Knowledge Base > Privacy & Self-Hosting > Installing GrapheneOS

How to Install GrapheneOS on Google Pixel

Privacy & Self-Hosting December 26, 2025

Take back your privacy without sacrificing functionality

This guide walks you through the entire installation process for GrapheneOS on a Google Pixel phone. While the Pixel 9a is used as the example here, this process works identically for all supported Pixel devices (Pixel 9, 9 Pro, 9 Pro XL, 9 Pro Fold, and older supported models).

Why GrapheneOS Over Stock Android or iOS?

This is not marketing hype. This is verifiable fact based on the official documentation at grapheneos.org/features.

What GrapheneOS Eliminates by Default

  • No Google Play Services integrated into the OS (you can optionally install them as sandboxed apps)
  • No Google apps or services running by default
  • No telemetry or data collection from the OS itself
  • No persistent device identifiers leaked to apps
  • No location data sent to Google for network-based location

What Stock Android/iOS Do by Default

  • Stock Android: Google Play Services has privileged system access and collects usage data, location history, and app activity
  • iOS: Apple services collect usage analytics, Siri requests, location data, and App Store activity
  • Both: Regular OS updates that may change privacy policies or add new data collection
Carrier Tracking

GrapheneOS protects your privacy from apps and services, but your phone carrier can still track your location through cell tower connections. That is unavoidable with any phone using cellular service. GrapheneOS does not fix that, but it does eliminate the additional tracking layers from Google, Apple, app developers, and advertisers.

Security Improvements

  • Hardened memory allocator that prevents common exploit techniques
  • Sandboxed Google Play (if you install it) with no special system privileges
  • Hardware memory tagging on supported devices
  • Network permission toggle (disable internet access per-app)
  • Sensors permission toggle (block accelerometer, gyroscope, etc.)
  • Storage Scopes and Contact Scopes (granular permission control)
  • Auto-reboot feature (puts device back to encrypted state after set time)

What About Google Services?

You can install Google Play Services on GrapheneOS through their sandboxed implementation. This is not a workaround or Terms of Service violation. It is an officially supported feature documented at grapheneos.org/usage.

The catch: You still need a Google account and phone number to use Google Play Services. GrapheneOS does not bypass that requirement. It just runs Play Services as a regular sandboxed app instead of giving it privileged system access.

Many apps work fine without Google Play Services. Some do not. You decide which apps you need and whether you want to install sandboxed Play for them.

What This Guide Covers

  • Installation using the official GrapheneOS web installer
  • What to expect during the process
  • Basic verification that it worked

This guide does not cover alternative app stores, detailed configuration and hardening, or installing sandboxed Google Play. Those are documented in the GrapheneOS usage guide.

Prerequisites (Read This First)

What You Need

Hardware:

  • A supported Google Pixel phone (check supported devices)
  • USB-C cable (use the one that came with your phone)
  • Computer with at least 2GB RAM and 32GB free storage
  • Direct USB port (avoid hubs, use rear ports on desktops)

Important: Carrier-locked phones may not allow bootloader unlocking. Buy unlocked directly from Google if possible.

Software:

  • Windows 10/11, macOS (Sonoma or newer), or Linux (Ubuntu, Debian, Arch)
  • Updated web browser: Chrome, Edge, Brave, or Chromium
  • Do NOT use Incognito/Private browsing mode
  • Do NOT use Flatpak or Snap browser versions

Before You Start

  1. BACKUP EVERYTHING. This process wipes your phone completely.
  2. Charge your phone to at least 80%
  3. Update to the latest stock Android version
  4. Have 1-2 hours available (actual install is 30 minutes, but budget extra time)
What Gets Wiped

Installing GrapheneOS will erase: all apps and app data, all photos and videos (unless backed up), all contacts (unless synced to another service), all messages and call history, all accounts and passwords stored on device. Everything. Back up what matters.

Installation Process

Step 1: Enable OEM Unlocking

On your Pixel running stock Android:

  1. Go to Settings > About phone
  2. Tap Build number 7 times to enable Developer Options
  3. Go to Settings > System > Developer options
  4. Toggle on OEM unlocking
  • This requires an internet connection for verification
  • If it is grayed out, your device may be carrier locked

Step 2: Set Up Your Computer

Linux users only:

  • Arch: Install android-udev package
  • Debian/Ubuntu: Install android-sdk-platform-tools-common package
  • Stop fwupd if running: sudo systemctl stop fwupd.service

Windows users: Windows 10/11 includes the driver by default. If needed, Windows Update will detect it as an optional update when the phone is connected.

