GrapheneOS runs on Pixel hardware and replaces the default Android system with one that collects nothing by default.

GrapheneOS is an Android-based operating system built for privacy and security. It runs on Google Pixel phones, removes Google's data collection layer, and gives you a phone that works normally for everyday tasks while sharing far less about you by default.

The name sounds technical, and the project has a reputation for being difficult to set up. That reputation is somewhat out of date. The official web installer at grapheneos.org/install/web handles the process through a browser window, with clear steps and no command line required.

What GrapheneOS actually changes

A standard Android phone, whether from Google directly or a carrier, comes with Google Play Services installed. This is the background layer that handles app updates, push notifications, and location services. It also reports back to Google constantly, sending device information, location data, and usage patterns by default.

GrapheneOS removes that layer. In its place, it provides a hardened Android base that does not report to any company. You still get a working phone with apps, a camera, Wi-Fi, and everything else. What you lose is the background reporting.

GrapheneOS also includes features not found in standard Android. Per-app network controls let you block individual apps from accessing the internet entirely. A hardened memory allocator makes certain types of attack harder. There is also a sandboxed version of Google Play that you can optionally install if you need access to Play Store apps, without giving those apps device-level trust.

Which phones are supported

GrapheneOS only runs on Google Pixel phones. This is a deliberate choice, Pixels have strong hardware security features and receive long-term firmware support, which lets GrapheneOS build on a reliable foundation.

The supported device list at grapheneos.org/supported-devices is kept current. Older Pixels leave the list when Google stops providing security updates for the underlying firmware. A Pixel 6 or newer covers most current users well.

How the web installer works

The web installer at grapheneos.org/install/web requires Chrome or a Chromium-based browser such as Edge or Brave. It uses a browser feature called WebUSB to communicate with your phone over a USB cable. Firefox does not support WebUSB.

Before starting, you enable a setting on your phone called OEM unlocking. This is in Developer Options, which you reach by tapping the build number in Settings seven times. Enabling OEM unlocking allows the bootloader, the part of the phone that decides which operating system to start, to be replaced.

The installer then walks you through locking the bootloader again once GrapheneOS is installed. This step matters, a locked bootloader with GrapheneOS provides verified boot, meaning the phone confirms on every startup that the operating system has not been tampered with.

The whole process takes around twenty to thirty minutes. The installer tells you at each stage what to do with the physical buttons on your phone. No commands are typed.

What to expect after installing

GrapheneOS looks similar to stock Android. The settings menus, app drawer, and general feel are familiar. What is absent by default is anything Google-branded. There is no Gmail app, no Google Maps, no Play Store installed.

You can install apps through GrapheneOS's own app repository for open-source software, or through the sandboxed Google Play option if you need Play Store access. The sandboxed version gives Play Store apps no more trust than any other app, which differs from how Google Play normally operates on stock Android.

The GrapheneOS FAQ covers common questions about app compatibility, banking apps, and what works out of the box. Most everyday apps function normally. Some banking apps detect that the bootloader was unlocked at some point and refuse to run; the FAQ explains workarounds for the most common cases.

What this does not solve

GrapheneOS removes Google's data collection from the operating system. It does not change what apps you install do on their own. If you install WhatsApp or a social media app on GrapheneOS, those apps still behave as they would anywhere else. The privacy benefit is at the system level, not the app level.

It also does not protect against your mobile carrier tracking your location through cell tower data. Your carrier knows which towers your phone connects to regardless of what operating system you run.

GrapheneOS is a meaningful improvement over stock Android for reducing device-level data collection. It is not a complete privacy solution on its own, and the project is straightforward about this in its documentation at grapheneos.org.

Who it suits

GrapheneOS is a reasonable option for people who already own a supported Pixel, want to reduce what their phone reports by default, and are willing to spend an afternoon on the installation. The web installer has lowered the technical barrier considerably.

If your concern is more general, such as reducing app permissions or turning off ad tracking, there are smaller steps you can take on a standard Android phone without replacing the operating system. GrapheneOS is for people who want to go further than those adjustments allow.

Before starting, check that your Pixel model is on the supported list at grapheneos.org/supported-devices. From there, the web installer page walks through everything else.

Check whether your Pixel model is on the GrapheneOS supported devices list at grapheneos.org/supported-devices before deciding whether to proceed.

• What a Catch-All Email Address Is and Why It Helps
• What to Do With an Old Laptop Before You Throw It Out
• You Don't Have to Fix Your Privacy All at Once