pixel 6 and 6 Pro hit EOL in October 2026 — still fully updated today, but not worth buying new now. Dropped (no longer updated): Pixel 5a and everything older.

Not sure if your Pixel qualifies? Check support status, patch timeline, and whether it's worth buying with the GrapheneOS Pixel compatibility checker.

Why Pixels only?

Worth understanding before you buy, because it's the question everyone asks. GrapheneOS runs exclusively on Pixels not out of preference but because Pixels are currently the only Android phones that combine all three requirements for a trustworthy install: a dedicated security chip (Titan M2), a bootloader that lets you re-lock it with a third-party OS's verified-boot keys, and documented, supported unlocking. Most other manufacturers either don't allow bootloader re-locking with custom keys, or ship weaker hardware-backed key storage. Without those, you can flash an OS but you can't restore verified boot — which is the whole security model.

How the install works (the 30-second mental model)

Before the steps, the shape of what you're about to do, so nothing during the process is a surprise:

• Unlock the bootloader → this wipes the phone and lets it accept a non-Google OS.
• Flash GrapheneOS → the installer writes the verified factory image to the phone.
• Re-lock the bootloader → this turns verified boot back on, now trusting GrapheneOS's keys.

The unlock-flash-relock sequence is the entire install. The web installer runs all three for you.

A few terms that make the prompts make sense:

• Bootloader — firmware that runs before the OS and decides what's allowed to boot. Locked by default; unlocking removes the restriction (and disables verified boot until you re-lock).
• Verified boot — a cryptographic chain from bootloader → firmware → OS. Once re-locked with GrapheneOS's keys, any tampering with OS partitions halts boot. This is what protects you against physical-access attacks.
• OEM unlocking — a permission flag that allows the bootloader to be unlocked. It doesn't unlock anything itself; it permits the unlock command to run.
• A/B partitions — Pixels keep two full copies of the OS. Updates write to the inactive copy, so a failed flash on one slot leaves the other intact. This is why the web installer almost never bricks a device.

Choose your path

Two ways to install. Pick one:

• Web installer (recommended for almost everyone). Runs in a Chromium browser, detects your device, downloads and verifies the image, and walks you through unlock → flash → re-lock. No commands. Start here unless you have a specific reason not to.
• CLI installer. Direct fastboot commands. Only worth it if you can't use a Chromium browser or you specifically want manual control. Same result, more steps.

Both are covered below.

Step 1: Enable Developer Options and OEM unlocking

On the Pixel, running stock Android, connected to the internet:

1. Settings → About phone → Build number — tap seven times. A countdown appears after the third tap; a confirmation after the seventh.
2. Settings → System → Developer Options → OEM unlocking — enable it.

If the toggle is greyed out with internet connected, the device is carrier-locked (see "Before you start"). If it's greyed out without internet, connect to Wi-Fi/data and wait a few seconds for the carrier-lock check to complete.

Step 2: Enter fastboot mode

Hardware method: Power off. Hold Volume Down, then press and hold Power, keeping Volume Down held until the fastboot screen (Android figure + "Fastboot Mode") appears. Connect to the computer by USB.

ADB method (if USB debugging is already on):

adb reboot bootloader

Verify the computer sees the device:

fastboot devices

It should return the serial number with "fastboot" status. Empty output → check the cable, the port, and (on Windows) the driver, per the checklist.

Path A: Web Installer (recommended)

Open grapheneos.org/install/web in Chrome, Edge, or Brave (Brave: disable Shields first). It handles everything automatically and prompts you through each stage.

Stage 1 — Connect. With the device in fastboot mode and plugged in, the installer asks for WebUSB permission. Allow it. It identifies your model and picks the correct factory image.

Stage 2 — Unlock the bootloader. The installer runs fastboot flashing unlock. On the phone, a warning appears about wiping data and installing custom software. Use Volume Down to select "Unlock the bootloader," press Power to confirm. The phone wipes, reboots, and returns to fastboot. This is expected.

Stage 3 — Flash. The installer downloads the factory image, verifies it against GrapheneOS's cryptographic signature, and flashes every partition (bootloader, radio firmware, OS). Don't disconnect the cable or let the computer sleep. Some partitions look stalled for 60–90 seconds — normal. Genuinely stuck for 5+ minutes? See troubleshooting.

