How to install GrapheneOS on your Phone

Posted on by peq42
grapheneOS phone system

Smartphones quietly collect more data about us than almost any other device we own — location, contacts, app usage, even how we type. GrapheneOS was built to change that. It’s a free, open-source, privacy- and security-focused operating system for Google Pixel phones that strips out the invasive tracking baked into standard Android while hardening the system itself against attack.

What sets GrapheneOS apart isn’t just the absence of Google’s default data collection — it’s the depth of the security work underneath: a hardened memory allocator, stronger app sandboxing, and security patches that often arrive faster than on stock Android. The result is a phone that’s both harder to surveil and harder to compromise, without sacrificing day-to-day usability. For journalists, activists, security researchers, or anyone who wants real control over their own device, GrapheneOS treats privacy and security as the same problem — and solves for both.

Before You Begin — Critical Notes

  1. Official methods only. GrapheneOS maintainers recommend using only the WebUSB-based installer or the command-line installation guide. Third-party guides are often outdated and may contain errors.
  2. Supported devices only. You need one of the officially supported devices listed on the GrapheneOS FAQ. Avoid carrier-locked variants — carrier IDs can disable bootloader unlocking. Get an unlocked device when possible.
  3. Data will be wiped. Unlocking the bootloader and flashing GrapheneOS erases all data on the device. Back up anything important first.
  4. Use the right cable. A high-quality USB-C cable (preferably the one that came with your device) is the most common source of installation issues. Avoid USB hubs — connect directly to a rear port on a desktop or any port on a laptop.
  5. Update everything first. Update your device’s stock OS to the latest version before starting. This ensures the most recent firmware is available.

Method 1 — WebUSB Installer (Recommended for Most Users)

This method runs in your browser and requires no command-line tools. It works on Windows, macOS, Linux, ChromeOS, Android, and even on a device already running GrapheneOS.

System Requirements

CategorySupported Versions (2026)
Operating SystemsWindows 10 / 11, macOS Sonoma (14) / Sequoia (15) / Tahoe (26), Arch Linux, Debian 12 / 13, Ubuntu 22.04 LTS / 24.04 LTS / 25.04, Linux Mint (follow Ubuntu/Debian), ChromeOS, GrapheneOS, Android 14–17
BrowsersChromium, Vanadium, Google Chrome, Microsoft Edge, Brave (with Shields disabled)
Hardware≥ 2 GB free RAM, ≥ 32 GB free storage
OtherDo not use Incognito/private browsing mode (storage quota is too low)

Tip: Avoid Flatpak and Snap versions of browsers — they’re known to cause issues. On Brave, disable Shields because it artificially limits storage.

Step-by-Step Installation

Step 1 — Enable OEM Unlocking

  1. On your Pixel, go to Settings → About phone → tap “Build number” 7 times to enable Developer options.
  2. Go to Settings → System → Developer options → toggle ON “OEM unlocking”.
  3. On carrier-capable SKUs, enabling OEM unlocking requires internet access so the stock OS can check if the device was sold locked.

Pixel 6a note: The factory OS doesn’t support OEM unlocking. Update to the June 2022 release or later via OTA, then perform a factory reset.

Step 2 — Boot into Fastboot Mode

  1. Reboot your device.
  2. Immediately hold the Volume Down button while it boots.
  3. Keep holding until you see a red triangle warning and the words “Fastboot Mode”.
  4. Do NOT press the power button to select “Start” — the device must remain in Fastboot mode.

Step 3 — Connect the Device

  1. Plug the device into your computer using the USB-C cable.
  2. On Linux, if you haven’t set up USB rules yet, see Step 3a.
  3. On Windows, recent versions include a generic fastboot driver. If using an older Windows or a 4th-gen Pixel, install Google’s USB driver via Device Manager.
Step 3a — Linux USB Permissions (non-root flashing)

On Arch Linux:

sudo pacman -S android-udev

On Debian/Ubuntu:

sudo apt install android-sdk-platform-tools-common
Step 3b — Work around fwupd conflicts (Linux)

The fwupd service can hijack fastboot devices. Stop it temporarily:

sudo systemctl stop fwupd.service

(This doesn’t disable the service permanently — it will restart on reboot.)

Step 4 — Launch the Web Installer
  1. Open the GrapheneOS WebUSB Installer page in a supported browser.
  2. Click “Connect device” — the page will detect your Pixel via WebUSB.
  3. Click “Unlock bootloader” in the web interface.
  4. Confirm on the device using volume buttons (select “Yes”) and the power button.

