What does installing GrapheneOS actually involve?
An afternoon, a USB-C cable, and one thing you need to accept before you start: both the unlock step and the re-lock step wipe the phone completely. If there's anything on it you haven't backed up elsewhere, back it up first — photos, messages, whatever you'd miss. Once that's sorted, the install itself is point-and-click through a web page, no command line, no developer tools beyond flipping two switches in the phone's settings.
I run GrapheneOS as my daily driver, and this is the exact process I used on my own Pixel. It's not theoretical. If the piece on TOLA and what it means for your digital sovereignty is what brought you here, this is the first of the three guides it promised — the phone is the easiest win, and this is how you take it.
Which Google Pixel phones can actually run it?
Most Pixels from the 6 series onward, but the list changes as new phones launch and old ones age out — GrapheneOS's own FAQ carries the current, authoritative list, and that's the one to check before you buy a phone specifically for this.
As of today that spans the Pixel 6, 6 Pro, and 6a through the Pixel 10 family, plus the Pixel Fold and Pixel Tablet. Two things worth knowing before you commit: 8th-generation Pixels (8 and later) carry a 7-year minimum software support guarantee from launch; the 6 and 7 series only got 5 years, which means the original Pixel 6 lineup — launched October 2021 — is closing in on the end of its support window. Don't buy a secondhand Pixel 6 for this project expecting years of runway. A device also has to meet GrapheneOS's own hardware bar to qualify at all: an unlockable bootloader (the low-level software gatekeeper that controls what operating system a phone is allowed to boot), a correct implementation of verified boot, and a real hardware security chip — which is why you can't just install this on any old Android phone.
What do I need before I start?
A computer running a reasonably current Windows, macOS, or Linux — not a virtual machine, the USB connection to the phone is unreliable through one. A proper Chromium-based browser (Chrome, Edge, or Brave with Shields turned off), not a private/incognito window, and not Ubuntu's Snap-packaged Chromium, which has broken USB support. The good-quality USB-C cable that came with your phone. And, again: everything backed up, because the next section starts wiping data almost immediately.
How do you actually install it?
Everything happens through GrapheneOS's official web installer, running entirely in the browser — you never touch a command line.
- On the phone, go to Settings → About phone and tap the build number repeatedly until Developer Options unlocks.
- In the new Developer Options menu, turn on “OEM unlocking.”
- Power the phone off, then hold Volume Down while powering it back on — this drops you into Fastboot Mode, a stripped-down screen with a warning triangle, separate from Android itself.
- Plug the phone into your computer.
- On the web installer page in your browser, choose to unlock the bootloader. The phone will ask you to confirm on-screen, using the volume keys to select and the power button to confirm. This wipes the phone.
- The installer downloads the current GrapheneOS build for your exact phone model automatically — you don't pick a file yourself.
- Click “Flash” and let it run. It handles the firmware, the reboot into the bootloader, and the actual operating system install without any manual steps from you.
- Back at the bootloader screen, select “Lock the bootloader” and confirm with the power button. This wipes the phone again — expected, and important: a locked bootloader is what makes verified boot mean anything, so this has to happen before you put any real data on the phone, not after.
- Select “Start” to boot into GrapheneOS for the first time.
- During setup, GrapheneOS will flag if it thinks the bootloader isn't locked. On the last setup screen, turn OEM unlocking back off — leaving it on afterwards leaves a theoretical downgrade path open that you don't need for daily use.
Why does locking the bootloader again actually matter?
40-60 words: an unlocked bootloader means anyone with the phone in their hands — or malicious software with the right access — could flash a different, compromised operating system onto it without you ever knowing. Locking it closes that door and switches on verified boot, the check that gives the rest of this guide's security promises any teeth at all.
GrapheneOS itself won't offer support to anyone running it with the bootloader still unlocked, and says plainly that until it's locked, “the device is considered to be insecure.” Verified boot means the phone checks its own operating system against a cryptographic signature every time it starts, and refuses to boot cleanly if that signature doesn't match — but only once the bootloader is locked. An installed-but-unlocked GrapheneOS phone gets none of that protection. It's step 8 above for a reason: don't skip it, and don't put it off.
Do I need Google Play Services to use it day to day?
Not by default, and that's deliberate — GrapheneOS ships without it. Some apps (a banking app, certain two-factor logins, Google Maps) work better with it, and you can add a sandboxed version of Google Play afterward if you need it. The word “sandboxed” is doing real work here: on stock Android, Google Play Services runs with deep, privileged access to the whole phone. On GrapheneOS, it runs as an ordinary app with no special privileges at all — the apps that need it still work, but Google's code doesn't get the keys to the rest of the house to make that happen.
In my experience most day-to-day apps work fine with nothing added at all; a handful need the sandboxed layer; almost none genuinely require the unrestricted version. Start without it, and add it only if something you actually use breaks.
What's the Auditor app, and do I actually need it?
It's optional, and aimed at a more advanced use case than most readers of this guide need on day one — so treat this section as “nice to know exists,” not a required step.
The Auditor app, paired with the attestation.app service, gives you cryptographic proof — anchored in the phone's own hardware security chip, not something malicious software could fake — that your GrapheneOS install hasn't been secretly modified since you set it up. You pair the phone once by scanning a QR code, and it checks in periodically after that. It's built for a specific worry: someone getting brief physical access to your phone and tampering with it while it's out of your sight (security researchers call this an “evil maid” scenario). If that's not your threat model, skip it for now — you can always set it up later.
Will I have to type my full password every single time?
No — day to day, your fingerprint is enough. The exception is straight after a reboot, when a full unlock with your actual password is required once before biometrics switch back on. That's not a GrapheneOS quirk; it's how modern Android's disk encryption works everywhere — the phone's storage stays locked until the real credential unlocks it the first time after each boot, because the fingerprint sensor itself can't check anything against data that's still encrypted.
GrapheneOS adds a genuinely useful feature on top of that baseline: an auto-reboot timer that forces this full-password state automatically if the phone sits locked and unused for too long, so a lost or stolen phone doesn't sit in an always-fingerprint-unlockable state indefinitely. The practical result, and the whole point of this guide's title promise: set a long, strong password once, rely on your fingerprint for almost every real unlock, and only type the long one out after a reboot — which, for most people, is rare.
What do you actually get for an afternoon's effort?
Four things, restated plainly rather than left as marketing buzzwords. Verified boot means tampered software refuses to run, full stop. The hardened memory allocator — a rewritten piece of the operating system's low-level plumbing — closes off the specific memory-corruption bugs that a large share of real phone-hacking tools depend on. App sandboxing boxes every app in more tightly than stock Android does, so a compromised app has a harder time reaching into anything else on the phone. And the USB-C port itself refuses new connections the moment the phone is locked, at both the hardware and software level — which is the direct, deliberate defence against the class of forensic USB extraction tools that started this whole series.
None of that requires you to think about it again after today. That's the actual pitch: an afternoon of setup, then it just runs.
Where to next?
This is the first of three guides. The second covers hardening a Windows machine against the same category of physical and state access — BitLocker, a pre-boot PIN, and locking down the BIOS itself. The third covers choosing a password manager to actually hold the recovery keys and backup codes both guides generate along the way. The privacy technology archive collects all three as they publish.
