GrapheneOS: Install, Banking Apps, Supported Pixels and Is It Worth It?

GrapheneOS is a free, open source version of Android that hardens a phone against remote exploits and against someone holding it. It runs on Google Pixels only. Everything below was checked against grapheneos.org and the sources listed at the end on 10 November 2026; the project ships updates every few days, so the device list and app notes move.

This page covers the operating system itself. Settings that apply to any stock iPhone or Android phone are in phone privacy hardening, and where a hardened phone fits in a wider setup is in the privacy tools by threat model guide.

What GrapheneOS changes

GrapheneOS starts from the Android Open Source Project, the code Google publishes, and adds hardening in three layers: remove attack surface, make bugs harder to exploit, and contain whatever gets through. Its features page lists only what it adds beyond AOSP.

Exploit mitigations

Most serious phone exploits are memory corruption bugs. GrapheneOS attacks that class directly.

• hardened_malloc. Its own memory allocator keeps allocator metadata out of line from the data, separates size classes into regions with random bases, zeroes memory on free and checks it is still zero before reuse, and quarantines freed memory so use-after-free bugs are harder to aim. The same allocator is used outside GrapheneOS, in secureblue for example.
• Hardware memory tagging. Pixel 8 and later have ARM's Memory Tagging Extension. GrapheneOS enables it by default for the base OS and for user apps known to be compatible, with an option to force it for all apps. When it catches memory corruption, GrapheneOS shows a crash notice saying so.
• Secure app spawning. Each app is started fresh so apps do not share the same memory layout secrets inherited from a common parent process.
• Hardened libc and kernel settings on top of the mitigations Android already ships.

These mitigations are why GrapheneOS is attractive against zero-day exploit chains, the kind sold by the vendors described in the exploit market. Background on how mitigations raise exploit cost is in exploit mitigations explained.

Verified boot with a relocked bootloader

Installing GrapheneOS flashes the project's verified boot public key into the Pixel's secure element. On every boot, the firmware checks the whole OS against that key and refuses modified data, the same way it checks Google's own images. Then you lock the bootloader again. A relocked bootloader blocks flashing or erasing partitions over USB, and the key can only be changed by unlocking, which wipes the secure element and destroys the keys needed to decrypt your data.

Because the OS is not Google's, the phone shows a yellow notice at boot with a hash of the key. On Pixel 6 and later that is the full SHA-256, which you can compare with the hashes published on the installer page. The GrapheneOS Auditor app goes further: a second Android phone running Auditor can verify the hardware, firmware and OS through hardware attestation.

Sandboxed Google Play

On a stock Pixel, Google Play services is a privileged system component. On GrapheneOS it is an ordinary app, installed from the GrapheneOS App Store, inside the normal app sandbox with no special access. It exists only in the profile where you install it, apps must choose to use it, and it needs your consent for each permission like any other app. Location requests are rerouted to GrapheneOS's own implementation by default.

The practical result: you can run Play-dependent apps in one profile and keep a second profile with no Google code at all. GrapheneOS allows up to 31 secondary profiles plus a guest, against 3 plus a guest on stock Android.

Per-app permissions stock Android lacks

Lock screen and physical access defences

• Auto-reboot. After the phone has been locked for a set time without a successful unlock, it reboots, which returns your data to the encrypted Before First Unlock state. The default is 18 hours and it can be set from 10 minutes to 72 hours. It runs in init, so crashing a system process does not stop it.
• USB-C port control. The default mode, charging-only when locked, blocks new USB connections as soon as the phone locks and turns off the data lines in the USB controller once existing connections end. The strictest mode, Off, also disables charging while the OS is running.
• Duress PIN and password. A separate PIN and password that, entered at any credential prompt, wipe the phone and its eSIMs immediately, with no reboot and no way to interrupt it. You must set both a duress PIN and a duress password. It does not currently trigger from the SIM PIN prompt.
• Two-factor fingerprint unlock. Optionally require a PIN after the fingerprint, so a long passphrase can be the primary unlock while daily unlocks stay quick.
• Fingerprint attempt limit of 5 in total, instead of 20 with delays. Five deliberate failures with the wrong finger disable fingerprint unlock.
• PIN scrambling on the lock screen and SIM PIN entry, and passwords up to 128 characters.

What the threat model covers

GrapheneOS is designed against remote exploitation, malicious apps, and someone holding your locked phone with forensic tools. It does not stop extraction when you unlock the phone for the examiner: the project describes consent-based full filesystem extraction as out of scope, apart from the duress PIN. Cloud data held by Google, your carrier, or messaging providers is also outside what an OS can protect.

Supported Pixels and how long they last

GrapheneOS names one reason for supporting Pixels only: they meet its hardware list. That list includes support for an alternate OS with full hardware security features, monthly firmware patches, a secure element that provides StrongBox, Weaver throttling of PIN guesses and insider attack resistance, the ability to disable USB data in the USB controller, hardware memory tagging, and a non-truncated hash of the boot key. On Pixel 6 and later, the Titan M2 secure element throttles guesses, which makes a random 6-digit PIN impractical to brute force.

