Setting Up GrapheneOS.

Why GrapheneOS Matters.

Your phone is the most intimate surveillance device you own. It knows where you sleep, who you talk to, what you search, what you buy, and where you go — every single day. Stock Android and iOS are designed to harvest this data at scale. GrapheneOS exists to break that cycle.

GrapheneOS is a security-hardened, privacy-focused mobile operating system built on the Android Open Source Project. It strips out Google’s embedded tracking, hardens memory allocation, adds per-app network and sensor controls, and gives you granular authority over what every application on your device can see, touch, and transmit. It runs exclusively on Google Pixel hardware — the only consumer phones with the verified boot chain and hardware security modules that GrapheneOS requires.

This guide assumes your OS is already installed. If you need installation instructions, the official GrapheneOS web installer at grapheneos.org/install/web is the recommended method. What follows is everything that happens after you see the setup screen for the first time.

The First Five Minutes.

When your freshly installed GrapheneOS boots for the first time, resist the urge to rush. These initial decisions set the security posture of your device for the long term.

Language & Region

Select your language and region. Nothing unusual here. Move on.

Wi-Fi Connection

Connect to a trusted network — ideally your home Wi-Fi behind a VPN-enabled router. If your threat model is elevated, consider performing initial setup on a network that is not associated with your identity. Do not insert a SIM card yet if you want to minimize carrier-level identity association during setup.

Set a Strong PIN or Password

GrapheneOS does not offer pattern unlock — it is considered insecure. Use a 6-digit random PIN at minimum if you trust the Pixel’s secure element throttling (which limits brute-force attempts), or a longer alphanumeric password if your threat model demands it. The secure element enforces exponentially increasing delays between failed attempts, making even a 6-digit PIN extremely resistant to brute force.

Disable OEM Unlocking

On the final setup screen, GrapheneOS presents a toggle to disable OEM unlocking. Leave this checked. With the bootloader locked and OEM unlocking disabled, nobody can flash a modified OS onto your device without a full factory reset — which wipes all data. This is a critical physical security control.

Essential Security Settings.

GrapheneOS ships secure by default, but several settings should be reviewed and tightened depending on your needs. These are the high-value adjustments.

PIN Scrambling

Navigate to Settings → Security → PIN scrambling. This randomizes the position of numbers on the PIN entry screen each time you unlock. It defeats shoulder-surfing attacks and prevents smudge pattern analysis on your screen. Enable it.

Auto-Reboot Timer

Under Settings → Security → Auto reboot, set the device to automatically reboot if it has not been unlocked within a defined period. When a phone reboots, it enters the “Before First Unlock” (BFU) state — the most secure state the device can be in. All user data is encrypted and inaccessible until the PIN is entered. A setting of 4–8 hours is a strong default. If your device is seized while powered on but locked, BFU state makes forensic extraction dramatically harder.

USB Configuration

Set USB mode to “Charging-only when locked” or disable USB peripherals entirely under Settings → Security. This prevents data extraction, juice-jacking attacks, and unauthorized accessory connections when your device is in a locked state.

Lockdown Mode

Lockdown mode is always available on GrapheneOS. Press and hold the power button, then tap “Lockdown.” This instantly disables biometric unlocking, hides notifications on the lock screen, and requires your PIN or password to access the device. Use it before border crossings, police encounters, or any situation where you might be compelled to unlock with a fingerprint.

Sensors Off Toggle

Add the “Sensors Off” tile to your Quick Settings panel. One tap disables the camera, microphone, and GPS sensors at the hardware level. This is your physical kill switch for the three most sensitive data collection vectors on any mobile device.

Network & Privacy Controls.

GrapheneOS provides network-level controls that stock Android does not expose. These are critical for controlling which apps can communicate and how.

Per-App Network Permission

Every app on GrapheneOS can be individually denied network access. Navigate to Settings → Apps → [App Name] → Permissions and toggle the Network permission. An offline calculator, note-taking app, or file manager has no business phoning home. Deny network access to anything that does not require it to function.

Wi-Fi Privacy

Disable “Turn on Wi-Fi automatically” under Network settings. Your phone should not be broadcasting probe requests for known networks as you move through the world — this is a tracking vector. Connect manually when you need Wi-Fi, and disconnect when you are done.

VPN Configuration

If you run a VPN, enable the “Block connections without VPN” kill switch under Settings → Network → VPN → [Your VPN] → Always-on VPN. This ensures no traffic leaks outside the encrypted tunnel, even during VPN reconnection. Note that VPN configurations are profile-specific — each user profile on the device maintains its own independent VPN settings.

Storage Scopes & Contact Scopes.

These are two of GrapheneOS’s most powerful and unique features. They give you precise control over what data each app can access — without breaking the app.

Storage Scopes

When an app requests broad file access (“Files and media” or “Photos and videos”), GrapheneOS lets you enable Storage Scopes instead. The app believes it has full access, but in reality it can only see files it created itself. If you want it to see a specific folder — say, a “Wallpapers” directory for a gallery app — you manually add that folder to the scope.

To enable: go to Settings → Apps → [App Name] → Permissions. If the app has requested storage access, you will see the option to “Add storage scope.” Use this for every app that does not genuinely need access to your full file system — social media apps, messaging apps, and media players are prime candidates.

