GrapheneOS is a privacy and security focused version of Android that runs on Google Pixel phones. It comes up constantly in privacy communities, and it is one of the few reasons people go looking for a specific used phone rather than whatever is cheapest. This guide covers what GrapheneOS actually is, how it works day to day, whether it is worth your time, and which used Pixel to buy so the install does not hit a wall.
Quick Answer
GrapheneOS is a free, open-source Android build with hardened security, granular app permissions, and no Google services installed by default. It only runs on Google Pixel hardware, and it requires a Pixel whose bootloader can be unlocked, which rules out most carrier-branded models. The Pixel 8a, Pixel 9a, and Pixel 9 are the best value picks right now because they pair low used prices with update support running into the 2030s. Buy the unlocked version, not a carrier variant.
What GrapheneOS Is
GrapheneOS is built on the Android Open Source Project, the same public codebase that underpins every Android phone. The project strips out Google’s proprietary services, then adds its own hardening on top: a stricter memory allocator, exploit mitigations, a hardened Chromium-based browser called Vanadium, and permission controls that stock Android does not offer.
It is not a “de-Googled ROM” in the loose sense the term usually carries. The project’s stated priority is security first and privacy second, on the logic that privacy without security is theater. That focus is why it refuses to run on hardware it considers inadequate.
It is also free. There is no license, no subscription, and no account to create. The cost of running GrapheneOS is the cost of a compatible phone, which is where the used market comes in.
Why GrapheneOS Only Runs on Pixels
This is the part that surprises people. GrapheneOS supports Google Pixel devices and nothing else, and the reason is a short list of hardware requirements that almost no other Android phone meets at once:
- Unlockable bootloader with re-lockable verified boot. You need to unlock the bootloader to install a different OS, then lock it again afterward so the phone still verifies its own software at boot. Most manufacturers let you do the first part and not the second.
- Full firmware and driver updates for the life of the device. GrapheneOS cannot patch firmware it does not receive.
- A secure element. Pixels use Google’s Titan chip for key storage and for rate-limiting passcode guesses.
- Hardware Memory Tagging Extension (MTE), which catches entire classes of memory bugs before they become exploits.
- Isolated cellular radio, so the baseband cannot reach into main memory.
Pixels from the 6 series onward hit all of these, and Google publishes update timelines you can plan around. That combination, rather than any affinity for Google, is why the hardware list is so short.
That may change. At MWC 2026, GrapheneOS and Motorola announced a partnership targeting officially supported non-Pixel devices as early as 2027, made possible by secure element improvements on Qualcomm’s side. Nothing has shipped yet, and no specific Motorola models have been named. For anything you buy today, Pixel is still the answer.
How GrapheneOS Works Day to Day
The first thing you notice is what is missing. There are no Google apps, no Play Store, and no Google account prompt during setup. The second thing you notice is that the phone otherwise behaves like Android, because it is Android.
Sandboxed Google Play
Most people still need some Google-dependent apps. GrapheneOS handles this with sandboxed Google Play: Play Services installs as an ordinary app with ordinary permissions and no system-level privileges. It cannot silently reach your data the way it can on a stock phone, and you can confine it to a single user profile so the rest of the device never touches it.
This is the single biggest practical difference from other privacy-focused Android builds, most of which either bundle Google services with full privileges or block them entirely.
Per-App Network and Sensor Permissions
Stock Android has no way to tell an app it may not use the internet. GrapheneOS adds a network permission and a sensors permission, both revocable per app. A flashlight app can be denied the network outright. A note-taking app can be cut off from the gyroscope, barometer, and compass.
Storage and Contact Scopes
Instead of granting an app your whole photo library or your entire address book, you grant it a scope: specific files, specific contacts. The app believes it has full access and simply sees a very small world. This keeps apps working that would otherwise refuse to run without broad permissions.
Profiles
GrapheneOS leans hard on Android’s multi-user support, with more profiles allowed than stock Android and better controls over them. A common setup is one profile for banking and personal use, one for Google-dependent apps, and one for anything you do not trust. Data does not cross between them.
