Install GrapheneOS on a Pixel

Is it for you?

• It wipes the phone. Back up first.
• There are no Google apps by default. You can add Google Play as a normal, sandboxed app if you need it.
• Google’s tap-to-pay wallet won’t work. Some banking apps may refuse to run.
• You get fast security updates and strong privacy controls.

Pick the right Pixel

GrapheneOS supports Pixel 6 and newer, including the Pixel Fold and Pixel Tablet.

1. Buying new? Pick a Pixel 8 or newer, including the “a” models. They get 7 years of updates from launch.
2. Avoid the Pixel 6 and 6 Pro now. Their support ends in October 2026.
3. Buy an unlocked phone, not one from a phone carrier. Carrier phones, mostly in the US, often can’t be unlocked.

Skip sellers offering phones with GrapheneOS pre-installed. The project recommends installing it yourself.

Prepare the phone

1. Back up anything you want to keep. Everything will be erased.
2. Install the latest update for the phone’s current system.
3. Charge it to at least half.

Prepare the computer

1. Update your computer and browser.
2. Use a normal browser window. Not incognito or private mode.
3. Don’t use a virtual machine, a Snap or Flatpak browser, or a USB hub.
4. On Brave, turn off Shields for the installer page.

# stop a firmware tool that can grab the phone
sudo systemctl stop fwupd.service

Allow unlocking on the phone

1. Open Settings → About phone. Tap Build number repeatedly until developer mode turns on.
2. Open Settings → System → Developer options. Turn on OEM unlocking.
3. The phone needs internet for this switch to work.

OEM unlocking Permission to unlock the startup lock, so a new system can be installed.

Start the phone in Fastboot mode

1. Turn the phone off.
2. Hold the volume-down button and turn it on. Keep holding.
3. You should see a red warning triangle and the words Fastboot Mode.
4. Don’t press the power button to “Start”. Leave it on this screen.

Connect and unlock

1. Type grapheneos.org/install/web into your browser yourself. Don’t trust links to other installers.
2. Plug the phone into the computer.
3. Click Unlock bootloader. Pick the phone in the browser pop-up.
4. On the phone, use the volume buttons to choose to unlock. Press power to confirm. This erases the phone.

Download and install

1. Click Download release and wait.
2. Click Flash release.
3. Don’t touch the phone until the page says it is done. It restarts by itself several times.
4. If the page loses the phone, click Reconnect device.

Lock the bootloader

1. Click Lock bootloader.
2. On the phone, choose to lock with the volume buttons. Press power to confirm. This erases it once more, which is fine.

Don’t skip this. Locking turns on the checks that stop anyone from changing the system behind your back.

Start it and check it’s genuine

1. Press power to choose Start.
2. A yellow screen says the phone runs a different system. It shows a long ID code. This yellow notice is normal: it means the bootloader is locked and running a system that isn’t Google’s. An orange screen would mean it is still unlocked.
3. Compare that code with the one for your model on the official install page. They must match exactly.
4. In the setup screens, leave the “OEM unlocking” box ticked on the last page. That turns the switch off again.

Have a second Android phone? GrapheneOS’s Auditor app can check the install with hardware proof.

Basic hardening

Find each setting by typing its name into the search box in Settings.

1. Set a random PIN of 6 digits or more. Turn on PIN scrambling.
2. Want fingerprint unlock? Turn on the option to also ask for a PIN after the fingerprint.
3. Check Auto reboot. It restarts a locked phone after 18 hours by default. Shorter is stricter.
4. Keep USB-C port on “Charging-only when locked” or stricter.
5. For each app, turn off the Network and Sensors permissions it doesn’t need.
6. Only add Google Play if an app needs it. Consider a separate user profile for those apps.

Duress PIN wipes everything. GrapheneOS can set a PIN that erases the phone. Only use it if you understand that.

Day to day

1. Updates install by themselves. Restart when asked.
2. Install apps from the GrapheneOS App Store or the app maker’s official source.
3. Never unlock the bootloader again unless you are reinstalling.