Installing GrapheneOS on Your Pixel.

Why Replace Your Phone’s Operating System.

Every smartphone ships with an operating system designed to collect your data. Stock Android, the software Google installs on every Pixel device, reports your location, app usage, browsing habits, and device interactions back to Google’s servers — often every few minutes. This is not a bug. It is the business model.

GrapheneOS is a different operating system entirely. Built on the same open-source Android foundation but stripped of Google’s surveillance infrastructure, GrapheneOS gives you a phone that works like you expect a phone to work — without constantly reporting your life to a corporation.

The process of replacing your phone’s operating system is called “flashing.” It sounds technical, but the GrapheneOS team has built a web-based installer that handles everything for you. If you can follow instructions and plug in a USB cable, you can do this.

What You Need Before Starting.

Before you begin, gather everything required. A failed installation is almost always caused by a bad cable, an incompatible browser, or a phone that has not been properly prepared. Eliminate these variables first.

Why Only Pixel Devices?

GrapheneOS only supports Google Pixel phones — and this is intentional, not a limitation. Pixel devices include hardware security features that most Android phones lack: a dedicated Titan M2 security chip, hardware-backed verified boot, and a secure element for encryption key storage. Without these features, many of GrapheneOS’s security enhancements simply would not work.

The irony is not lost on anyone: the most private mobile operating system runs exclusively on Google hardware. But the Pixel line is the only Android hardware built to the security standard GrapheneOS requires.

Supported Devices (2026)

For the current device support list, check grapheneos.org.

Understanding the Terminology.

Before you begin the installation, you need to understand a few key concepts. These terms will appear throughout the process, and knowing what they mean will help you understand what is happening at each step.

Preparing Your Phone and Computer.

Proper preparation is the difference between a smooth installation and a frustrating troubleshooting session. Complete every step in this section before moving forward.

Step 1: Back Up Everything

The installation process will erase all data on your phone. This is not optional — it is a security feature built into the bootloader unlocking process. Before you begin:

• Photos and videos: Transfer to your computer or an external drive
• Contacts: Export to a VCF file or sync to a service you control
• Two-factor authentication codes: Screenshot or export your 2FA backup codes — losing these can lock you out of accounts
• App data: Note any apps with important data that does not sync to the cloud
• Passwords: Ensure your password manager is backed up and accessible from another device

Step 2: Update Stock Android

Before installing GrapheneOS, update your Pixel to the latest version of stock Android. This ensures the firmware (the low-level software that controls hardware) is current. GrapheneOS builds on top of this firmware.

Go to Settings → System → System Update and install any available updates. Restart your phone after updating.

Step 3: Enable Developer Options

Developer Options is a hidden settings menu that gives you access to advanced features, including the ability to unlock the bootloader.

• Go to Settings → About Phone
• Find Build Number at the bottom
• Tap it seven times — you will see a countdown and then a message saying “You are now a developer!”

Step 4: Enable OEM Unlocking

This is the switch that authorizes bootloader unlocking. Without it, the installation cannot proceed.

• Go to Settings → System → Developer Options
• Toggle OEM Unlocking to ON
• Your phone must be connected to Wi-Fi — Google needs to verify the device is not stolen before allowing this toggle

Step 5: Prepare Your Computer

Windows users: Download and install the Google USB Driver. Extract the ZIP file, right-click android_winusb.inf, and select “Install.”

Linux users: Install the Android platform tools to get proper USB device permissions. In terminal, run: sudo apt install android-sdk-platform-tools-common and then restart your computer.

macOS and ChromeOS users: No additional drivers needed. Ensure you are using a Chromium-based browser.

Installing GrapheneOS.

With preparation complete, you are ready for the installation itself. The entire process takes approximately 15–20 minutes and uses the official GrapheneOS Web Installer, which handles the technical details automatically.

Step 1: Enter Fastboot Mode

First, you need to put your phone into Fastboot Mode — the low-level state that allows direct communication with a computer.

• Power off your phone completely
• Press and hold Volume Down + Power simultaneously
• Keep holding until you see the Fastboot screen — a large arrow icon with the word “Start” and a small Android robot lying on its back

Step 2: Connect to Computer

With your phone in Fastboot Mode, connect it to your computer using your USB-C cable. For best results:

• Use a USB-C port directly on your computer — avoid USB hubs
• On a laptop, use the ports built into the machine, not a docking station
• On a desktop, use the rear motherboard ports, not front panel ports

Step 3: Open the Web Installer

Navigate to the official installer at grapheneos.org/install/web in your Chromium-based browser.

Click “Connect to Device” and select your Pixel from the popup. Your browser is now communicating directly with your phone’s bootloader.

Step 4: Unlock the Bootloader

On the web installer page, click “Unlock Bootloader.”

Look at your phone screen. You will see a confirmation prompt. Use the volume buttons to highlight “Unlock the bootloader” and press the Power button to confirm.

Your phone will remain in Fastboot Mode after confirming. The unlock destroys the existing encryption keys — effectively wiping your data — but you will not see a visible reboot or reset at this stage. The phone stays connected and ready for the next step.

Step 5: Download GrapheneOS

On the web installer, click “Download Release.” The installer will automatically detect your Pixel model and download the correct GrapheneOS build. This is approximately 2GB and may take several minutes depending on your internet speed.