Pixel 8 and newer carry Google's 7 year guarantee and memory tagging; Pixel 7 and older were sold with 5 years and lack memory tagging. Updates usually stop soon after the date in the table. The Pixel 6 and 6 Pro passed their date in October 2026; as of 10 November 2026 they are still on the official device list and received the 2026110700 release. When Google support ends, GrapheneOS may ship extended support releases, which it calls a last resort while you replace the phone.

Avoid carrier variants. US carriers in particular sell Pixels with OEM unlocking disabled, which blocks installation.

How to install GrapheneOS with the web installer

The web installer at grapheneos.org/install/web is the method the project recommends for most people. It drives fastboot over WebUSB from the browser, so there is nothing to install on a Windows 10 or 11, macOS or ChromeOS computer. Linux needs udev rules, covered below. Allow roughly an hour (our estimate; it depends on your connection), and back up the phone: two steps wipe it.

What you need

• A computer with at least 2GB of free memory and 32GB of free storage. Avoid virtual machines.
• Chrome, Edge, Chromium or Brave (with Shields off for the site). Avoid Snap and Flatpak builds and private windows. Chromium from Ubuntu's Snap package lacks working WebUSB.
• A good USB-C cable plugged straight into the computer, no hub or front-panel port. Bad cables are the most common cause of failed installs.
• An Android 14 or newer Play Protect certified phone, or another GrapheneOS phone, also works as the installing device.

Steps

1. Update the stock OS if you can, so the phone has current firmware for the early flashing stage. On a Pixel 6a, the factory firmware cannot enable OEM unlocking at all until you install the June 2022 or later update and factory reset.

2. Enable OEM unlocking. Settings, About phone, tap Build number until developer options appear. Then Settings, System, Developer options, turn on OEM unlocking. The phone needs internet access for this on models that can be sold carrier-locked.

3. On Linux only, install the udev rules (android-udev on Arch, android-sdk-platform-tools-common on Debian and Ubuntu). If the browser reports the device is already claimed, stop fwupd for the session:

   copy

   sudo systemctl stop fwupd.service

4. Boot into the bootloader. Restart the phone and hold volume down until a red warning triangle and the words Fastboot Mode appear. Do not press power to select Start.

5. Connect the phone to the computer. Current Windows 10 and 11 include the needed driver.

6. Unlock the bootloader. Press Unlock bootloader on the page, then confirm on the phone with a volume key and the power button. This wipes the phone.

7. Download the release with the Download release button.

8. Flash the release with Flash release. The installer flashes the firmware, reboots to the bootloader and flashes the OS by itself. Leave the phone alone until it finishes.

9. Lock the bootloader with Lock bootloader and confirm on the phone. This turns on full verified boot and wipes the phone again, which is why you do it before setting anything up.

10. Boot by pressing power with Start selected.

11. Leave OEM unlocking off. The last screen of the setup wizard has a checked toggle that disables OEM unlocking. Keep it checked.

Optional, and worth doing: compare the boot key hash on the yellow boot notice with the published hash for your model, or verify the phone with Auditor from a second Android device.

After setup, install Google Play only if you need it, from the preinstalled App Store, in the profile where you want it.

What breaks

Banking apps and Play Integrity

Google's Play Integrity API returns verdicts about the device. GrapheneOS can get the optional basic integrity label, which only requires a Google attestation root of trust. The device and strong labels require an operating system Google has certified, and Google does not certify GrapheneOS. An app that enforces those verdicts will refuse to run, however well the phone is secured.

GrapheneOS does not try to spoof the checks. It publishes an attestation compatibility guide asking app developers to use Android's hardware key attestation directly and allow the GrapheneOS verified boot keys, which it publishes as a signed JSON file. Play Integrity's strong verdict is built on that same hardware attestation, so an app that switches keeps the same hardware-backed assurance.

Some apps also break for other reasons:

• Apps with their own anti-tampering code may need Native code debugging turned back on under Settings, Security and privacy, Exploit protection, if you turned it off.
• A few apps need Exploit protection compatibility mode turned on for that app (Settings, Apps, the app). It switches that app to Android's standard allocator and turns off memory tagging for it.
• Some apps check that they were installed from the Play Store, so install them through the Play Store in the profile with sandboxed Google Play.

Check your bank before you switch. The GrapheneOS usage guide links to a community list maintained by PrivSec.dev (last updated 20 October 2026 when checked), grouped by country, with notes such as which apps fail on the Pixel 10 series and which need workarounds. GrapheneOS states it makes no guarantees about that list. A missing entry means nobody reported it, so a quick search of the GrapheneOS forum for your bank's name is the second check.