This will wipe all data on the device.

Step 5 — Download and Flash Factory Images

  1. Click “Download release” in the web installer. The browser will fetch the factory images for your detected device.
  2. Once downloaded, click “Flash release”.
  3. The installer will automatically:
  • Flash the latest firmware
  • Reboot into the bootloader
  • Flash the GrapheneOS OS images

Do not interact with the device during this process. Wait for the script to finish completely.

Step 6 — Lock the Bootloader (Critical!)

Locking enables full verified boot — the feature that cryptographically verifies every boot. It also prevents further flashing/erasing of partitions.

  1. With the device still in Fastboot mode, click “Lock bootloader” in the web installer.
  2. Confirm on the device (volume buttons → power button).
  3. This will wipe all data again — this is normal.

Why locking matters: Verified boot uses a public key flashed to the device’s secure element. This key can only be changed when the bootloader is unlocked. Locking ensures that any tampering with the OS or firmware will be detected and blocked on every boot.

Step 7 — First Boot & Post-Installation

  1. Press the power button with “Start” selected to boot into GrapheneOS.
  2. During setup, the final screen contains a toggle for OEM unlocking — leave it OFF (recommended).
  3. Complete the setup wizard.

Method 2 — CLI Installation (Advanced Users)

Use this if you prefer the command line or need more control. The process adds cryptographic verification of the downloaded images.

Prerequisites

Same as the WebUSB method, plus:

  • fastboot ≥ 35.0.1 installed and in your PATH
  • OpenSSH client for signature verification
Installing fastboot (standalone, recommended)

Download and verify the official platform-tools release:

Linux:

sudo apt install libarchive-tools
curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-linux.zip
echo 'acfdcccb123a8718c46c46c059b2f621140194e5ec1ac9d81715be3d6ab6cd0a  platform-tools_r35.0.2-linux.zip' | sha256sum -c
bsdtar xvf platform-tools_r35.0.2-linux.zip
export PATH="$PWD/platform-tools:$PATH"

macOS:

curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-darwin.zip
echo 'SHA256 (platform-tools_r35.0.2-darwin.zip) = 1820078db90bf21628d257ff052528af1c61bb48f754b3555648f5652fa35d78' | shasum -c
tar xvf platform-tools_r35.0.2-darwin.zip
export PATH="$PWD/platform-tools:$PATH"

Windows (PowerShell):

curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-win.zip
(Get-FileHash platform-tools_r35.0.2-win.zip).hash -eq "2975a3eac0b19182748d64195375ad056986561d994fffbdc64332a516300bb9"
tar xvf platform-tools_r35.0.2-win.zip
$env:Path = "$pwd\platform-tools;$env:Path"
Remove-Item Alias:Curl
Verify fastboot version:
fastboot --version
# Should show: fastboot version 35.0.2-12147458 (or newer)

CLI Step-by-Step

Step 1 — Boot into Fastboot Mode

Hold Volume Down while rebooting until you see the red triangle and “Fastboot Mode”.

Step 2 — Unlock Bootloader

fastboot flashing unlock

Confirm on the device (volume buttons → power button). All data will be erased.

Step 3 — Download & Verify Factory Images

  1. Download the signing key:
curl -O https://releases.grapheneos.org/allowed_signers

The key should be:

contact@grapheneos.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUg/m5CoP83b0rfSCzYSVA4cw4ir49io5GPoxbgxdJE
  1. Download the factory images for your device codename and version from the releases page:
curl -O https://releases.grapheneos.org/DEVICE_NAME-install-VERSION.zip
curl -O https://releases.grapheneos.org/DEVICE_NAME-install-VERSION.zip.sig
  1. Verify the signature (essential for security):

Linux/macOS:

ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s DEVICE_NAME-install-VERSION.zip.sig < DEVICE_NAME-install-VERSION.zip

Windows:

cmd /c 'ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s DEVICE_NAME-install-VERSION.zip.sig < DEVICE_NAME-install-VERSION.zip'

You should see: Good “factory images” signature for contact@grapheneos.org…

  1. Extract the images:
# Linux
bsdtar xvf DEVICE_NAME-install-VERSION.zip

# macOS / Windows
tar xvf DEVICE_NAME-install-VERSION.zip

cd DEVICE_NAME-install-VERSION

Step 4 — Flash the Images

# Linux / macOS
bash flash-all.sh

# Windows
./flash-all.bat

Wait for the script to finish completely before interacting with the device.