Step 6: Flash GrapheneOS

Once the download completes, click “Flash Release.”

This is the actual installation — and this is where the visible action happens. The installer writes the firmware first, then the phone reboots back into the bootloader interface, and then the operating system is flashed. Your phone will reboot multiple times during this process. Do not touch the device — the installer handles everything automatically.

Step 7: Lock the Bootloader

This is the most important security step. After flashing completes and your phone returns to Fastboot Mode, click “Lock Bootloader” on the web installer.

Look at your phone screen. Use the volume buttons to select “Lock the bootloader” and press Power to confirm. Locking will trigger another data wipe — this is expected and ensures a clean state.

Locking the bootloader re-enables Verified Boot, which ensures your operating system cannot be tampered with. This is critical for security. Most custom Android ROMs do not support re-locking — GrapheneOS does.

Step 8: First Boot

Your phone will now boot into GrapheneOS for the first time. You will see a yellow or orange warning screen during boot — this is normal and expected. It indicates the phone is running a “custom” operating system with a different security key than Google’s.

Complete the setup wizard just as you would with any new phone. GrapheneOS will ask for language, Wi-Fi, and basic preferences.

Post-Installation Setup.

With GrapheneOS installed, your phone is now running a privacy-focused operating system. But there are a few more steps to lock down the device and configure it for daily use.

Disable OEM Unlocking

Now that GrapheneOS is installed and the bootloader is locked, you should disable the OEM Unlocking toggle. This adds another layer of protection — even if someone gets physical access to your phone, they cannot easily unlock the bootloader to tamper with it.

• Go to Settings → System → Developer Options
• Toggle OEM Unlocking to OFF
• Optionally, disable Developer Options entirely by toggling the main switch at the top

Set a Strong PIN or Password

Your PIN or password protects the encryption keys that secure your data. GrapheneOS encrypts your entire device by default, but the strength of that encryption depends on the complexity of your unlock credential.

• Use at least a 6-digit PIN (preferably longer)
• A passphrase is more secure than a PIN if you are comfortable typing it
• Enable PIN scrambling in security settings — this randomizes the PIN pad layout to prevent shoulder surfing and screen smudge attacks

Configure Auto Reboot

One of GrapheneOS’s most powerful security features is the auto reboot timer. When your phone has not been unlocked for a set period, it automatically restarts and returns to the most secure state — Before First Unlock (BFU).

In BFU, your encryption keys are not loaded into memory, making data extraction essentially impossible. This is the single most effective defence against physical device seizure.

• Go to Settings → Security → Auto Reboot
• Set a timeout (12–72 hours depending on your threat model)
• The default of 18 hours is reasonable for most users

Install Sandboxed Google Play (Optional)

GrapheneOS does not include Google services by default. However, many apps — banking apps, rideshare services, some navigation tools — require Google Play Services to function.

GrapheneOS offers a unique solution: sandboxed Google Play. This runs Google’s services as a regular app with no special privileges, not as a system-level component with unrestricted access to your device.

• Open the Apps app (pre-installed)
• Select Google Play Services and tap Install
• Optionally install Google Play Store if you want access to the Play Store

Even with sandboxed Play installed, Google cannot access your location, contacts, or files unless you explicitly grant those permissions — unlike stock Android, where Google Play Services has system-level access by default.

Common Issues and Solutions.

Most installation problems come from a handful of predictable causes. Before seeking help, check this troubleshooting matrix.

If you encounter an issue not covered here, the official GrapheneOS documentation at grapheneos.org includes detailed troubleshooting guides. The project also maintains an active community on Matrix and a forum for technical support.

What Changes After Installation.

GrapheneOS looks and feels like Android — because it is Android. The difference is under the surface. Here is what changes and what stays the same.

What Works the Same

Your phone still makes calls, sends texts, connects to Wi-Fi, takes photos, and runs apps. Most apps from the Play Store work fine with sandboxed Google Play installed. The user experience is nearly identical to stock Android — the surveillance architecture is simply removed.

What May Require Adjustment

Some apps that depend heavily on Google services may have reduced functionality or require additional configuration. Banking apps are a common friction point — most work, but some may need you to install sandboxed Play first. Navigation apps that rely on Google Maps backend will need Google Play Services or an alternative like Organic Maps (fully offline, privacy-respecting).

Your Phone Is Now Under Your Control.

Congratulations. You have successfully replaced your phone’s surveillance-oriented operating system with one designed to respect your privacy. The device in your pocket no longer reports your every move to Google’s servers. It no longer grants backdoor access to your data. It operates the way you assumed your phone worked all along — but never did.

This is not the end of the process. It is the beginning. From here, you can explore GrapheneOS’s advanced features — multiple user profiles for compartmentalized activities, storage scopes for granular file access control, network toggles to block apps from the internet entirely, and automatic reboot to maintain the highest security posture.

The official documentation at grapheneos.org covers all of these features in depth. Bookmark it. Reference it. The GrapheneOS project is actively developed and regularly updated — your phone will receive security patches automatically, often faster than stock Android devices.

GrapheneOS → grapheneos.org Web Installer → grapheneos.org/install/web