Stage 4 — Re-lock the bootloader. The installer runs fastboot flashing lock. Confirm "Lock the bootloader" with Power. The phone reboots into GrapheneOS.

This step is not optional. Locking the bootloader is what activates verified boot and hardware attestation. Leave it unlocked and anyone with USB access and a laptop can silently replace your OS. Do not skip it.

Path B: CLI Installer (alternative)

For direct fastboot control or if you can't use a Chromium browser. Full reference: grapheneos.org/install/cli.

Requirements:

• fastboot 35.0.1 or newer — distro packages are often too old. Get the latest Android Platform Tools from Google and put the folder on your PATH.
• OpenSSH (ssh-keygen) for signature verification.

Process:

1. Download the factory image for your exact device from grapheneos.org/releases.
2. Verify it against GrapheneOS's signing key:

ssh-keygen -Y verify -f allowed_signers -I [email protected] -n "factory images" -s <image>.zip.sig < <image>.zip

3. Extract the archive.
4. In fastboot mode, unlock (confirm on device):

fastboot flashing unlock

5. Run the included flash script:

# Linux / macOS
./flash-all.sh

# Windows
flash-all.bat

6. Re-lock (confirm on device):

fastboot flashing lock

Don't modify flash-all — it handles partition ordering for you.

Troubleshooting

OEM unlocking greyed out (internet connected) — carrier-locked device. Contact the carrier; there's no technical workaround. Buy from Google Store next time.

OEM unlocking greyed out (no internet) — connect to Wi-Fi/data and wait a few seconds for the carrier-lock check.

Pixel 6a: OEM unlock doesn't work on factory firmware — update to June 2022+ firmware via Settings → System → System update, factory reset, then re-enable Developer Options and OEM unlocking.

fastboot devices returns nothing — different port (prefer a rear/direct one), different cable, confirm the phone is actually in fastboot mode. Windows: install the Google USB driver via Windows Update → Optional Updates, or Device Manager.

"WebUSB not supported" — use a locally installed Chrome/Edge (not Snap/Flatpak on Linux), and not a private/incognito window.

Flash stalls or the cable drops — disconnect, reboot to fastboot (Volume Down + Power), reconnect, restart the installer from the beginning. A/B partitions mean a half-finished flash on one slot doesn't brick the phone.

Red "device is corrupt" screen after install — the bootloader wasn't locked, or the re-lock failed. Re-enter fastboot and run fastboot flashing lock. If it was locked and you still see it, re-flash from scratch.

First boot: four choices that matter

GrapheneOS's setup wizard is short. Four decisions are worth making deliberately:

1. Set a passphrase, not a PIN. GrapheneOS derives your disk-encryption key from the lock screen credential — a longer passphrase dramatically raises the cost of brute-forcing a seized device. The PIN-vs-passphrase math is worth reading.
2. Skip Google account setup. Build the baseline first; add Google later, deliberately, through sandboxed Play if you need it.
3. Disable OEM unlocking. Settings → System → Developer Options → turn it back off. It was only needed for the install.
4. Verify with Auditor. Install the Auditor app from the GrapheneOS App Store and run a local attestation. It uses the Titan chip to confirm the bootloader is locked and GrapheneOS is genuinely what's running — a hardware-backed check that can't be faked in software.

The full day-one sequence — what to configure, in order — is in First 24 Hours with GrapheneOS. The rest of this guide is reference: the app model, every security setting, and the profile system.

Sandboxed Google Play

On stock Android, Google Play Services is a privileged system process with access to hardware identifiers, system APIs, and inter-app channels regular apps can't touch. GrapheneOS removes that privilege entirely: sandboxed Google Play runs Play Services as an ordinary, unprivileged app, with a compatibility layer translating its API calls. Most things work; the app just receives appropriately scoped responses.

What works and what doesn't:

• ✅ Play Store installs, app updates, in-app purchases, Play Asset/Feature Delivery.
• ✅ Push notifications (Firebase Cloud Messaging) — after granting one battery-optimization exception.
• ✅ Most Play-dependent apps, unmodified.
• ❌ Google Wallet tap-to-pay — needs an attestation of official Google firmware a custom OS can't produce.
• ↪ Location requests get rerouted through GrapheneOS's own geolocation service, not straight to Google.

For the full "will my app work" picture, see what breaks on GrapheneOS.

