GrapheneOS is the locked phone Cellebrite says it cannot exploit
GrapheneOS is the phone operating system that the unlock tools used by police list as the one they cannot break into, when the phone is locked and the updates are on. Cellebrite sells that equipment to police and intelligence customers. In its July 2024 Premium support matrix, which the GrapheneOS project published, a locked GrapheneOS phone was still not exploitable unless it was missing patches from 2022. Stock Android, on the same sheets, they list as exploitable. The project's reading of Cellebrite's January 2025 documentation is unchanged: no exploit for a GrapheneOS build patched after mid-2022, and no practical exploit against a current one, while iOS and stock Android remain on the list. In October 2025, 404 Media reviewed a leaked Cellebrite sales slide: a stock Pixel 9 could be opened before the first unlock, and a Pixel 9 running GrapheneOS could not.
That record has a boundary. It is not a finding that every intelligence service is finished. The sheets describe Cellebrite's exploit product, not a lab that has never leaked. Hand over the PIN, or leave the phone unlocked, and no exploit is required: they copy the filesystem the ordinary way. The project treats the next exploit as a matter of time, which is why a locked phone reboots itself, 18 hours after it was locked in the note published with that matrix, so the data is at rest again. On the same matrix, brute force had still not got past the Titan M2 secure element in a Pixel 6 or later. A long passphrase is what you use if you do not want to depend on that chip staying ahead of them.
It is still a Pixel operating system. It does not ship Google's apps, it runs the Android apps you install, and Play can go in a sandbox. It will not make you private to your carrier, or to an account you sign into. The rest of this page is which phone to buy and what changes. The part above is why people put it on the phone.
What those unlock tools can and cannot do
| State of the phone | Current GrapheneOS | Stock Android |
|---|---|---|
| Locked, before the first unlock since boot | Not exploitable if patched after 2022 | Listed as exploitable, across the major brands |
| Locked, but unlocked once since boot | Same, on those sheets. The reboot puts it back in the row above. | Listed as exploitable |
| Unlocked, or they have the PIN | Full copy. No exploit involved. | Full copy |
The USB port refusing data while the phone is locked is part of the same defense. So is keeping the updates on: the sheets' exception is an old patch level, not a special phone. Cellebrite's advanced lab, the project notes, might try to pull key material out of the hardware itself, and calls that difficult. That is a different job from the exploit box police carry to a search.
Which Pixel to buy
Buy a Pixel 8 or anything newer in that line, including the later Folds and the a-series. GrapheneOS tells you to: from the eighth generation on, the update guarantee is seven years, and the phone has hardware memory tagging, which the OS enables by default. Older Pixels still get builds. The project tells you not to buy those.
| Phone | Buy it for this | Updates |
|---|---|---|
| Pixel 8, 9 and 10, including the a-series and the later Folds | Yes | Seven years from launch. A Pixel 8 runs to October 2030; a Pixel 10 to August 2032; a Pixel 10a to March 2033. |
| Pixel 7, 7 Pro, 7a, the original Pixel Fold, Pixel Tablet | Only if you already own it | Five years. The 7 and 7 Pro run to October 2027, the 7a to May 2028, and the Fold and Tablet to June 2028. |
| Pixel 6 and 6 Pro | No | The guarantee ends in October 2026. After Google stops, any further GrapheneOS release is a stopgap, not a full patch. |
| Pixel 6a | No | July 2027, and it is not on the buy list. No memory tagging. |
| Anything that is not a Pixel | No | No official build. The project’s position is that most other hardware cannot be made reasonably secure, however much work the software gets. |
The month-by-month list is on the FAQ. Don’t plan on Google publishing patches past the month in that table. A carrier phone can be a separate dead end: US carriers in particular often ship Pixels with the bootloader unlock removed, and without that unlock the installer cannot run. Buy an unlocked phone.
What you will actually notice
The home screen is still Android. The changes that matter are the ones an app feels.
Storage Scopes and Contact Scopes let an app believe it has the permission it demanded, while seeing nothing. A messenger that refuses to open unless it can read every contact can be given Contact Scopes and then no contacts at all, or one contact, or one group. It cannot write your address book. Storage Scopes is the same trick for files: the app sees what it created, and anything else only if you hand it that file. Turn either one on before you grant the real permission. Once the real permission is granted, Scopes isn’t available.
Lock the phone and the USB-C port stops accepting new data connections. Charging still works. The default is charging-only while locked, under Settings, Security, Exploit protection. That is the practical answer to a cable in a public port, not a separate app.
