This guide shows you how to install GrapheneOS on Pixel hardware, plus what the hardening actually buys you once it’s running. GrapheneOS is a hardened Android distribution that runs only on Google Pixel devices. That restriction isn’t brand preference. Pixels are the devices that let you install a third-party OS and then re-lock the bootloader with your own verified boot key. This single property is what separates GrapheneOS from most custom ROMs.

Installing GrapheneOS on a Pixel takes roughly twenty minutes on a supported device. Everything in the walkthrough below follows the project’s official web installer documentation.

Before You Install GrapheneOS on Pixel: What You Need

Device and Software Requirements

Only officially supported Pixels are covered by the project. The published verified boot key hashes currently span the Pixel 6 family through the Pixel 10 family, including the 9a and 10a. Fourth- and fifth-generation Pixels are handled differently, though, and only display the first 32 bits of the boot key hash. As a result, they can’t be verified using the method described later.

You need 2GB of free memory and 32GB of free storage to install GrapheneOS on Pixel from the web installer. It runs on Windows 10 or 11, macOS Sonoma through Tahoe, several mainstream Linux distributions, and ChromeOS. It even runs on an Android phone or tablet, which surprises people who assume a desktop is mandatory.

Avoiding the Most Common Install Failures

Carrier variants cause the most common failure, and it happens before the install even starts. Carrier SKUs ship with a non-zero carrier ID written to the persist partition at the factory. That ID activates carrier configuration in the stock OS, including disabling both carrier unlocking and bootloader unlocking. The carrier may be able to clear it remotely, but support staff often don’t know how. So, buy a carrier-agnostic device instead.

Supported browsers are Chromium, Chrome, Edge, Vanadium, and Brave. Brave needs Shields disabled, because it caps reported storage to resist fingerprinting, and the installer then has too little space to work with. Firefox isn’t supported at all, since it doesn’t implement WebUSB. Several widely shared guides say Chrome or Firefox, and that’s simply wrong.

Avoid Flatpak and Snap browser builds, too. Ubuntu’s Chromium Snap ships with broken WebUSB. Don’t use a private browsing window either, since that usually starves the installer of the storage it needs to extract the release. And don’t install from inside a virtual machine, since USB passthrough is unreliable there.

Use the USB-C cable that came with the device where possible. Connect directly to a rear port on a desktop, or a port on a laptop. Avoid hubs and front-panel ports, since bad cables and hubs are the single most common source of install failures overall.

With prerequisites out of the way, here’s how to install GrapheneOS on Pixel hardware in nine steps.

Steps 1 – 5: Prepare the Device

1. Update the stock OS first. GrapheneOS flashes current firmware early in the process either way, but starting from an updated device avoids connection problems during the early flashing stage.
2. Enable developer options. Go to Settings, then About phone, then tap Build number repeatedly until developer mode enables.
3. Enable OEM unlocking. Go to Settings, System, Developer options, then toggle OEM unlocking. On SKUs that can be sold carrier-locked, this requires internet access so the stock OS can check the device’s status. On the Pixel 6a specifically, OEM unlocking won’t work on factory firmware. Update to the June 2022 release or later over the air, then factory reset before it will function.
4. Linux only: set up USB access. Install android–udev on Arch, or android-sdk-platform-tools-common on Debian and Ubuntu. If you hit an error about the USB device already being claimed, stop the firmware update daemon with sudo systemctl stop fwupd.service. It restarts on reboot, so you aren’t disabling it permanently.
5. Boot into the bootloader. Reboot the device while holding the Volume Down button. This step is complete only when the screen shows a red warning triangle labelled “Fastboot Mode”. Don’t press the power button to select Start, because the device has to stay paused in fastboot for the installer to connect.

Steps 6 – 9: Connect, Flash, and Lock

6. Connect the device. Windows 10 and 11 include a generic fastboot driver adequate for the Pixel 4a 5G and later. If you need it, the driver appears in Windows Update under optional updates, confusingly labelled LeMobile Android Device because of a USB ID overlap. Pixel Tablet users should disconnect the stand first, since the tablet can’t use the stand and the USB port at the same time.
7. Unlock the bootloader from the installer. Confirm on the device using volume to change the selection and power to accept. This wipes all data.
8. Download and flash the release. The installer handles firmware, reboots into the bootloader, and flashes the OS. Don’t touch the device while it runs.
9. Lock the bootloader. This step isn’t optional, and it’s the whole point of the process. Locking enables full verified boot, blocks fastboot from flashing or erasing partitions, and makes the device detect and refuse modified OS partitions. It wipes data again, so do it before you set anything up on the phone.

