Your phone is basically a cop with your location, your contacts, and your search history in its back pocket. Google’s got one hand on the wheel, apps have the other, and you’re just the passenger hoping nobody crashes.
GrapheneOS is still Android. It just puts you back behind the wheel. It also wipes your phone three times on the way in, which is the part every breathless “install it in 20 minutes” post forgets to mention.
Why Your Pixel Phone Feels Like Borrowed Territory
Android is open source. The Android that ships on a retail Pixel is that open source base plus a privileged layer of Google code that the OS itself depends on: geolocation, push messaging, attestation, the lot. You can uninstall the Google apps you can see. You can’t uninstall the ones the OS treats as part of itself.
GrapheneOS is what happens when security researchers get tired of that arrangement and build from AOSP instead. It’s Pixel-only, it drops the privileged Google layer, it runs Google Play as an ordinary sandboxed app if you want it, and it adds hardening on top: a hardened memory allocator, per-app network and sensor permissions, and same-day shipping of Android security patches rather than waiting on a monthly vendor cycle.
The realistic take: you won’t become invisible. Your carrier still knows where you are. But the phone stops making decisions on Google’s behalf without asking you.
Installing It: The Web Installer Is Actually Solid
GrapheneOS used to require fastboot commands that scared people away. Now there’s a browser wizard that drives the same process over WebUSB.
What you need:
- A supported Pixel. Official production support runs from the Pixel 6, 6 Pro, and 6a up through the Pixel 10a, plus the Pixel Fold and Pixel Tablet. The Pixel 5a and everything older is end of life and gets no releases.
- A Pixel that is not carrier locked. Devices sold on contract by US carriers usually have OEM unlocking disabled, and that kills the install before it starts. This is mostly a US problem.
- OEM unlocking turned on: Settings > About phone, tap the build number seven times, then Settings > System > Developer options > OEM unlocking.
- A Chromium-based browser on the computer. Chrome, Edge, Vanadium, or Brave with Shields switched off. Firefox has no WebUSB support and will not work. Ubuntu’s snap build of Chromium is also broken for this.
- 2GB of free RAM and 32GB of free disk on the computer.
- A USB cable that carries data, not a potato charge-only cable.
- 30 minutes, plus however long your restore takes.
The flow:
Head to https://grapheneos.org/install/web and follow the wizard. The browser talks straight to your phone’s bootloader, which sounds sketchy until you remember it’s the same fastboot protocol, driven from a page whose source you can read.
# What the wizard does (you click; the browser drives):# 1. You boot the phone into fastboot mode with the button combo# 2. Browser unlocks the bootloader <- WIPES THE PHONE# 3. Browser downloads and flashes the release# 4. You re-lock the bootloader <- WIPES THE PHONE AGAIN# 5. First boot, then you turn OEM unlocking back offRead steps 2 and 4 again. Unlocking the bootloader wipes all data. Flashing replaces the existing OS and wipes data. Locking it back down wipes data again. Nothing survives. Back up before you start and restore afterward, and stop believing anyone who tells you your photos come along for the ride.
Do not skip the re-lock. This is the step people leave out, and leaving it out throws away most of what you came for. Locking the bootloader is what turns on full verified boot, and it stops anyone holding your phone from using fastboot to flash, format, or erase partitions. After the first boot, go back into developer options and turn OEM unlocking off as well.
Check the hash once. With a locked bootloader running a non-Google signing key, the boot screen shows a yellow warning with the key’s hash. Compare it against the hash published on the GrapheneOS install page. Pixel 6 and newer display the full hash rather than a truncated prefix, so the comparison is worth something. Do it once, then ignore the screen forever. It auto-continues after about five seconds and never goes away.
Sandboxed Play: Google Services as a Normal App
The interesting design choice in GrapheneOS is that it runs the official Google Play releases inside the standard app sandbox. No privileged partition, no signature-level permissions, no special access. Play services becomes an app like any app you install.
You get it from the GrapheneOS App Store: open the App Store, pick Google Play services, install. That pulls in the Play Store too, because the two depend on each other. It’s per-profile, so you can run Play in a work profile and keep an owner profile with no Google code on it at all.