Paying with the phone

Google's Wallet help page says Wallet doesn't run on phones that "are rooted, run a custom ROM, or have modified factory software" or that "haven't been approved by Google". GrapheneOS users pay by card, by a bank's own NFC payment app if that app allows GrapheneOS (GrapheneOS lists some that ban it, such as mada Pay), or with a watch.

GrapheneOS vs stock Pixel vs iPhone vs CalyxOS and LineageOS

Two GrapheneOS controls have no direct equivalent in the table: the duress PIN, and the auto-reboot timer you can set from 10 minutes to 72 hours. iPhones on iOS 18.1 and later reboot after 72 hours without an unlock, a timer security researchers found by reverse engineering; Apple did not document it at release.

A few notes on the table. Stock Pixels on Android 16 and later can turn on Advanced Protection, announced in May 2025. Its USB protection limits any new USB connection to charging while the phone is locked. It is the closest stock equivalent and worth enabling if you stay stock. CalyxOS paused releases after August 2025 while the team reworked its signing and release process, and resumed full releases on 1 July 2026; it shipped 8.0.4.50 on 30 October 2026. LineageOS aims at keeping old devices running and does not target the same security properties.

For iPhone users, Lockdown Mode cuts attack surface in Messages, the browser and FaceTime and blocks accessories while locked; the full list is in phone privacy hardening. GrapheneOS gets there through exploit mitigations and isolation, and leaves message attachments and web features on.

What the forensic leaks show

The best evidence about phone seizure resistance comes from the vendors themselves. In May 2024 the GrapheneOS project published Cellebrite capability documents dated April 2024. 404 Media reported on the same set of documents on 17 July 2024 and said it had verified them. The Android tables, as GrapheneOS summarised them, showed Cellebrite able to exploit every non-GrapheneOS Android brand both before first unlock (BFU) and after first unlock (AFU), while GrapheneOS was listed as not exploitable once its patch level was past late 2022. The same documents showed only Pixels stopping PIN brute force through the secure element.

On 30 October 2025, 404 Media reported a newer leaked Cellebrite slide covering Pixels and GrapheneOS, captured by someone who joined a Cellebrite Microsoft Teams call. 404 Media said it verified the material.

Two limits apply. These are snapshots: a new exploit can change the picture in any month, which is why auto-reboot matters. And every vendor lists consent-based extraction, meaning the owner unlocks the phone. A strong passphrase and a short auto-reboot timer protect you; the OS cannot protect data from someone you unlock it for. Digital forensics basics explains BFU, AFU and extraction types.

2026: the Motorola partnership

On 1 March 2026 at Mobile World Congress, Motorola announced a long-term partnership with the GrapheneOS Foundation to collaborate on future devices engineered with GrapheneOS compatibility, and on joint research and new security capabilities. It is the first OEM partnership for the project, whose FAQ had long said it planned to partner with manufacturers to build devices meeting its requirements. No Motorola phone had official GrapheneOS support as of 10 November 2026; the official device list is still Pixel only.

Failure modes

• Skipping the relock. An unlocked bootloader leaves full verified boot off and lets anyone with the phone and a cable flash it. Lock it and leave OEM unlocking off.
• Buying a carrier-locked Pixel. You will reach step 2 and find OEM unlocking greyed out.
• Bad cable or hub. The flash stops part way. Use the cable from the box, directly into the computer, and retry.
• A weak unlock method. The secure element throttles guesses, so a random 6-digit PIN holds against brute force on supported Pixels. A PIN you reuse, or one someone watched you type, does not. For data you need protected even against an exploited secure element, the project suggests a passphrase of 6 to 8 random words, with two-factor fingerprint unlock for daily convenience.
• Auto-reboot set to off. It is the defence that undoes a seizure in AFU state. Shorter than 18 hours costs you only the occasional PIN re-entry after a reboot.
• Installing Google Play in the owner profile out of habit. It works, but you lose the option of a Google-free main profile. Decide first.
• Assuming the OS protects your accounts. Cloud backups, SMS one-time codes, and a messenger that stores contacts on its servers are all outside the phone. For messaging, see the most private messengers.
• Running an end-of-life Pixel. Firmware and driver patches stop, and the OS cannot replace them.

Who should switch

Switch if you already have, or are buying, a Pixel 8 or newer; you have checked that your bank and any work apps run; and you care about device seizure, targeted exploits or keeping Google services in a box. Journalists, lawyers, activists, people crossing borders with sensitive data, and anyone leaving an abusive relationship (see how to detect stalkerware) gain the most.

Stay on a stock iPhone with Lockdown Mode if you want comparable protection with no compatibility risk, or you depend on Apple Pay.

Stay on a stock Pixel with Advanced Protection if one essential app fails Play Integrity, or you are not willing to troubleshoot an app now and then.

Skip CalyxOS and LineageOS if security is the reason for switching. They suit other goals, such as keeping old hardware alive or running a Google-free phone on a non-Pixel.

So is GrapheneOS worth it? On a Pixel 8 or newer, once you have confirmed your banking app works, yes. The cost is giving up tap to pay through Google Wallet.