Why You Might Care, and Who Should Skip It
The honest case for GrapheneOS is narrow but real. If your threat model includes targeted attacks, if you handle sensitive material for work, if you are a journalist or an activist, or if you simply object to the amount of data a stock Android phone reports back, the hardening is meaningful rather than cosmetic.
The honest case against it is app compatibility. Banking apps are the usual casualty: many rely on Google’s device attestation and refuse to run on a device that fails the check, though a good number now work fine. Google Wallet and tap-to-pay do not work, so you lose contactless payments from the phone. Anything tied tightly to Google’s ecosystem gets rougher.
If you use tap-to-pay daily, depend on a bank with a hostile app, or do not want to spend an afternoon setting up a phone, stock Android on a Pixel is already one of the better-updated and better-secured options available. For a broader look at the hardware itself, see Used Google Pixel Buyer’s Guide: Which Pixel Is Worth It.
Which Used Pixels Support GrapheneOS
Every Pixel from the 6 series forward is supported, but “supported” splits into two tiers. Full support lasts as long as Google ships firmware for the device. After that, GrapheneOS may publish extended support releases as harm reduction, and the project is blunt that these cannot deliver complete security patches and are meant as a bridge while you move to newer hardware.
That makes the manufacturer support end date the number that matters most when you shop. Each model below links to its Swappa listings page. Prices reflect recent Swappa starting prices and move with supply, so check the live page before you commit. Note that unlocked versions usually run $20 to $60 above the carrier version of the same model, which is the premium you are paying for a bootloader you can actually unlock.
| Pixel model | Support ends | Tier | Used price range |
|---|---|---|---|
| Pixel 6 / 6 Pro | October 2026 | Expiring now | $170 to $210 |
| Pixel 6a | July 2027 | Short runway | $130 to $170 |
| Pixel 7 / 7 Pro | October 2027 | Short runway | $160 to $200 |
| Pixel 7a | May 2028 | Short runway | $130 to $190 |
| Pixel Fold | June 2028 | Short runway | $360 and up |
| Pixel 8 / 8 Pro | October 2030 | Full support | $215 to $330 |
| Pixel 8a | May 2031 | Full support | $204 to $250 |
| Pixel 9 / 9 Pro | August 2031 | Full support | $330 to $420 |
| Pixel 9a | April 2032 | Full support | $280 to $330 |
| Pixel 10 / 10 Pro | August 2032 | Full support | $405 and up |
| Pixel 10a | March 2033 | Full support | $330 and up |
The picks that make sense today are the Pixel 8a and the Pixel 9a. Both sit in the low-to-mid hundreds used, and both have five years or more of firmware updates left. The Pixel 8 is the value flagship of the group, and the Pixel 8 Pro adds the telephoto camera for roughly $100 more. If you want the longest runway available, the Pixel 10 and Pixel 10a are supported into 2032 and 2033.
Avoid the Pixel 6 and 6 Pro for a new GrapheneOS build. Google’s support window closes in October 2026, which means extended-support releases almost immediately. The Pixel 7 and Pixel 7a are better short-term buys but still run out in 2027 and 2028. If you are weighing an older device you already own, Keeping an Older Device Secure After Updates End covers what actually changes when patches stop.
The Unlocked Pixel Requirement
This is where most GrapheneOS attempts fail, and it happens after the money has changed hands.
Installing GrapheneOS requires toggling OEM unlocking in developer options. On carrier-branded Pixels, particularly Verizon models, that toggle is greyed out permanently. The phone is otherwise identical hardware, and there is no workaround. You cannot enable it by paying off the device, by getting a carrier unlock for SIM purposes, or by any software trick.
Carrier SIM unlocking and bootloader unlocking are two different things. A phone can be fully SIM-unlocked, usable on any network, and still refuse to unlock its bootloader. Listings that say “unlocked” often mean only the first. Unlocked vs. Carrier-Locked Phones: What It Means When Buying Used breaks the distinction down in full.
What to look for when buying:
- A Google Store or unlocked retail model, not a carrier variant. Swappa lists carrier and unlocked versions separately, so filter for unlocked before you browse.
- No carrier branding in the listing photos or boot animation.
- Ask the seller to confirm that OEM unlocking is available in developer options. It takes them one minute to check.