Profiles are the other daily control. Each one has its own encryption key. You can end a secondary profile from the power menu, which throws that key out of memory without rebooting. The owner profile can’t do that: it holds system data, so it stays decrypted until you reboot, and other profiles won’t open after a reboot until the owner has unlocked once. Put the apps that need Google in a secondary profile and you can shut that profile when you aren’t using them.
The bundled browser is Vanadium, a hardened Chromium, and the same engine is the WebView inside other apps. The project’s advice on it is to skip the pile of privacy extensions: they add state that makes the browser easier to tell apart. Anonymous browsing is a different tool: Tor Browser.
Updates are automatic. The update check sends the device model and the OS version, because both are in the URL, and the project says there is no analytics on top of that. There is no account in the request.
Sandboxed Google Play
Google Play is allowed. It is not part of the operating system, and the OS does not use it as the backend for its own services, including when Play is installed. You install Play services from the GrapheneOS app store, into one profile. Only apps in that profile can see it, and they have to opt in. Play cannot read another app’s private data unless you grant it what any other app would need.
Signing in is optional until you want the Play Store to install something. The Store wants a Google account. An app that logs in with Google wants one too. If you sign in, Google knows that account is on this phone. The sandbox limits what the Play process can take from the device. It does not limit what you type into a Google login.
Location is the setting people miss. By default, apps that ask Play for a location are handed the operating system’s location instead, so you don’t grant Play the location permission for maps to work. Turn that rerouting off only if you specifically want Google’s network location. Managing an eSIM is a system toggle and does not need Play installed.
Banks, Android Auto, and apps that refuse the phone
Most banking apps want Play services in the same profile, and that is often enough. Some then ask Google whether the OS is a certified Pixel build. GrapheneOS passes the basic integrity check, fails the certified-profile check, and will not fake the pass. The phone can answer that check in hardware, which is why GrapheneOS will not spoof it: a faked software answer stops working once the app asks the hardware. If the app says the phone is compromised, install Play in that profile and try again before you give up on the OS. One exploit-protection switch, native code debugging, also breaks apps that debug themselves: turn it back on if you had turned it off. A community list of banking apps is linked from the usage guide. GrapheneOS does not vouch for it.
Android Auto is the other special case. It needs privileges a normal app doesn’t get, so it isn’t part of the baseline sandbox. Install it from the GrapheneOS app store, not from Play, then turn on the wired or wireless permission in the sandboxed Play settings. Wired needs less access than wireless. Some cars want the wireless permission even on a cable.
What a new operating system cannot hide
Connecting to a carrier means identifying the phone to that network. Airplane mode is the switch GrapheneOS names for stopping that: it shuts the cellular radio off, and Wi-Fi can come back on without waking it. An LTE-only mode exists to shrink the attack surface. It does not make the network trustworthy. Calls and ordinary texts still trust the carrier. Use an encrypted messenger for the conversations that matter. Which one, and what its server still sees, depends on who you’re hiding from, not on the phone’s OS.
A VPN changes who can read the sites in your traffic. It does not stop the tower knowing the SIM is there. The VPN page is that choice. The same split applies to every login: the OS can keep Play from being a privileged system component, and it cannot keep a bank, a mail provider or a social network from recognising the account.
Encryption covers the phone when the profile is locked, and a secondary profile you have ended is locked in that stronger sense. An unlocked phone in someone’s hands is an unlocked phone. There is no Factory Reset Protection tying the device to a Google account after a wipe. The project treats that feature as theft deterrence, not security. A stolen phone can be erased and resold. Your data is not on it if the wipe happened, and the thief is not stuck at a Google login.
Whether to install it
- You will buy a Pixel 8 or newer and you can spare an evening
- Install GrapheneOS yourself with the project’s web installer. Don’t buy a phone someone else has already flashed. The project endorses no seller, and a preinstalled device still has to be checked and factory reset before you trust it.
- One app you can’t live without fails the certified-OS check
- Stay on the stock Pixel, or confirm that app on a GrapheneOS phone before you move your number. A hardened OS you abandon in a week because the bank app quit is a worse phone than the one you had.
- You want updates and you will not reinstall an operating system
- A current iPhone, or a Pixel left on stock with updates on. That is the baseline on the privacy tools page. GrapheneOS is the step past it, for a Pixel you are willing to wipe.
The web installer is the method the project recommends for almost everyone. There is a command-line path for people who don’t want to trust the download server. Third-party walkthroughs are what the FAQ tells you to skip: they go stale, and they get steps wrong. If setup then warns that the bootloader is unlocked, the install is not finished. Locking it erases the phone, so do that before you add an account or a photo. GrapheneOS does not support a phone left unlocked.