How to install GrapheneOS on a Pixel phone

Who this is for

GrapheneOS is a security and privacy-focused mobile operating system based on Android. This guide is for anyone who wants to install GrapheneOS on a compatible Pixel phone. To follow this guide you should have basic familiarity with using a computer and following instructions! :3

The short version

1. Check if your Pixel phone is compatible with GrapheneOS (see the list below).
2. Back up your data, as installing GrapheneOS will erase everything on your device.
3. Enable OEM unlocking in Developer Options.
4. Follow Method 1 (web installer) below, it takes about 10-20 minutes.

How it actually works

GrapheneOS is designed to enhance the security and privacy of your device by implementing various security features and hardening the Android operating system. It replaces the stock Android OS on your Pixel phone, providing a more secure (and private!!) environment for your data and communications. The installation process involves unlocking the bootloader, flashing the GrapheneOS image, and setting up your device from scratch.

Why use it?

Stock Android ships tied to Google services that constantly phone home, while GrapheneOS changes the trust model. In this way you get:

• No Google services by default, and, if you want them, you can easily install them! They'll run inside a sandboxed environment, basically like a normal app without special privileges (no system-level access, which is VERY GOOD).
• Granular permissions, basically the ability to control network access per app, revoke sensor access, and use Storage Scopes and Contact Scopes, making an app believe it has full access while only seeing what you explicitly allow.
• Vanadium browser, one of the most secure mobile browsers available on the market thanks to integration with the OS.
• Per-connection MAC randomization and no leaked hardware identifiers!
• Hardened memory and exploit protection, basically a hardened memory allocator, and on 8th gen and later Pixels, you also get hardware memory tagging (so-called ARM MTE) enabled by default to catch a lot of exploits!
• The ability to set a duress PIN/password, which if entered wipes the whole device, auto-reboot timer that returns the phone to a more secure state after inactivity called "Before First Unlock", and the ability to disable the USB-C port at hardware level.
• Verified boot and attestation, so you can confirm cryptographically the hardware, firmware and OS are genuine using its specific Auditor app.

Doing it yourself

Before you start, please be sure you have a Pixel phone! While writing this guide the following models are supported: Pixel 10a, Pixel 10 Pro Fold, Pixel 10 Pro XL, Pixel 10 Pro, Pixel 10, Pixel 9a, Pixel 9 Pro Fold, Pixel 9 Pro XL, Pixel 9 Pro, Pixel 9, Pixel 8a, Pixel 8 Pro, Pixel 8, Pixel Fold, Pixel Tablet, Pixel 7a, Pixel 7 Pro, Pixel 7, Pixel 6a, Pixel 6 Pro and Pixel 6. If you have a model not listed here, it means GrapheneOS does not support it anymore, and you should buy a newer model! I'm not responsible for any damage or loss if you proceed anyway!!!

Recommended for new buyers: Pixel 8 and later, because these have a 7-year support guarantee from launch and support hardware memory tagging (MTE). The Pixel 6 and 6 Pro reach their minimum OEM support end in October 2026, so avoid them for a fresh purchase. And PLEASE AVOID carrier-locked variants, as they don't support unlocking the bootloader, which is required to install GrapheneOS. I trust you that you have a Pixel phone, so let's get started! :3

Prerequisites

You need a compatible Pixel phone, a USB-C cable (the one that came with the phone is best), and a computer with at least 2 GB free RAM and 32 GB free storage. Install from bare metal, not a virtual machine. Also, back up your data, since installing wipes the device completely!

Now, after doing all of that, you need to enable developer options on your Pixel phone. To do this, go to Settings → About phone → tap Build number 7 times. Then go back to Settings → System → Developer options, and enable OEM unlocking.

If you have a Pixel 6a, heads up: OEM unlocking won't work on the factory stock OS. You need to update to the June 2022 release or later via OTA, then factory reset. After that it should work fine!

Let's begin the installation process! :3

Method 1: Using the official Web installer (recommended)

This is the recommended path for most people, because it is, in fact, very easy and fast to do. To do so, you don't need to know how to use a terminal, because it runs entirely in a supported browser using WebUSB. It even works from another Android phone, a Chromebook, or GrapheneOS itself!! To use this method, you need to use a supported browser, which are: Chromium (not the Ubuntu Snap build), Vanadium, Google Chrome, Microsoft Edge, or Brave (with Brave Shields disabled). Do not use Incognito/private mode, since it won't have enough storage to extract the release.