Standard permissions Play asks you, in the same dialog as any other app. You can deny, or grant while-in-use only.Other apps' data Unreachable. Normal sandbox rules apply.Network permission GrapheneOS adds a revocable per-app network toggle. Stock Android grants INTERNET at install time with no way to take it back. Here you can take Play offline.Geolocation Play's location requests are rerouted to a GrapheneOS reimplementation by default, not to Google's backend.OS services GrapheneOS never uses Play as the backend for system geolocation, push, or anything else.The limitation worth knowing: this is a compatibility layer, extended case by case. Functionality that fundamentally needs privileged access doesn’t work by default. Android Auto is the headline example, supported only through dedicated opt-in toggles. eSIM management needs proprietary Google code and is disabled out of the box, so you can keep an eSIM you already had but can’t add a new one until you enable it.
One myth to kill: GrapheneOS does not block ads. There’s no built-in blocker and no network filtering that quietly starves ad requests. The project’s own recommendation is DNS-level blocking, which you set up yourself under Private DNS by pointing it at something like dns.adguard-dns.com. Worth knowing that ad blocking is itself detectable and adds to your fingerprint, which is why a widely used blocklist beats a bespoke one.
What Breaks, and Why
Not every app works. The reasons are specific, and knowing the mechanism tells you in advance whether you have a problem.
Banking apps. The big one. Banks increasingly call Google’s attestation service to check what OS they’re running on. GrapheneOS passes the basicIntegrity check and fails ctsProfileMatch, because passing that second one requires a Google-certified build and GrapheneOS is not certified. GrapheneOS deliberately doesn’t spoof its way past the check, since that approach shatters every time Google tightens the screws. Banks that accept basic integrity work normally. Banks that demand certification refuse to launch. PrivSec.dev maintains a community-sourced compatibility list at https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/ and it’s your best guess before committing, though the GrapheneOS project makes no promises about its accuracy.
There’s a second cause that looks identical and is fixable in ten seconds. Plenty of financial apps ship crude anti-tampering that watches for debugging of their own code. If you turned off Native code debugging under Settings > Security & privacy > Exploit protection, turn it back on and try again. That single toggle explains a good share of “my bank app just closes” reports.
Enterprise MDM. Intune, MobileIron, and friends check the same attestation and usually enforce a certified-OS policy. This is a policy problem, not a technical one, and you will not argue your way out of it. Carry a work phone.
Google’s own apps are fine. Gmail, Drive, Docs, Maps, YouTube: all of them work under sandboxed Play, including in-app purchases, Play Asset Delivery, and Play Feature Delivery. The folklore that Google apps break on GrapheneOS is years out of date. Location sharing in Maps needs Play services granted Location with “Allow all the time” plus Physical activity, which is exactly the sort of thing you now get asked about instead of having it assumed.
Games and apps demanding hardware attestation. Devices launched with Android 8 or later support hardware-backed attestation, which can’t be spoofed without leaked keys. Anything that insists on the hardware-backed verdict will refuse to run, and no toggle fixes it. Anything that only asks for basic integrity is usually fine. Test before you buy.
Fitness trackers and smart home. Entirely vendor dependent, based on how much privileged Play integration the app assumes. Try the app before you buy the hardware.
What works without drama:
- Open-source apps: Signal, Element, Tusky, Organic Maps
- Web wrappers and anything that’s really a browser in a trench coat
- Self-hosting clients: Nextcloud, Seafile, Syncthing, Jellyfin
- F-Droid and Accrescent
- Vanadium, the hardened Chromium that ships as both the browser and the system WebView
Daily Driver: What It Actually Feels Like
GrapheneOS feels like Android because it is Android. Same gestures, same launcher, same settings tree with a pile of extra switches in it.
The parts that hold up:
- Security patches land fast, on a same-day schedule rather than a monthly vendor cycle.
- The Pixel Camera app works and does not need Google Play services or GSF to run. If you want the Pixel image pipeline, you keep it. The bundled GrapheneOS Camera app covers the basics plus Night mode.
- Per-app Network and Sensors permissions are useful once you build the habit of denying network to anything that has no business online.
- Storage Scopes and Contact Scopes let you hand an app a convincing empty folder or empty contact list instead of denying the permission and watching the app sulk.