- A clean IMEI and no account locks, which Swappa’s staff review already requires on every listing. Google account locks are covered in Android FRP: How to Avoid a Locked Used Phone.
Browse verified unlocked Google Pixel listings at swappa.com/buy/unlocked/google.
How to Install GrapheneOS
The official method is a web installer that runs in Chrome, Edge, Brave, or another Chromium browser. It takes roughly 20 to 40 minutes on a first attempt, and it does not require you to type fastboot commands by hand.
- Charge and back up. The process erases the phone twice. Nothing survives it.
- Enable developer options, then turn on OEM unlocking. If the toggle is greyed out, stop here: that device cannot run GrapheneOS.
- Boot into fastboot mode by holding volume down while powering on.
- Connect to a computer with the phone’s own USB-C cable, plugged into a port on the machine itself rather than a hub.
- Open the web installer at grapheneos.org/install/web and follow the prompts to unlock the bootloader, download the factory images, and flash the release.
- Re-lock the bootloader when the installer tells you to. This restores verified boot and is not optional if you care about the security model.
- Boot GrapheneOS, finish setup, and turn OEM unlocking back off.
If you are installing on a phone you are moving off of, wipe the old device properly first. How to Wipe Your Device Before Selling covers the sign-out steps that matter, and if you plan to sell it, see what it is worth on Swappa.
What to Check Before You Buy
Before you pay for a used Pixel earmarked for GrapheneOS:
- Support window. Confirm the model’s firmware support runs at least two or three years past your purchase date.
- Unlocked status. Bootloader unlockable, not just SIM unlocked.
- Battery condition. Pixels in the 6 and 7 generations are old enough that battery wear is real. The listing should describe it.
- Storage size. Multiple user profiles consume space faster than a single-profile phone. 128GB is a floor, 256GB is comfortable.
- Physical condition. Standard used-phone diligence applies, and How to Test a Used Device Before You Buy walks through the checks.
Every Swappa listing is staff reviewed before it goes live, with clean IMEI and no activation locks as listing requirements, which removes the two failure modes that most often turn a cheap private-sale Pixel into a paperweight.
FAQ
Is GrapheneOS legal?
Yes. GrapheneOS is free, open-source software, and installing a different operating system on hardware you own is legal in the US. Unlocking the bootloader typically voids the manufacturer warranty, which is a separate matter from legality and rarely relevant on a used phone.
Does GrapheneOS work with Google Pay or tap-to-pay?
No. Google Wallet does not function on GrapheneOS, so you lose contactless payments from the phone. This is the compatibility gap most people notice first, and there is no workaround at present.
Will my banking app work on GrapheneOS?
Sometimes. Apps that rely on Google’s Play Integrity attestation may refuse to run, though many banks have relaxed this. The GrapheneOS community maintains an app compatibility list, but the only reliable test is installing your specific apps and trying them.
Can I install GrapheneOS on a Samsung Galaxy or OnePlus phone?
No. GrapheneOS supports Google Pixel devices only. A Motorola partnership announced in 2026 targets non-Pixel support as early as 2027, but nothing is available today.
Does GrapheneOS support the Pixel 11?
Not officially as of September 2026. The Pixel 11 shipped with Memory Tagging Extension disabled in firmware, and GrapheneOS is still evaluating whether it can be enabled reliably. If you want a device that works now, buy a Pixel 8, 9, or 10 series model instead.
Can I go back to stock Android later?
Yes. Google publishes factory images for every Pixel, and reverting is the same flashing process in reverse. Restoring stock Android also makes the phone easier to resell, since most buyers expect the stock OS.
The Bottom Line
GrapheneOS is the strongest privacy option available on a mainstream phone, and the barrier to entry is lower than its reputation suggests: a supported Pixel, an unlocked bootloader, and half an hour. The mistakes that cost people money are buying a carrier-branded Pixel that will never unlock, or buying a Pixel 6 or 7 whose firmware support expires in the next year.
Spend the extra $50 to $100 on an unlocked Pixel 8a or Pixel 9a instead of a cheap carrier Pixel 6. The support runway is worth more than the discount, and used Pixel prices move constantly, so compare current listings before you buy.