Step 3: Boot Into Bootloader

  1. Power off your Pixel completely
  2. Hold Volume Down button
  3. While holding Volume Down, press Power button
  4. Keep holding Volume Down until you see "Fastboot Mode" with a red warning triangle
  5. Do NOT press power to select "Start" - stay in Fastboot Mode

Step 4: Run the Web Installer

  1. Go to grapheneos.org/install/web in your browser
  2. Connect your phone to your computer with the USB-C cable
  3. Click "Unlock bootloader" button in the web installer
  4. On your phone: Use volume buttons to select "Unlock" and power button to confirm. This wipes all data on the phone.
  5. Click "Download release" button. This downloads about 2GB, be patient.
  6. Click "Flash release" button. The phone will automatically flash firmware, reboot, and install GrapheneOS. Do NOT touch the phone during this process.
  7. Click "Lock bootloader" button. Use volume buttons to select "Lock" and power button to confirm. This wipes data again (security feature).
  8. Phone will reboot into GrapheneOS

The entire flashing process takes about 15-30 minutes. Let it finish completely.

Verification

Visual Verification

When you boot GrapheneOS for the first time:

  1. You will see a yellow warning screen showing the verified boot key hash
  2. Verify this matches the official hash at grapheneos.org/install/web#verified-boot-key-hash

Using Auditor App

For stronger verification:

  1. Install Auditor app from GrapheneOS app store on your newly installed phone
  2. Install Auditor on a second Android device (or use attestation.app)
  3. Follow the tutorial at attestation.app/tutorial
  4. This verifies the hardware, firmware, and OS are genuine

First Boot and Setup

During initial setup:

  1. Set your language and region
  2. Connect to Wi-Fi (or skip and use mobile data)
  3. Set screen lock (PIN, password, or pattern). GrapheneOS supports up to 128 character passwords. Use a strong passphrase if you are serious about security.
  4. Important: On the final setup screen, leave "Disable OEM unlocking" CHECKED. This prevents the bootloader from being unlocked without your permission.

GrapheneOS will ask much less of you than stock Android. No Google account required, no services to opt into, just the basics.

What is Different After Installation

Apps Included by Default

GrapheneOS includes:

  • Vanadium browser (hardened Chromium)
  • GrapheneOS Camera app
  • PDF Viewer
  • Auditor (for device verification)
  • Apps app (GrapheneOS app store)

That is it. Everything else you install yourself.

The Apps App

GrapheneOS includes an app called "Apps" (yes, really). This is their app store and currently only has GrapheneOS first-party apps and sandboxed Google Play (if you choose to install it). For other apps, you will need to install other app stores.

Key Privacy/Security Settings to Know

After installation, check out:

Settings > Security and privacy:

  • Auto reboot (automatically reboots locked phone after set time)
  • Internet permission (disable network access per-app)
  • Sensors permission (block accelerometer, gyroscope per-app)

Settings > Apps:

  • Per-app permissions are much more granular than stock Android
  • Storage Scopes (choose which files/folders apps can access)
  • Contact Scopes (choose which contacts apps can see)

Going Back to Stock Android

If you want to revert to stock Android:

  1. Follow Google's instructions at flash.android.com/back-to-public
  2. Boot to fastboot mode and unlock bootloader
  3. Run: fastboot erase avb_custom_key to remove GrapheneOS verified boot key
  4. Follow Google's web flashing tool

Common Questions

Can I use banking apps?

Some work, some do not. It depends on whether they require Google Play Services and whether they detect the unlocked bootloader during installation (it gets locked afterward). Test the apps you need.

Will I get GrapheneOS updates?

Yes, automatic over-the-air updates just like stock Android. GrapheneOS typically releases updates within days of Google's security patches.

Can I install Google apps?

Yes, through sandboxed Google Play. See grapheneos.org/usage.

Is this legal?

Yes. You own your phone, you can install whatever OS you want.

Will this break my phone?

No. You can always flash back to stock Android. The hardware is unchanged.

Resources

Back to Privacy & Self-Hosting