As an alternative Android operating system, GrapheneOS doesn’t officially come pre-installed on any device.

If you have a compatible phone, you can install GrapheneOS yourself through a few relatively straightforward steps. To help you make the installation as smooth as possible, this guide will explain:

• • Which devices you can install GrapheneOS on
• • What other prerequisites you should meet
• • How to install GrapheneOS using the two available methods
• • Why you should pair it with a secure mobile carrier

Can You Install GrapheneOS on Any Phone?

You can’t install GrapheneOS on any device—it’s only available on a select few Google Pixel models with the necessary security hardware. The current list of supported devices includes:

• • Pixel 6 / 6a / 6 Pro
• • Pixel 7 / 7a / 7 Pro
• • Pixel 8 / 8a / 8 Pro
• • Pixel 9 / 9 Pro / 9 Pro XL / 9 Pro Fold
• • Pixel Fold
• • Pixel Tablet

This means you can’t install GrapheneOS on Samsung phones or other devices that support Android, even thought the OS serves as Android’s security-focused counterpart.

Note that while older models like the Pixel 3 and Pixel 4 series also support GrapheneOS, they’re considered end-of-life devices. At the time of writing this, they still receive extended support, but you won’t get access to all the features and should update to newer hardware for long-term support.

What Do You Need To Install GrapheneOS?

Installing GrapheneOS isn’t as simple as downloading and executing a specific file. The following table outlines the installation prerequisites besides a compatible Pixel phone:

GrapheneOS installation removes all existing user data on your phone. That’s why you must back up your personal files and data beforehand. Once the process starts, your data will be unrecoverable.

Methods for Installing GrapheneOS

Depending on your skills and tech background, you can choose between two GrapheneOS installation options:

1. 1. WebUSB-based installer (web installer for short)
2. 1. Command-line installer (CLI)

Even if you’re tech-savvy and know your way around command-line tools, the web installer is objectively simpler. As some users might still prefer CLI, we’ll break down both options below.

1. How To Install GrapheneOS Using the Web Installer

The GrapheneOS web installer offers user-friendly guidance through the installation process. To access it, you should first boot your Pixel into bootloader mode. You can do this by:

1. 1. Turning off your phone
2. 1. Pressing and holding the volume down + power button

Once you see a red triangle and “Fastboot Mode,” connect your Pixel to the computer via USB. Then, visit grapheneos.org/install/web in your browser (Preferably Chrome, Edge, or Chromium).

The site will automatically detect that you’re in bootloader mode, after which you can start the installation process. Here are the steps you should follow:

1. 1. Click Unlock bootloader on the web page. To confirm the unlocking, use the volume keys to navigate to “Yes” and press the power button.
2. 1. Click Download release on the installer page and choose your device to download GrapheneOS factory images.
3. 1. Go back to the installer page and click Flash release. Monitor the status in the installer and wait for the process to finish.
4. 1. Click Lock bootloader in the installer to ensure maximum security.
5. 1. Press the power button to boot into GrapheneOS.

If you run into any issues during the process, don’t panic. Encountering errors like your device not being found isn’t a major issue, and you can troubleshoot them in several ways, such as:

• • Using a different USB port or cable
• • Checking if OEM unlocking is enabled
• • Rebooting back into bootloader (using volume down + power)

2. Installing GrapheneOS Using CLI

While CLI GrapheneOS installation is more technical, the general steps are largely the same. The only difference is that you’ll use the command-line tools instead of a standard visual interface.

Specifically, you’ll first need the fastboot tool. On Windows, you can run fastboot --version in the terminal to determine the current version, which should be at least 35.0.1.

On Arch Linux, you can install android-tools to obtain fastboot. If your OS doesn’t include a fastboot version you can use, you’ll need to obtain standalone releases of Platform-Tools. When you do so, follow these steps to install GrapheneOS:

1. 1. In the terminal/PowerShell, run fastboot flashing unlock to unlock the bootloader.
2. 1. Download the GrapheneOS factory images ZIP and its signature, for example:
      1. curl -O https://releases.grapheneos.org/DEVICE_NAME-install-VERSION.zip
      2. curl -O https://releases.grapheneos.org/DEVICE_NAME-install-VERSION.zip.sig
3. 1. Use ssh-keygen with the signing key (allowed_signers file) to check the .sig file and verify the download.
4. 1. Unzip the factory images (tar xf DEVICE_NAME-install-VERSION.zip) and enter the directory, and then run:
      1. bash flash-all.sh on Linux or Max
      2. flash-all.bat on Windows
5. 1. Run fastboot flashing lock to lock the bootloader.
6. 1. Boot your phone by pressing the power button.