Install it (if you want it):

1. Open the pre-installed GrapheneOS App Store.
2. Install Google Play services (this bundles Play Services + the Play Store).
3. Open Play Store, sign in if you like, install apps normally.
4. Push notifications: Settings → Apps → Google Play services → Battery → Unrestricted.

Best practice: install Play in a secondary profile, not the owner profile, so it's contained. Profiles are covered below.

App Stores and Sideloading

• GrapheneOS App Store (pre-installed) — GrapheneOS-tested sandboxed Play builds, and it mirrors Accrescent. Your primary source.
• Accrescent — privacy-focused, developer-signed, reproducible builds. Small catalog, growing. Worth installing for what it carries.
• F-Droid — huge FOSS catalog, but its default repo re-signs apps with F-Droid's own key rather than the developer's, and builds aren't always reproducible. Prefer the IzzyOnDroid repo or developer-signed repos within it. Sideload the APK from f-droid.org.
• Aurora Store — anonymous Play frontend, no Google account needed; the shared-account pool gets rate-limited. Secondary option, from auroraoss.com.
• Direct APKs — Settings → Apps → Special app access → Install unknown apps, grant it to the specific app you'll open the APK with, then turn it back off after.

Exploit Protection Settings

Settings → Security & privacy → Exploit protection. These are GrapheneOS's headline hardening features. Defaults are sensible; the ones worth knowing:

Auto reboot — reboots the device after a set time locked (default 18 hours, configurable 10 min–72 hr). After reboot the device is in Before First Unlock (BFU) state: encryption keys are out of memory, data is inaccessible, attack surface is minimal. Implemented at init level so a compromised userspace can't bypass it. This is what makes a lost or seized device far harder to extract from.

USB-C port control — five modes:

The default's hardware-level cut-off blocks USB-based forensic extraction tools (e.g. Cellebrite) that target the data lines on a locked device.

Dynamic code loading restrictions — three per-app toggles (block executable code from memory; block it from storage; disable WebView JIT). Off by default for compatibility; enable on apps that don't need runtime code generation to shrink their attack surface.

Native code debugging (ptrace) — blocked by default for system/bundled apps; per-app toggle for your own installs. ptrace is a common privilege-escalation primitive, so disabling it hardens process isolation.

PIN scrambling — Settings → Security & privacy → Device unlock → Scramble PIN. Randomizes keypad layout each unlock; defeats shoulder-surfing and accelerometer-based PIN reconstruction.

Duress PIN / password — Settings → Security & privacy → Device unlock → Duress password. A secondary credential that, entered at any auth prompt, instantly and irreversibly wipes all hardware keystore keys (making encrypted data unrecoverable), wipes the eSIM, and shuts down — fast, with no visible "wiping" indicator. PIN and password versions trigger independently; set whichever matches your lock type.

Two-factor fingerprint unlock — Settings → Security & privacy → Device unlock → 2-factor fingerprint unlock. Requires fingerprint plus a (scrambled) PIN, so biometric alone can't open the device. This changes the usual fingerprint-vs-PIN trade-off. Only available for 48 hours after the last passphrase unlock, then it falls back to the passphrase.

Battery charge limit — Settings → Battery → Charge limit. Caps at 80% to reduce battery wear; periodically tops to 100% for calibration. Useful if the phone lives on a charger.

Permission System

GrapheneOS adds permission controls stock Android simply doesn't have:

Network (per-app) — Settings → Apps → [App] → Permissions → Network. Off = the app gets standard network-unavailable errors (ENETDOWN), as if the phone were offline. It can't tell it's been blocked, so nothing breaks in a "permission denied" way. Available at install time, before the app ever runs. This is one of the highest-value toggles on the OS.

Sensors (per-app) — blocks accelerometer, gyroscope, barometer, thermometer, step counter, etc. Stock Android grants all of this with no prompt; GrapheneOS lets you deny it per app.

Storage Scopes — instead of broad storage access, the app sees only the files/folders you explicitly add. From the app's view it has full storage permission — it just can't see anything you didn't authorise, and can't tell it's being filtered.

Contact Scopes — same idea for contacts: the app sees an empty list by default; you grant specific contacts/fields; write access is blocked entirely.

Camera/mic indicators — persistent status-bar indicators whenever camera or mic is in use.

Per-app exec spawning — Settings → Apps → [App] → Exec spawning. Isolated spawning builds each app process from scratch instead of forking a shared Zygote, eliminating cross-app memory residue at a small launch-speed cost.