Steps:

1. Complete the prerequisites and enable OEM unlocking (above).
2. Boot into the bootloader (fastboot mode). Reboot the phone while holding Volume Down until you see a red warning triangle and the words "Fastboot Mode". Do not press the power button to pick "Start", the phone must stay paused in fastboot mode.
3. Connect the phone to the computer with the USB-C cable. (On Windows 10/11 a generic driver is used automatically for the Pixel 4a 5G and later.)
4. Open the official web installer at grapheneos.org/install/web.
5. Press Unlock bootloader. Confirm on the phone with the volume keys to change the selection and the power button to accept. This wipes all data.
6. Press Download release to fetch the factory images for your device.
7. Press Flash release and wait. The installer handles the firmware, reboots, and OS flashing automatically. Do not touch the phone until it finishes.
8. Press Lock bootloader to re-lock, and confirm on the phone. This wipes data again and enables full verified boot, so do it before setting up the phone.
9. Boot into GrapheneOS. Once you're in, go to Settings → System → Developer options and turn off OEM unlocking. This hardens the device!

That's it!!! Most people are done in 10-20 minutes.

Method 2: Using the command line (for the nerds)

This one is for you if you prefer doing things the traditional way or if your setup doesn't support WebUSB. It works on Windows 10/11, recent macOS (Sonoma/Sequoia/Tahoe), Arch, Debian 12/13, and Ubuntu 22.04/24.04/25.04. Please follow the steps in order, don't skip or reorder anything!!

Throughout this section, replace DEVICE_NAME with your device codename (for example tokay for Pixel 9, shiba for Pixel 8, etc.) and VERSION with the current release version from the GrapheneOS releases page.

Step 1: Open a terminal

Use a single terminal for the whole process. On Windows, use a regular (non-admin) PowerShell, not the legacy Command Prompt. You also need to remove PowerShell's curl alias for this session:

Remove-Item Alias:Curl

Step 2: Get fastboot (platform-tools)

You need fastboot version 35.0.1 or newer on your PATH. Here's how to get it depending on your OS!

On Arch Linux you can just use the distro package:

sudo pacman -S android-tools

On Debian/Ubuntu the packaged version is broken and outdated (classic), so use the official standalone platform-tools instead:

sudo apt install libarchive-tools
curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-linux.zip
echo 'acfdcccb123a8718c46c46c059b2f621140194e5ec1ac9d81715be3d6ab6cd0a  platform-tools_r35.0.2-linux.zip' | sha256sum -c
bsdtar xvf platform-tools_r35.0.2-linux.zip

On macOS:

curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-darwin.zip
echo 'SHA256 (platform-tools_r35.0.2-darwin.zip) = 1820078db90bf21628d257ff052528af1c61bb48f754b3555648f5652fa35d78' | shasum -c
tar xvf platform-tools_r35.0.2-darwin.zip

On Windows:

curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-win.zip
(Get-FileHash platform-tools_r35.0.2-win.zip).hash -eq "2975a3eac0b19182748d64195375ad056986561d994fffbdc64332a516300bb9"
tar xvf platform-tools_r35.0.2-win.zip

Now add the tools to your PATH for this session. On Linux/macOS:

export PATH="$PWD/platform-tools:$PATH"

On Windows:

$env:Path = "$pwd\platform-tools;$env:Path"

Check that it works by running:

fastboot --version

If it prints the version, you're good! :3

Step 3: Linux-only setup

If you're on Linux, you need to allow flashing as a non-root user with udev rules:

# Arch
sudo pacman -S android-udev

# Debian / Ubuntu
sudo apt install android-sdk-platform-tools-common

If you get a "device already in use" or "claimed" error later, stop fwupd:

sudo systemctl stop fwupd.service

Step 4: Boot into the bootloader and unlock

Boot the phone while holding Volume Down until you see "Fastboot Mode" with the red triangle, then connect it to your computer. Now unlock the bootloader:

fastboot flashing unlock

Confirm on the device using the volume keys to select and power button to accept. This wipes all data.