What To Do After Installing GrapheneOS

Once GrapheneOS is up and running, you can use its many security features to safeguard your data. Here are some of the first steps you should take:

• • Enable PIN scrambling: GrapheneOS lets you scramble the PIN layout to minimize the risk of shoulder surfing attacks. You can find and enable this feature in the Device unlock section of the settings menu.
• • Explore privacy toggles: With GrapheneOS, you can cut off the network and sensor access from specific apps. The related toggles are under Settings > Privacy, so customize app permissions as you see fit.
• • Familiarize yourself with new apps: GrapheneOS comes with hardened apps that increase overall security, such as the Vanadium browser and Auditor app for checking device integrity.
• • Disable OEM unlocking: If you don’t expect to reinstall GrapheneOS anytime soon, Settings > System > Developer options to disable OEM unlocking and safeguard your device.

As capable as GrapheneOS might be, no operating system can fully protect you from a rising security concern—network attacks. Once you familiarize yourself with the software, you should consider taking another step toward complete protection by opting for a secure phone service.

Why You Should Pair GrapheneOS With a Secure Carrier

Traditional telcos like AT&T and Verizon undermine the purpose of using secure cell phones by leaving major security gaps. This is because they use outdated and easily exploitable protocols that hackers can breach without much effort—something they’ve done quite a few times.

Besides suffering dozens of individual data breaches, telcos fell victim to perhaps one of the most sophisticated attacks to date—the Salt Typhoon attack. It targeted all broadband networks, exfiltrating countless sensitive data points.

Your phone’s OS cannot protect you from such attacks. It also cannot stop carriers from collecting sensitive data that is sold to advertisers and other third parties.

Instead, you need a secure service that shields your data from malicious parties, commercial telcos, and even internal teams. If this sounds appealing, check out Cape.

Cape + GrapheneOS: A Powerful Security Combo

Cape is a privacy-first mobile service that keeps your connection and data safe from both common and advanced network attacks. It operates on a “Don’t trust us” policy, which means it doesn’t need (or want) any personal data.

The service only collects the minimum amount of data necessary for it to work, so you can sign up anonymously to ensure information like your name, address, and SSN never leaves your device. When you do, Cape will use its advanced cryptography to protect your account—here’s how:

1. 1. When you sign up, your device creates a private encryption key
2. 1. The key is represented by a unique digital signature (a 24-word phrase) available only to you
3. 1. Your account is locked with the private key, which stays on your device at all times

The digital signature is necessary to make any notable account changes, such as number port-outs. There’s no human involvement, and nobody can initiate such changes but you, which minimizes the risk of SIM swapping.

Besides secure authentication, Cape offers various robust security features:

How To Install GrapheneOS With Cape

To install GrapheneOS with Cape, you’ll need:

• • A compatible Pixel phone
• • Cape’s eSIM
• • A device that can run the GrapheneOS Web Installer (laptop or computer)

Here are the condensed steps to follow from the owner profile:

1. 1. Go to Settings → Network & Internet → eSIM Support
2. 1. Enable eSIM management
3. 1. Download the Cape app—you have two options:
      1. Enable sandboxed Google Play Services and download the Play Store
      2. Download and install the Aurora App store on your device
4. 1. Proceed through the checkout flow to activate Cape
5. 1. Flash the OS by following the Web Installer steps

Once the installation is complete, you can enjoy the combined device-level privacy of GrapheneOS and the robust network protection that Cape offers.

How To Install Apps on GrapheneOS

One of the main benefits of GrapheneOS is the lack of pre-installed Google services. While this significantly improves privacy, it means you don’t get a readily available Play Store.

Luckily, you can still install pretty much all everyday apps. For enhanced privacy, GrapheneOS offers a sandboxed version of the Play Store, which you can find alongside Google Play services in the “Apps” app you get with GrapheneOS.

All you need to do is install Google Play services and the Play Store, and you can download apps the same way you would on a regular Android (minus the countless privacy issues).

If you don’t have a Google account or don’t wish to use one, you can get an alternative app store like the Aurora Store. It offers plenty of apps and enables anonymous sign-up to help you further enhance your privacy.

GrapheneOS allows app sideloading, so you don’t need to use a traditional store to get apps. You can install them directly from APK files, but download them from trusted sources to avoid malware and other security threats.

Switch to Cape for Superb Connectivity + Full Transparency

Cape has the highest network density in the U.S., so you can expect a stable connection with solid performance even in fringe areas. You’ll get an eSIM with:

• • Unlimited text and calls
• • Unlimited 4G/5G
• • Free international roaming for eligible devices and locations

All of this, alongside Cape’s security measures, comes at $99 per month. All federal, state, and local taxes are included in the monthly plan—no hidden charges.

The available functionalities will expand as Cape’s Beta evolves. The team is dedicated to ensuring a premium subscriber experience, so you can expect regular new value-adds to the feature set.

Get Started With Cape

You don’t need to wait until you’ve installed GrapheneOS to enjoy comprehensive network security—you can get started immediately by visiting cape.co/get-cape.

To help you expand the scope of security beyond the OS and the network, Cape partnered with Proton for a unique deal that shields your online activity. Cape subscribers can now get Proton Unlimited or Proton VPN Plus for only $1 for six months.