Profiles

GrapheneOS massively expands Android's multi-user profiles — up to 31 secondary profiles (stock allows 3), each cryptographically isolated.

• Profile isolation — separate apps, data, settings, and encryption keys per profile. Apps in one profile can't see, talk to, or enumerate apps in another. Switching requires that profile's credential.
• Owner profile — full admin; can restrict what secondary profiles may do (e.g. block app installs, enforce a fixed app set).
• End Session — locks a secondary profile and evicts its keys from memory (data back to encrypted-at-rest) without uninstalling anything.
• Profile-specific VPN — each profile has independent VPN config; a VPN in one profile doesn't route (or leak) another profile's traffic, so you can run ProtonVPN in just the profile that needs it and leave the rest untouched.
• Notification forwarding — background profiles can optionally forward notifications to the active profile (off by default).
• Cross-profile install — a package already installed in one profile can be added to another from local cache, no re-download.

Recommended model: owner profile Google-free; a secondary profile with sandboxed Play for apps that need it; extra profiles for work, burners, or high-trust financial apps as needed.

Keeping GrapheneOS Updated

Updates use the A/B model — the new version writes to the inactive slot while you keep using the phone, and a reboot switches to it. If the new slot won't boot, it falls back automatically. GrapheneOS ships security patches typically within hours to days of the monthly Android Security Bulletin, often ahead of official Pixel OTAs. Settings → System → System update.

Security Preview channel (Settings → System → System update → Release channel) delivers Android Security Bulletin patches before public disclosure — functional but source can't be published until the embargo lifts. Switch back to Stable afterward.

Returning to Stock Android

Fully reversible:

1. Download your device's factory image from google.com/android/images.
2. Boot to fastboot.
3. fastboot flashing unlock (wipes the device again).
4. Flash with the included flash-all.sh / flash-all.bat.
5. fastboot flashing lock.

Re-locked with Google's keys, it boots stock Android with verified boot active. The unlocked period leaves no software-visible trace after re-locking.

Frequently Asked Questions

Do banking apps work on GrapheneOS?
Most do, especially with sandboxed Google Play installed. A minority fail because they rely on Google's Play Integrity certified-device check rather than the hardware attestation GrapheneOS supports. It varies by bank and region and changes with app updates, so test yours. Full detail in what breaks on GrapheneOS.

Does Google Pay / Google Wallet tap-to-pay work?
No — permanently. Contactless via Google Wallet needs an attestation of official Google firmware a custom OS can't produce. A smartwatch payment app or a bank's own NFC implementation are the only workarounds.

Is battery life worse?
No meaningful difference from stock Pixel Android once you've restored the same apps. Standby drain is often lower on a clean install. Screen time and signal matter far more than the OS.

Is GrapheneOS safe and legal to install?
Yes to both. It's open-source, from a non-profit, built on AOSP, and installing it on your own hardware is legal. Re-locking the bootloader with GrapheneOS's keys keeps verified boot intact. Privacy Guides rates it the strongest Android distribution available.

Can I go back to stock Android?
Yes — fully reversible. Re-flash Google's factory image and re-lock (see "Returning to Stock Android").

Which Pixel should I buy?
A Pixel 8 or newer, unlocked, from the Google Store — seven-year firmware support means seven years of full patching. Avoid carrier models. Use the Pixel compatibility checker if unsure.

How long does it take?
About 15 minutes of active work on a supported Pixel with a good cable. Most of that is the flash running itself.

Do I need the command line?
No. The web installer covers supported Pixels start to finish. The CLI path is optional, for people who prefer manual control or can't use a Chromium browser.

Will I lose my data?
Yes — the install wipes the phone completely. Back up everything first.

Further Reading

• First 24 Hours with GrapheneOS — the day-one setup sequence, in order
• What Breaks on GrapheneOS (and What Doesn't) — banking, Google Pay, Android Auto, gaming, battery
• The Complete Android Privacy and Security Guide — the broader threat model
• Realistic Options to Gain Phone Privacy — stock-Android hardening if you're not switching OS
• Fingerprint vs PIN · Why rebooting your phone matters
• GrapheneOS docs · releases / device list · Auditor

Last updated: September 2026. Confirm the current supported-device list at grapheneos.org/releases before buying.