Contact Scopes

The stock Android Contacts permission is all-or-nothing: an app either sees every contact or none. GrapheneOS adds Contact Scopes, which lets you selectively expose specific contacts to specific apps. A messaging app can see the five people you actually message, and nothing else. This is particularly valuable for apps like WhatsApp, Signal, or Telegram that aggressively request full contact access.

The Multi-Profile Strategy.

User profiles on GrapheneOS provide full process isolation and encryption at rest. Each profile is essentially a separate encrypted container. Apps in one profile cannot see, access, or interact with apps or data in another profile. This is one of the most underused and most powerful features available to you.

How Profiles Work

When you switch away from a profile and use the “End Session” option in the power menu, that profile’s data is fully encrypted until you re-enter the password. A seized device in this state reveals nothing about that profile’s contents. Each profile also maintains its own independent app installations, permissions, VPN settings, and network configurations.

To create profiles, go to Settings → System → Multiple Users. You can push apps installed on the Owner profile to secondary profiles without re-downloading them. Each profile should have its own strong PIN or password.

Where to Get Your Apps.

One of the most visible differences from stock Android or iOS is how you install apps. GrapheneOS does not come with the Google Play Store. You have multiple sources, each with different trade-offs. Understanding these trade-offs is part of operating with intention.

Recommended Order of Operations

Search for your app in this order: GrapheneOS App Store → Accrescent → Obtainium (GitHub) → Sandboxed Google Play → Aurora Store. Use the highest-trust source available for each app. Prioritize apps signed with the original developer’s keys over those re-signed by a third-party store.

Installing Sandboxed Google Play

If you need apps that depend on Google Play Services — banking apps, ride-sharing, push notifications — open the built-in Apps application and install Google Play Services, Google Services Framework, and Google Play Store. These run as regular sandboxed apps with no special system privileges. You control their permissions exactly as you would any other app.

For maximum isolation, install Sandboxed Google Play only in the profile that needs it. Do not install it in your Owner profile if you are running a multi-profile setup.

Obtainium — Direct-From-Source App Management.

Obtainium eliminates the app store middleman entirely. It monitors developer repositories on GitHub, GitLab, or custom URLs, detects new releases, downloads the correct APK for your device architecture, and installs it. Updates arrive the moment the developer publishes them — no store review delays.

Configuration

For each app, paste the GitHub repository URL (e.g., https://github.com/nicehash/obtainium) into Obtainium. Set version detection to “Latest Release.” If the developer publishes multiple APK variants, use the Regex filter to match only arm64 builds — which is correct for all modern Pixels.

Enable background update checks at 12–24 hour intervals to minimize battery drain and network noise.

Making Apps Work.

Most Android apps work on GrapheneOS without modification. The exceptions tend to be apps with aggressive anti-tampering checks — primarily banking and financial apps. Here is how to handle them.

Banking Apps

Many banking apps require Google Play Services to be installed in the same profile. Some may require you to disable exploit protection mitigations for that specific app: long-press the app icon, tap “App info,” then look under compatibility settings. This is a per-app toggle and does not weaken system-wide security. Check the GrapheneOS community banking compatibility list for your specific bank before assuming an app will not work.

Push Notifications

Apps that use Google’s Firebase Cloud Messaging for push notifications need Sandboxed Google Play running in the same profile to receive them. If you disable or uninstall Play Services, those apps will not receive push notifications — they may fall back to polling, or simply go silent. Keep Play Services installed and running in any profile where you need real-time notifications.

Apps That Will Not Work

Google Wallet (contactless payments) does not function on GrapheneOS because Google refuses to certify non-stock operating systems for NFC payments. There is no workaround. Plan accordingly — carry a physical card.

Anonymous Account Provisioning.

If you choose to install Sandboxed Google Play, you will need a Google account. For privacy-conscious users, this account should have zero links to your real-world identity.

Creating an Anonymous Google Account

Standard VPN and Tor connections are often flagged during Google account creation. A more reliable approach is to create the account from a public Wi-Fi network — a coffee shop, library, or grocery store — using a device that is not associated with your identity. Use a fake name generator for the required personal information fields.

Phone Verification

Google may require SMS verification. Standard VOIP numbers are frequently rejected. Privacy-focused SMS rental services maintain pools of physical SIM cards from real carriers. These numbers bypass VOIP filters. If you use such a service, pay with cryptocurrency to break the financial link. Once the account is verified, immediately set up TOTP-based two-factor authentication (via an authenticator app) and generate backup codes. Then remove the phone number from the account entirely.

Recommended FOSS Replacements.

Every proprietary app has a free and open-source alternative. These are the high-reliability replacements that cover most daily-use categories.

Ongoing Security Hygiene.

Configuration is not a one-time event. GrapheneOS requires a periodic maintenance cycle to stay hardened.

Sovereignty Starts in Your Pocket.

A phone running GrapheneOS is not a perfect shield — no device is. But it is the most capable tool available for reclaiming control over your digital life. Every permission denied, every profile isolated, every tracker-heavy app sandboxed represents a deliberate choice about who gets access to your data and who does not.

The configuration described in this guide ranges from a five-minute quick setup (strong PIN, disable OEM unlocking, install your apps) to a fully compartmentalized multi-profile architecture with anonymous accounts and direct-from-source app management. Where you land on that spectrum depends on your threat model. Start where you are. Tighten as you learn. The important thing is that you have started.