Verify GrapheneOS Installed Correctly on Your Pixel

Once you install GrapheneOS on Pixel hardware, verification is the step people skip and shouldn’t. Disable OEM unlocking first. The final setup screen has a toggle for this, checked by default. Leave it checked. It can be changed later in developer settings if needed.

From there, two verification mechanisms exist, and they’re the reason this OS is worth the trouble in the first place.

Boot key hash. When running an alternate OS, the device shows a yellow notice at boot containing the SHA-256 of the verified boot public key. Compare it against the hash published for your model on the project’s install page. Sixth-generation Pixels and later show the full hash. This confirms that what you flashed is what the project published, even if the computer you flashed from was compromised.

Hardware attestation. The project’s Auditor app uses the device’s secure element to attest that hardware, firmware, and OS are genuine. Because the point is to learn about the device without trusting it to be honest, results aren’t shown on the device being checked. You need a second Android device running Auditor and a QR code exchange, or the optional monitoring service for scheduled checks with email alerts.

What Installing GrapheneOS on Pixel Actually Buys You

This is where GrapheneOS separates from privacy ROMs generally. Once you install GrapheneOS on Pixel hardware, most of the work is defence against exploitation of unknown vulnerabilities, rather than feature-level privacy toggles.

Verified Boot Survives the Install

Most custom Android ROMs require leaving the bootloader permanently unlocked. That removes verified boot and leaves the device open to persistent compromise. GrapheneOS, in contrast, flashes its own verified boot key into the secure element. Every boot then verifies the full firmware and OS image chain against it, with rollback protection tied to the security patch level. If any OS partition is modified, the device simply refuses to read the modified data. You keep the hardware security model, instead of trading it away for the OS.

Memory Corruption Defences

The project ships its own allocator, hardened_malloc, with fully out-of-line metadata that rules out traditional allocator exploitation. It also adds deterministic detection of invalid frees, plus zero-on-free with write-after-free detection. On top of that come randomised and deterministic quarantines, delaying reuse to blunt use-after-free bugs. Guard pages surround larger allocations and slabs for small ones, alongside random canaries and hardware memory tagging for slab allocations.

The kernel is hardened alongside it, too. That means 4-level page tables on arm64, raising ASLR entropy from 24 to 33 bits. It also means memory tagging in the main kernel allocators, canaries on the kernel heap, and memory zeroed on release in both the page allocator and the slab allocator. Unused memory is also zeroed at early boot to clear anything left from a previous boot, module signing is forced, and the kernel runs in lockdown confidentiality mode.

The practical effect is that whole classes of memory bugs become unexploitable or unreliable, rather than merely unpatched.

Dynamic Code Execution Is Heavily Restricted

The Android runtime’s JIT compiler is disabled entirely, in favour of ahead-of-time compilation. Dynamic code loading is also blocked for nearly the whole base OS, so verified boot and this restriction together prevent OS processes from running attacker-controlled code. For user-installed apps, there are three separate toggles instead, covering code loading from memory, code loading from storage, and WebView JIT. Each one sends a notification when something gets blocked, so you can enable it only for apps that genuinely need it.

Attack Surface Reduction

NFC, Bluetooth, and UWB are off by default. USB and camera access are disabled while the screen is locked. Bluetooth and Wi-Fi, meanwhile, can be set to switch off after a timeout.

The USB-C port control deserves specific mention, because it’s stronger than anything in stock Android. The default mode is charging-only when locked. On locking, it blocks new USB connections immediately at the hardware level, by configuring the USB controller, with the kernel acting as a second layer. It then disables the data lines in hardware once existing connections end. It also disables USB-C alternate modes, including DisplayPort. Android’s standard device-admin USB toggle, by comparison, only disables high-level USB handling in the OS and does none of this. A fifth mode disables charging too, removing the remaining attack surface in the USB-PD stack entirely.

There’s also an LTE-only mode, which cuts out both the legacy 2G and 3G code and the newer 5G code in the cellular baseband stack.

Google Services Become an Ordinary App

Sandboxed Google Play runs the official Play releases inside the standard app sandbox with no special privileges, rather than the deeply privileged system access it normally holds. It’s installed per profile. Only apps in that profile can use it, and they must explicitly choose to. The OS itself never uses it as a backend, even when present. The vast majority of Play functionality still works, including the Play Store, in-app purchases, and dynamically updated modules. Only a small subset of inherently privileged functionality is unavailable.

Permissions the Stock OS Doesn’t Offer

A Network permission toggle blocks both direct and indirect network access, including localhost, which matters because localhost is otherwise a channel between profiles. When denied, the OS presents the network as down rather than throwing permission errors, so apps degrade gracefully instead of crashing.

A Sensors permission covers everything not already gated: accelerometer, gyroscope, compass, barometer, and the rest. Denied apps receive zeroed data, and you get a notification telling you they tried to access it.

