Install GrapheneOS on a Pixel, step by step

GrapheneOS is a privacy and security focused version of Android that runs on Google Pixel phones. It removes Google’s apps and services by default, hardens the system against attacks, and still lets you add Google Play in a locked-down sandbox so banking and travel apps keep working. This guide follows the official web installer step by step, in plain language, so a careful first-timer can do it in about 30 to 45 minutes.

If you are still deciding whether this is the right path for you, read Choosing a private phone first, then come back here when you have a supported Pixel in hand.

Before you begin: what you need

• A supported Pixel phone (see the list below).
• A computer running Windows 10 or 11, macOS Sonoma or newer, or a recent Linux distribution (Debian 12+, Ubuntu 22.04 LTS+, Arch, or ChromeOS).
• A Chromium-based browser on that computer: Google Chrome, Microsoft Edge, Brave (with Shields disabled), or Vanadium. The web installer uses a feature called WebUSB, which Firefox and Safari do not support.
• A good quality USB-C cable, plugged directly into a rear port on a desktop or a port on a laptop. Avoid USB hubs, which are a common cause of failed flashes.
• A little time and patience. Do not rush or unplug the cable mid-step.

Two things to know up front. First, installing GrapheneOS erases everything on the phone, so back up anything you want to keep before you start. Second, GrapheneOS only supports Pixels because they combine an unlockable bootloader with strong hardware security (verified boot and a dedicated security chip), which most other phones do not offer together.

Supported Pixel devices (as of July 2026)

GrapheneOS officially supports the following Google Pixel devices:

• Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a
• Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a
• Pixel 8, Pixel 8 Pro, Pixel 8a
• Pixel 7, Pixel 7 Pro, Pixel 7a
• Pixel 6, Pixel 6 Pro, Pixel 6a
• Pixel Fold and Pixel Tablet

GrapheneOS strongly recommends the Pixel 8 series or newer, because those devices come with a minimum guarantee of seven years of security updates from launch. The Pixel 6 and 7 families still work but reach the end of their update life earlier, so they are best treated as budget or short-term choices. Always check the current list at grapheneos.org/faq before buying, since older models are retired over time.

Step 1: Turn on Developer options and OEM unlocking

On the Pixel itself:

1. Open Settings > About phone.
2. Scroll to Build number and tap it repeatedly (about seven taps) until you see “You are now a developer”.
3. Go back to Settings > System > Developer options.
4. Turn on OEM unlocking. On some carrier-purchased phones this toggle is greyed out, which means the bootloader cannot be unlocked. This is why buying an unlocked Pixel directly from the Google Store is the safest choice.

You do not need to enable USB debugging for the web installer, so leave that off.

Step 2: Boot the phone into the bootloader

1. Power the phone off completely.
2. Hold the volume down button and keep holding it while the phone starts.
3. The phone boots into Fastboot Mode, shown with a red warning triangle and the word “Start” at the top. This is the bootloader screen. Do not press anything else here.

Step 3: Open the web installer and connect

1. On your computer, go to grapheneos.org/install/web in your Chromium browser (not a private or incognito window).
2. Plug the phone into the computer with the USB-C cable.
3. Follow the page down to the unlocking section and press Unlock bootloader.
4. A browser dialog asks you to choose a USB device. Select the phone and click Connect.

If the phone does not appear, try the other end of the cable, a different port, or remove any USB hub or adapter.

Step 4: Unlock the bootloader

1. With the installer connected, press the Unlock bootloader button on the web page.
2. On the phone, a screen asks you to confirm. Use the volume buttons to highlight the confirmation and the power button to select it.
3. The phone wipes itself and unlocks. This is expected. An unlocked bootloader is required before any new operating system can be written.

Step 5: Download and flash GrapheneOS

1. On the web installer, press Download release. The browser fetches the official factory images. This can take a few minutes depending on your connection.
2. Once the download finishes, press Flash release.
3. Do not touch the cable or the phone while it flashes. The process writes the operating system and shows progress in the browser. It usually takes several minutes.
4. Wait for the page to confirm the flash is complete.

Step 6: Relock the bootloader (do not skip this)

This step is what makes GrapheneOS secure, so it matters as much as the flash itself.

1. On the web installer, press Lock bootloader.
2. On the phone, confirm with the volume and power buttons. The phone wipes once more.

Relocking turns on verified boot, which checks at every startup that the system software has not been tampered with. A phone left with an unlocked bootloader is far less secure, because someone with physical access could modify it. Never leave the bootloader unlocked after installing.

Do not worry: GrapheneOS is signed so that relocking works correctly with it. This is different from generic Android modding, where relocking can brick the device.

Step 7: First setup and disabling OEM unlocking

1. Unplug the phone and let it start normally into GrapheneOS.
2. Work through the setup screens (language, Wi-Fi, PIN or passphrase).
3. Near the end of setup, GrapheneOS offers to turn OEM unlocking back off. Accept this. It prevents the bootloader from being unlocked again without your knowledge.

Set a strong screen lock. A six-digit PIN or, better, a passphrase protects the encryption that keeps your data unreadable if the phone is lost or seized.

Step 8: Add Google Play so banking and travel apps work (optional)

GrapheneOS ships with no Google apps. Many everyday apps run fine without them, but some banking, payment, and travel apps expect Google Play services. GrapheneOS solves this with sandboxed Google Play: the real Google Play services and Play Store installed as ordinary apps with no special system privileges.

1. Open the Apps application that comes with GrapheneOS (this is the built-in GrapheneOS App Store).
2. Select Google Play services and install it. This installs Play services, the Play Store, and the Services Framework together.
3. Open the Play Store, sign in with a Google account if you wish, and install your apps.

Because these run inside the normal app sandbox, Google Play gets no more access than any other app. You control its permissions and can even keep it confined to a separate user profile. For a fuller comparison with other de-Googled systems, see De-Googled Android without breaking your daily apps.

Staying updated

GrapheneOS updates itself automatically over the air. The built-in updater checks roughly every few hours when you are on Wi-Fi or an allowed network, downloads new releases in the background, and applies them on the next restart. Security patches often arrive faster than the standard monthly Android schedule, so the best thing you can do is simply restart the phone when it asks.

If something goes wrong

• Phone not detected: switch cable ends, use a direct port, remove hubs, and make sure you are in Fastboot Mode.
• OEM unlocking greyed out: the phone is carrier-locked and cannot be used; an unlocked Pixel is required.
• Flash interrupted: do not panic. Keep the phone in Fastboot Mode, reconnect, and run the flash again from the web installer.
• Still stuck: the official install guide and the GrapheneOS community forum at grapheneos.org walk through every screen with troubleshooting notes.