Table of Contents
Critical Prerequisites
Read this section carefully. Skipping it can lead to a blocked installation.
A. Hardware Requirements
GrapheneOS is developed exclusively for Google Pixel devices. This is not due to favoritism, but security: Pixels contain the Titan security chip and allow for "Verified Boot" with custom keys, a feature most other manufacturers lack.
- Pixel 6, 6 Pro, 6a
- Pixel 7, 7 Pro, 7a
- Pixel 8, 8 Pro, 8a
- Pixel 9, 9 Pro, 9 Pro XL, 9 Pro Fold
- Pixel Fold & Pixel Tablet
You must use a high-quality USB-C cable. If your computer does not have a USB-C port, a high-quality USB-A to USB-C cable works.
Tip: Avoid using the front USB ports on a desktop PC case; use the rear ports directly on the motherboard to avoid connection dropouts.
CRITICAL: Avoid Carrier Models
Do NOT buy your Pixel from Verizon, AT&T, or T-Mobile. These are "Carrier Locked" models. They permanently disable the ability to unlock the bootloader, making GrapheneOS installation impossible. You must purchase an "Unlocked" or "OEM Unlocked" model directly from Google or a generic retailer.
B. Device Preparation
Before we can wipe the stock Android OS, we need to tell it to allow modifications. This is done inside the settings of the phone.
-
1
Update the Stock OS
Connect the phone to Wi-Fi and perform a standard system update. This ensures the firmware (radio, bluetooth, etc.) is the latest version before we overwrite the OS. You do not need to sign in to a Google Account.
-
2
Enable Developer Mode
Go to Settings > About Phone. Scroll down to Build Number. Tap it repeatedly (7 times) until a toast message appears saying "You are now a developer".
-
3
Enable OEM Unlocking
Go back to the main settings menu. Go to System > Developer Options. Find the toggle for OEM Unlocking and enable it. You will be asked to confirm.
Troubleshooting: If the OEM Unlocking toggle is greyed out, connect the phone to the internet and wait a few minutes. The phone needs to "call home" to Google's servers to verify it isn't a carrier-locked unit.
The Web Installer (Recommended)
The easiest, most secure way to install. Runs entirely in your browser.
Browser Requirement
You must use a browser that supports WebUSB. Chrome, Brave, Edge, or Chromium are recommended. Firefox and Safari will not work.
It limits storage space needed for the image.
Step 1: Boot into Fastboot Mode
With your phone turned OFF, press and hold the Volume Down and Power buttons simultaneously.
Keep holding until you see a screen with a red warning triangle or an Android robot lying down. It should say "Fastboot Mode" in red text.
Now, connect your phone to your computer via USB.
Step 2: Connect to the Installer
On your computer, navigate to the official installer: grapheneos.org/install/web
Click the button that says "Unlock Bootloader" on the website. A browser prompt will appear asking for permission to connect to your device (it might be listed as "Android" or "Pixel"). Select it and click Connect.
Step 3: Unlock the Bootloader
After clicking the button on the website, look at your phone screen. It will change to a warning screen about unlocking the bootloader.
- Press the Volume Keys to scroll the selection to "Unlock the bootloader".
- Press the Power Button to confirm.
- The phone will wipe all data and reboot back into Fastboot mode.
Step 4: Download and Flash
Back on the website, the "Download Release" button should now be clickable.
- Click Download Release. Wait for the factory image to download (approx 1-2 GB).
- Once downloaded, click Flash Release.
- Your phone will reboot automatically into "Userspace Fastboot" (you might see a small GrapheneOS logo).
- DO NOT TOUCH THE CABLE. The process involves flashing radio, bootloader, and system partitions. It will reboot multiple times.
Step 5: Lock the Bootloader (Crucial)
Once the flashing reaches 100% and says "Flashed successfully", verify your phone is back at the bootloader screen. The "Lock Bootloader" button on the website will be active.
- Click Lock Bootloader on the website.
- Look at your phone. Use Volume keys to select "Lock the bootloader".
- Press Power to confirm.
Congratulations! You can now press "Start" on your phone to boot into GrapheneOS.
The CLI Installer (Advanced)
For Linux users or those who prefer total control via command line.
A. Setting up the Environment
You need the fastboot tool. GrapheneOS requires a very recent version (35.0.1 or higher). Most Linux distros package outdated versions.
# Verify version is 35.0.1+
fastboot --version
If your distro provides an old version, download the standalone platform-tools from Google, extract them, and add them to your PATH.
B. Download Factory Images
Go to grapheneos.org/releases. Find your device codename (e.g., Pixel 7 is 'panther'). Download the Factory Image ZIP file.
cd panther-factory-2024010100
C. The Flashing Process
Boot your phone into Fastboot mode (Volume Down + Power) and connect it.
fastboot flashing unlock
Confirm on device screen.
./flash-all.sh
Wait for the script to finish and the device to reboot into bootloader.
fastboot flashing lock
Confirm on device screen.
Post-Install Verification
Ensure your device is secure before setting it up.
1. The "Yellow Screen"
When you boot your phone, you will see a warning screen saying "Your device is loading a different operating system". This is normal.
It indicates that a custom OS key is verified. If you see a RED warning ("Your device is corrupt"), something went wrong. Yellow is good.
2. Disable OEM Unlocking
Once you boot into GrapheneOS and finish the setup wizard:
- Go to Settings > System > Developer Options.
- Uncheck OEM Unlocking.
This prevents a thief from unlocking your bootloader and flashing a new OS to bypass your data protection.
App Ecosystem Setup
Choosing how you get your apps: Sandboxed Play vs. F-Droid.
Option A: Sandboxed Google Play
Recommended for most usersGrapheneOS has a unique feature: it can run Google Play Services as a completely normal, non-root app. This gives you 99% app compatibility (Uber, Banking, Push Notifications) without giving Google system-level access to your data.
- Open the app called "Apps" pre-installed on your phone.
- Tap "Google Play Services" -> Install.
- Tap "Google Play Store" -> Install.
- Tap "Google Services Framework" -> Install.
- Once installed, open the Play Store and sign in (or don't, updates still work for some apps).
Option B: F-Droid & Aurora
For Privacy PuristsIf you want absolutely zero Google connections, use F-Droid repositories.
-
1
Droid-ify (F-Droid Client) The standard F-Droid app is slow. We recommend downloading "Droid-ify" or "Neo Store" from GitHub for a modern interface to FOSS apps.
-
2
Aurora Store This is an anonymous frontend for the Google Play Store. It lets you download Play Store apps without a Google account. Note: Paid apps often don't work here.
Advanced Hardening
Configure GrapheneOS exclusive features for maximum privacy.
Storage Scopes
Normally, giving an app "Storage" permission gives it access to everything. With Storage Scopes, the app sees an empty dummy folder. You can manually select specific files or folders to "leak" to the app.
Network Toggle
GrapheneOS allows you to completely cut internet access for specific apps. Great for offline music players, keyboards, or PDF readers that have no business being online.
PIN Scrambling
Moves the numbers around on your PIN entry screen every time you unlock. This prevents someone from guessing your PIN by looking at the smudge marks on your screen.
Auto-Reboot
Encryption keys are stored in memory while the phone is ON. GrapheneOS can automatically reboot (wiping keys from memory) if the phone hasn't been unlocked for a set time (e.g., 18 hours).
You are now secure.
Your device is now running the most secure mobile operating system available. Remember to keep your OS and apps updated.