Step 5: Download and verify the factory images

First, get the signing key:

curl -O https://releases.grapheneos.org/allowed_signers

Then download the factory images and signature for your device:

curl -O https://releases.grapheneos.org/DEVICE_NAME-install-VERSION.zip
curl -O https://releases.grapheneos.org/DEVICE_NAME-install-VERSION.zip.sig

Now verify the download! On Linux/macOS:

ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s DEVICE_NAME-install-VERSION.zip.sig < DEVICE_NAME-install-VERSION.zip

On Windows:

cmd /c 'ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s DEVICE_NAME-install-VERSION.zip.sig < DEVICE_NAME-install-VERSION.zip'

If it prints Good "factory images" signature, you're good. If verification fails, DO NOT continue. Something went wrong with the download and you should try again.

Step 6: Extract and flash

Extract the archive. On Linux:

bsdtar xvf DEVICE_NAME-install-VERSION.zip

On macOS/Windows:

tar xvf DEVICE_NAME-install-VERSION.zip

Move into the extracted folder:

cd DEVICE_NAME-install-VERSION

Now run the flashing script! On Linux/macOS:

bash flash-all.sh

On Windows:

./flash-all.bat

Wait for it to finish completely. It flashes firmware, reboots, and flashes the OS on its own. Don't touch the phone until it's done.

Linux tip: if flashing fails because /tmp is too small (it's often memory-backed), use a local temp directory:

mkdir tmp && TMPDIR="$PWD/tmp" ./flash-all.sh

Step 7: Lock the bootloader

Re-lock to enable full verified boot:

fastboot flashing lock

Confirm on the device. This wipes data again, which is why you lock before setting up the phone, not after.

And that's it for the command line method! :3

After installation

You're almost done!! Here's what to do now:

• Boot GrapheneOS. Select Start in the bootloader with the power button.
• Disable OEM unlocking. Go to Settings → System → Developer options and turn off OEM unlocking. This hardens the device.
• Verify your install (optional but recommended). On 6th gen and later Pixels you can compare the on-screen verified-boot key hash against the official hash for your model, and use the Auditor app (with a second Android device) for hardware-backed attestation. Basically it confirms everything is genuine and not tampered with!
• Set up your apps. Use the Aurora Store for anonymous Play Store downloads, F-Droid for open source apps, or install sandboxed Google Play if you need push notifications and certain services.
• Harden further. Consider setting up a duress PIN, the auto-reboot timer, disabling USB when locked, and per-app network permissions. You don't have to do all of this at once, but it's nice to know it's there!

What can go wrong

• Bad USB cable or hub. This is the number one cause of install failures, seriously. Use the cable that came with the phone and plug it directly into your computer, not through a hub. If flashing keeps failing or disconnecting, try a different cable or a different port (rear ports on desktops are more reliable).
• WebUSB not working. Make sure you're using a supported browser (Chromium, Chrome, Edge, Brave with Shields off, or Vanadium). Firefox and Safari do NOT support WebUSB. Also don't use Incognito/private mode!!
• OEM unlocking greyed out. This usually means your device is carrier-locked. Some carriers permanently disable bootloader unlocking at the factory level. If this is the case, there's basically nothing you can do, you need a carrier-agnostic device. On a Pixel 6a specifically, update to at least the June 2022 release and factory reset first.
• Flashing fails on Linux because /tmp is too small. Your /tmp is probably memory-backed. Create a local temp directory and use TMPDIR="$PWD/tmp" ./flash-all.sh instead.
• "device already in use" error on Linux. Stop the fwupd service with sudo systemctl stop fwupd.service and try again.
• Phone stuck in a boot loop after flashing. This almost always means the bootloader was locked before flashing completed properly. Boot back into fastboot mode (hold Volume Down during reboot), unlock the bootloader again, re-flash, and make sure flashing finishes completely before locking.
• Verification fails when checking the download. Don't proceed!! Delete the files and download them again. Could be a corrupted download or a network issue.

A few realistic caveats

Look, GrapheneOS is great, but there are some things you should know:

• NFC/tap-to-pay (Google Wallet) generally won't work, so keep your physical cards handy.
• Some banking apps may refuse to run. Most work fine with sandboxed Google Play though, and the bank's website is usually a fine fallback!
• You need a Pixel. If you're on another brand, GrapheneOS is simply not an option today. Sorry!!

Where to read more

• GrapheneOS official site, the source of truth for everything, including installation, features, and FAQ.
• GrapheneOS usage guide, how to actually use GrapheneOS after installation, including setting up apps and sandboxed Google Play.
• GrapheneOS FAQ, answers to common questions about compatibility, features, and security.
• GrapheneOS community chat, if you get stuck, ask here. They're active and helpful, just make sure you try the guide yourself first and describe the specific step where you're stuck!