Is it hard to install GrapheneOS?

Not technically difficult if you follow the official installer and don't skip steps, but it does require comfort with developer settings, USB debugging, and the concept of bootloader unlocking. Most delays or mistakes come from rushing, using an outdated guide, or interrupting the process partway.

Yes. Installing GrapheneOS wipes the device completely as part of unlocking the bootloader. Back up anything you need before you start — there is no way to install alongside the existing OS or recover data afterward.

Which Pixel models support GrapheneOS?

The GrapheneOS Project maintains the current supported device list on their own site, which changes as older models age out of support and new Pixels launch. Check grapheneos.org before purchasing a device specifically to install GrapheneOS on it.

Can I install GrapheneOS on a phone bought secondhand?

Yes, provided it's a supported Pixel model, isn't carrier-locked in a way that blocks bootloader unlocking, and isn't still linked to a previous owner's Google account with Factory Reset Protection enabled. Confirm both before buying.

What if I don't want to do this myself?

That's exactly the gap SOVEREIGN fills. We install the identical, official, unmodified GrapheneOS release, apply a documented hardening profile, configure Sandboxed Google Play and a curated app set if your package includes it, and attest the device with a published boot fingerprint — all before it ships to you.

← All guides/

Getting started

How to Install GrapheneOS

The full process, on your own Pixel, start to finish. And an honest look at what it actually takes versus buying a device that's already done.

GrapheneOS is free, open-source, and the GrapheneOS Project publishes the full install process for anyone to follow. If you're comfortable with a bit of technical setup, you can install it on your own Pixel yourself. Here's exactly how, and what to weigh before you start.

What you need

A supported Google Pixel device — GrapheneOS only runs on Pixel hardware
A computer running Windows, macOS, or Linux, with a Chromium-based browser (Chrome, Edge, Brave) for the official web installer
A USB-C cable that supports data transfer, not just charging
Roughly 30–45 minutes, including download and flash time
A full backup of anything on the device already — the process wipes it completely

The installation process

Follow these in order. The official web installer automates most of this, but understanding each step matters — it's how you catch a problem if one comes up.

01
Back up and factory reset current data
Installing GrapheneOS wipes the device entirely. Back up anything you need from the phone's current OS first — there's no way to recover data after flashing begins.
02
Enable OEM unlocking and USB debugging
On the Pixel's current OS: Settings → About phone → tap Build number seven times to enable Developer options. Then Settings → System → Developer options → enable both OEM unlocking and USB debugging.
03
Use the official GrapheneOS web installer
Go to the GrapheneOS Project's official install page and use their browser-based installer — it runs entirely in your browser via WebUSB, downloads the correct build for your specific Pixel model automatically, and walks through unlocking the bootloader, flashing the OS, and locking it again. Only ever use the GrapheneOS Project's own install page — never a third-party mirror or video-linked download.
04
Unlock the bootloader
The installer will prompt you to unlock the bootloader, which wipes the device and enables it to accept a non-stock OS image. This step is where GrapheneOS diverges from a stock Android update — it's a deliberate, reversible unlock that Pixel hardware supports by design.
05
Flash GrapheneOS
The installer flashes the current stable GrapheneOS build to the device. This takes a few minutes and shouldn't be interrupted — keep the USB cable connected and the browser tab open throughout.
06
Re-lock the bootloader
This is the step that's easy to skip and matters most. Re-locking the bootloader after flashing restores Verified Boot — the cryptographic proof that the exact OS you installed hasn't been tampered with since. A GrapheneOS install with the bootloader left unlocked loses this guarantee entirely. The official web installer handles this automatically as its final step.
07
Complete first boot and verify
Power on, work through the minimal setup wizard, then check Settings → About phone → Device identifiers → Verified boot state. It should read "Boot verified" with a fingerprint hash. Compare that hash against the GrapheneOS Project's own published values at grapheneos.org/install/fingerprints — if it doesn't match exactly, something went wrong and you should reinstall.

What to consider before you start

It's genuinely free

GrapheneOS costs nothing. The GrapheneOS Project publishes the full install process, and a technically comfortable person can complete it themselves in under an hour with no purchase required.

One mistake and you're reinstalling

Interrupting the flash, using an outdated guide, or skipping the re-lock step doesn't brick the phone, but it does mean starting over — or worse, running an insecure configuration without realising it.

There's no hardening applied by default

A fresh GrapheneOS install is a strong, secure baseline — but it's not configured for any specific threat model. Sandboxed Google Play, auto-reboot timers, duress passwords, network permission defaults, and app selection are all decisions you make yourself, one by one, after install.

Support is community-based

The GrapheneOS community and documentation are genuinely good, but if something goes wrong at 11pm before a trip, you're troubleshooting it yourself.

After you install

A fresh install is secure by default, but not hardened to any particular threat model. From here you'll typically want to set a strong passphrase, decide whether to install Sandboxed Google Play, review network and sensor permissions app by app, set an auto-reboot timer, and consider a duress password. Our What Is GrapheneOS guide covers how the encryption and Verified Boot model works if you want the background on why each of these matters.

Frequently asked questions

Is it hard to install GrapheneOS?: Not technically difficult if you follow the official installer and don't skip steps, but it does require comfort with developer settings, USB debugging, and the concept of bootloader unlocking. Most delays or mistakes come from rushing, using an outdated guide, or interrupting the process partway.
Will I lose my data?: Yes. Installing GrapheneOS wipes the device completely as part of unlocking the bootloader. Back up anything you need before you start — there is no way to install alongside the existing OS or recover data afterward.
Which Pixel models support GrapheneOS?: The GrapheneOS Project maintains the current supported device list on their own site, which changes as older models age out of support and new Pixels launch. Check grapheneos.org before purchasing a device specifically to install GrapheneOS on it.
Can I install GrapheneOS on a phone bought secondhand?: Yes, provided it's a supported Pixel model, isn't carrier-locked in a way that blocks bootloader unlocking, and isn't still linked to a previous owner's Google account with Factory Reset Protection enabled. Confirm both before buying.
What if I don't want to do this myself?: That's exactly the gap SOVEREIGN fills. We install the identical, official, unmodified GrapheneOS release, apply a documented hardening profile, configure Sandboxed Google Play and a curated app set if your package includes it, and attest the device with a published boot fingerprint — all before it ships to you.

Would rather it arrive already done?

Every SOVEREIGN device ships with official, unmodified GrapheneOS, hardened to a documented profile and attested before it leaves us — no bootloader unlocking required on your end.

View packages →What is GrapheneOS?

Last updated: July 2026. GrapheneOS is a trademark of the GrapheneOS Project. Always use the GrapheneOS Project's own official installer at grapheneos.org — never a third-party mirror. SOVEREIGN is not affiliated with or endorsed by the GrapheneOS Project.