Step 5 — Lock the Bootloader

fastboot flashing lock

Confirm on the device. Data will be wiped again.

Step 6 — First Boot & Post-Installation

Boot the device, complete setup, and disable OEM unlocking on the final setup screen.

Verifying Your Installation (Optional but Recommended)

Verified Boot Key Hash

When you boot a device with a non-stock OS, newer Pixels (6th generation and up) display the full SHA-256 hash of the verified boot public key on a yellow screen. Compare it against the official hash for your device:

DeviceVerified Boot Key Hash
Pixel 103f7415ea26f5df5b14ea6d153256071a7a1af9ce7b0970b7311cc463c7ea02c7
Pixel 10 Pro4e8ee8f717754052198ca6d2d3aaa232e2461b4293c0d6f297e519cc778de093
Pixel 10 Pro XL141d7fc32af7958a416f2661b37cf6f27bfb376fb5ce616aeaa27a82c7a04f74
Pixel 10ad8f879d10419eddc9fcda6280718be763f6bf12299e1f72df3ea8ad8a8eb7f80
Pixel 99e6a8f3e0d761a780179f93acd5721ba1ab7c8c537c7761073c0a754b0e932de
Pixel 9 Prof729cab861da1b83fdfab402fc9480758f2ae78ee0b61c1f2137dd1ab7076e86
Pixel 8cd7479653aa88208f9f03034810ef9b7b0af8a9d41e2000e458ac403a2acb233
Pixel 8 Pro896db2d09d84e1d6bb747002b8a114950b946e5825772a9d48ba7eb01d118c1c
Pixel 73efe5392be3ac38afb894d13de639e521675e62571a8a9b3ef9fc8c44fd17fa1
Pixel 7 Probc1c0dd95664604382bb888412026422742eb333071ea0b2d19036217d49182f
Pixel 6a08c860350a9600692d10c8512f7b8e80707757468e8fbfeea2a870c0a83d6031
Pixel 6 Pro439b76524d94c40652ce1bf0d8243773c634d2f99ba3160d8d02aa5e29ff925c
Pixel 6f0a890375d1405e62ebfd87e8d3f475f948ef031bbf9ddd516d5f600a23677e8
See grapheneos.org/install for full list

Note: 4th and 5th gen Pixels only show the first 32 bits of the hash — not enough for reliable verification.

Hardware-Based Attestation with Auditor

GrapheneOS includes the Auditor app for hardware-backed attestation. To verify your device’s integrity:

  1. Install Auditor on a second Android device.
  2. Use the QR code-based verification flow to pair the devices.
  3. Auditor will confirm the hardware, firmware, and OS are genuine using the device’s secure element.

See the Auditor tutorial page for details.

Troubleshooting

IssueSolution
USB device already in use (Linux)Stop fwupd: sudo systemctl stop fwupd.service
Insufficient storage in browserDon’t use Incognito/private mode; clear browser cache; ensure ≥ 32 GB free
Bricked device / fastboot not detectedTry a different USB port/cable; on Windows, reinstall the Pixel USB driver
flash-all.sh fails with tmp space error (Linux)/tmp may be too small (tmpfs). Run: mkdir tmp && TMPDIR=”$PWD/tmp” ./flash-all.sh
Brave browser won’t downloadDisable Brave Shields for the site
Carrier-locked bootloaderCarrier variants may be permanently locked — get an unlocked device

If you get stuck, ask for help in the official GrapheneOS chat channel. Provide the exact error output from your attempt.

Reverting to Stock Android

If you want to return to Google’s stock OS:

  1. Boot into fastboot mode with the bootloader unlocked.
  2. Erase the custom verified boot key:
fastboot erase avb_custom_key
  1. Use Google’s flashing tool to install the stock factory images.
  2. Lock the bootloader to fully restore the stock state.

Further Reading

  • GrapheneOS Usage Guide — post-install configuration, privacy features, and app compatibility
  • GrapheneOS FAQ — supported devices, security model, and common questions
  • Official Releases Page — download factory images and changelogs

Tip: Always consult the official guides for the most current instructions. This tutorial reflects the 2026 official documentation.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Posts