Storage Scopes lets an app believe it has every storage permission it asked for, while actually seeing only files it created, plus anything you explicitly add. Contact Scopes does the same thing for contacts, presenting an empty list by default.

Data at Rest and Duress

Auto-reboot returns a locked device to the before-first-unlock state after a timer, defaulting to 18 hours and configurable from 10 minutes to 72 hours. It’s implemented in init, so it can’t be bypassed by crashing a system process, since an init crash panics the kernel and reboots anyway.

A duress PIN or password, entered anywhere credentials are requested, irreversibly wipes the device and any installed eSIMs. The wipe doesn’t need a reboot and can’t be interrupted once triggered.

Fingerprint unlock is limited to five total attempts, rather than the standard twenty. Two-factor fingerprint unlock adds a second-factor PIN after a successful fingerprint, which lets you use a long passphrase as the primary method without living with it daily. Password length goes up to 128 characters, instead of 16, making diceware passphrases genuinely practical.

Profiles, Network Privacy, and Patching

Secondary user profiles go from 4 to 32. You can also log out of a profile to purge its encryption keys from memory and hardware registers, rather than leaving it decrypted in the background. Per-connection MAC randomisation is on by default, which is stronger than Android’s per-network persistent random MAC. VPN leak blocking closes several holes in Android as well, including a DNS race condition when a VPN drops and multiple multicast bypass routes. Screenshots, meanwhile, have the OS build string and timestamp metadata stripped automatically.

On patching, the project ships current Linux LTS point releases on devices with Generic Kernel Image support. This has historically put it months ahead of the stock Pixel OS on kernel security fixes.

What You Give Up When You Install GrapheneOS on Pixel

The bootloader unlock wipes the device twice during install, so back up first. Google functionality requires deliberately installing sandboxed Play. Even then, a small amount of privileged functionality remains unavailable regardless. Third-party reviews report that Google Wallet tap-to-pay doesn’t work out of the box, and that face unlock is unavailable on newer Pixels, leaving fingerprint only. Banking app compatibility is the most frequently raised concern, and it varies by institution. Reports are mixed and change over time, so check your specific apps before committing to the switch.

Reverting to stock is supported through Google’s own flashing tool. There’s an extra step people miss, though: boot to fastboot with the bootloader unlocked, and erase the custom verified boot key first, or the device won’t return to a clean factory state.

Talk to our team about endpoint security →  TALK

Frequently Asked Questions

How long does it take to install GrapheneOS on Pixel? Roughly twenty minutes on a supported device, following the official web installer, assuming you have a working cable, a supported browser, and a carrier-agnostic Pixel.

Which Pixel phones support GrapheneOS? The Pixel 6 family through the Pixel 10 family, including the 9a and 10a. Fourth- and fifth-generation Pixels are handled differently and can’t be fully verified using the boot key hash method, since they only display the first 32 bits of the hash.

Can I use Chrome or Firefox for the GrapheneOS web installer? Chrome works. Firefox does not, since it doesn’t implement WebUSB, despite several widely shared guides claiming otherwise. Supported browsers are Chromium, Chrome, Edge, Vanadium, and Brave with Shields disabled.

Does installing GrapheneOS on Pixel wipe the device? Yes, twice. Unlocking the bootloader wipes all data, and locking it again after flashing wipes it a second time. Back up anything you need before starting.

What do you lose when you install GrapheneOS instead of stock Android? Google services require manually installing sandboxed Play, a small amount of privileged Google functionality stays unavailable, Google Wallet tap-to-pay reportedly doesn’t work out of the box, and face unlock is unavailable on newer Pixels. Banking app compatibility varies by institution and should be checked individually.

References

Project documentation: The official web installer guide covers prerequisites, supported browsers and operating systems, verified boot key hashes, and the reversion procedure. grapheneos.org/install/web

Its features overview covers exploit mitigations, hardened_malloc, kernel hardening, USB-C port control, sandboxed Google Play, permission toggles, auto-reboot, and duress credentials. grapheneos.org/features

The supported devices FAQ lists every Pixel model currently covered. grapheneos.org/faq#supported-devices

A command-line installation guide is also available for anyone who prefers it over the web installer. grapheneos.org/install/cli

The Auditor attestation tutorial explains the two-device verification process referenced above. attestation.app/tutorial

Technical documentation for hardened_malloc is maintained separately on GitHub. github.com/GrapheneOS/hardened_malloc

Third-party reports: Claims about app compatibility, tap-to-pay, face unlock, and install duration come from third-party reviews and community guides rather than the project itself and aren’t independently verified here. Some third-party guides also contain errors, notably the claim that Firefox can be used for the web install. Community installation and daily-driver guides, 2026.

Read More Here