The parts that get oversold:
- Battery life is not better. Sandboxed Play services usually wants a battery optimization exception before push notifications arrive on time, and once you grant it you’re back to roughly stock idle drain.
- Apps do not load faster. The hardened allocator costs a little performance rather than saving it.
Real annoyances:
- Pixel features that live in privileged Google system apps are gone: Call Screen, Hold for Me, Now Playing.
- Android Auto needs opt-in toggles rather than working out of the box.
- eSIM management is off by default and needs the proprietary bits enabled.
- Google Home and Nest setup flows lean on privileged Play integration and are hit or miss.
You trade a set of Google conveniences for a set of controls. That trade is the reason to run it, and if the conveniences matter more to you than the controls, the honest answer is to stay on stock.
F-Droid vs Play: The App Discovery Problem
Once you’re on GrapheneOS you’ll wonder where apps come from. Sandboxed Play works. So does F-Droid, and so does Accrescent, the newer store GrapheneOS ships in its own App Store.
F-Droid builds apps from source on its own infrastructure and signs them itself, which is the trust argument for it and also why updates lag upstream by days or weeks. You won’t find Instagram, TikTok, or most corporate apps there. You will find replacements that don’t ship an analytics SDK.
F-Droid - Source public and reproducible, builds done by F-Droid - No tracking, no ads - Updates lag upstream; maintainers are volunteers - Small catalog
Google Play (sandboxed) - Every app, including the invasive ones - Fast updates - Sandbox constrains what an app can reach, it does not change what you hand over when you tap Allow - Google still sees what you installRealistic setup: F-Droid or Accrescent for the privacy tools, sandboxed Play for the things with no alternative, and a hard look at each Play install before you tap the button.
Is It Worth It?
GrapheneOS makes sense if:
- You already run open-source software by preference
- Your bank works, or you’re fine using its website
- You don’t need Android Auto, Call Screen, or a corporate MDM enrollment
- You like tinkering and don’t mind occasional troubleshooting
GrapheneOS is probably not for you if:
- Your bank enforces hardware attestation and you need the app
- Your employer mandates mobile device management
- You bought a carrier-locked Pixel that can’t enable OEM unlocking
- Pixel-exclusive call features are the reason you bought the phone
The install runs about 30 minutes plus restore time. You can go back to stock the same way you arrived, with the Google factory images and another wipe. Worst case, you lost an afternoon and learned what your bootloader does. Best case, you end up with a phone that asks permission instead of assuming it.
It isn’t a perfect OS, and it doesn’t pretend to be. It documents its own limits better than the vendor it replaces.
Common Questions
Does installing GrapheneOS erase my data?
Yes, three times over. Unlocking the bootloader wipes the phone, flashing the OS wipes it again, and re-locking the bootloader wipes it a third time. Back up everything before you start and plan to restore afterward. No install path preserves your existing apps, photos, or messages.
Do banking apps work on GrapheneOS?
Some do. GrapheneOS passes Google’s basicIntegrity attestation check but fails ctsProfileMatch, which requires a Google-certified build. Banks needing only basic integrity work normally; banks demanding certification refuse to launch. Check the PrivSec.dev community compatibility list for your bank, and first try re-enabling native code debugging under Exploit protection.
Can I use the Google Play Store on GrapheneOS?
Yes. Install it from the GrapheneOS App Store by selecting Google Play services, which pulls in the Play Store alongside it. Both run inside the standard app sandbox with no special privileges, so they request permissions the same way any other app does, and you can revoke their network access.
Which Pixel phones does GrapheneOS support?
Official production support covers the Pixel 6, 6 Pro, and 6a through the Pixel 10a, plus the Pixel Fold and Pixel Tablet. The Pixel 5a and older devices are end of life. Carrier-locked Pixels sold on US contracts usually cannot enable OEM unlocking, so they cannot run GrapheneOS at all.
Do I have to re-lock the bootloader after installing GrapheneOS?
Yes. Locking the bootloader enables full verified boot and stops anyone with physical access from using fastboot to flash, format, or erase partitions. Leaving it unlocked discards most of the security you installed GrapheneOS to get. Turn OEM unlocking back off in developer options afterward.
