been installing grapheneos on pixels for 2+ years. here's the complete step-by-step guide with actual 2025 instructions, direct links to official sources, and real-world tips from someone who's done this dozens of times.

this isn't theory. this is the exact process that works every time.

SUPPORTED DEVICES (2025 CURRENT LIST):
grapheneos only works on google pixels due to hardware security requirements:

RECOMMENDED (7-year support guarantee):
- pixel 9 pro fold, pixel 9 pro xl, pixel 9 pro, pixel 9, pixel 9a
- pixel 8 pro, pixel 8, pixel 8a

STILL SUPPORTED (5-year support guarantee):
- pixel 7 pro, pixel 7, pixel 7a
- pixel 6 pro, pixel 6, pixel 6a
- pixel tablet, pixel fold

source: https://grapheneos.org/faq

why only pixels? they're the only phones with:
- unlockable bootloaders with maintained security
- verified boot implementation
- hardware security modules (titan m/m2 chips)
- guaranteed 5-7 years of security updates
- proper alternate os support

WHAT YOU NEED BEFORE STARTING:
hardware requirements:
- supported google pixel (buy carrier-unlocked, not verizon/at&t variants)
- usb-c cable (use the one that came with your pixel)
- computer with 2gb ram + 32gb free storage
- internet connection

software requirements:
- updated web browser: chrome, edge, brave, or chromium
- avoid: firefox, safari, incognito mode, flatpak/snap browsers

CRITICAL: backup everything. installation wipes your phone completely.

STEP 1: PREPARE YOUR PIXEL
update to latest android:
settings > system > system update > install any available updates

enable developer options:
1. settings > about phone
2. tap "build number" 7 times until it says "you are now a developer"
3. settings > system > developer options
4. toggle on "oem unlocking"
5. toggle on "usb debugging"

IMPORTANT: pixel 6a users must update to june 2022 or later, then factory reset before oem unlocking works.

source: https://grapheneos.org/install/web

STEP 2: INSTALL USING WEB INSTALLER (RECOMMENDED)
this is the easiest method. grapheneos built a web-based installer that handles everything automatically.

1. connect pixel to computer via usb
2. open web browser and go to: https://grapheneos.org/install/web
3. select your exact pixel model from the dropdown
4. follow the on-screen instructions

the web installer will:
- detect your device automatically
- download the correct grapheneos image
- unlock your bootloader
- flash grapheneos
- relock your bootloader for security

typical install time: 15-30 minutes

STEP 3: BOOTLOADER UNLOCKING
when prompted by the web installer:

1. your pixel will reboot into bootloader mode
2. you'll see a warning about unlocking bootloader
3. use volume buttons to select "unlock the bootloader"
4. press power button to confirm
5. device will wipe and reboot

this step is irreversible and wipes all data.

STEP 4: GRAPHENEOS INSTALLATION
the web installer automatically:
- downloads latest grapheneos release for your device
- flashes firmware and operating system
- handles all technical details

you'll see progress updates in your browser. don't disconnect usb cable during this process.

STEP 5: RELOCK BOOTLOADER
critical security step:

1. web installer will prompt to relock bootloader
2. follow on-screen instructions
3. confirm on your pixel using volume/power buttons
4. device will reboot into grapheneos

relocking the bootloader enables verified boot and passes safetynet checks.

FIRST BOOT AND SETUP:
after installation completes:

1. pixel boots into grapheneos setup
2. select language and region
3. connect to wifi (use trusted network)
4. set strong pin/password (6-digit minimum)
5. skip google account setup
6. complete initial setup

grapheneos is now installed and ready to use.

ALTERNATIVE: COMMAND LINE INSTALLATION
for advanced users who want more control:

full cli instructions: https://grapheneos.org/install/cli

requires:
- terminal/command prompt knowledge
- android platform tools (adb/fastboot)
- manual download of grapheneos images

most users should stick with the web installer.

POST-INSTALLATION ESSENTIALS:
install apps:
- f-droid: open source app store
- aurora store: google play apps without google account
- obtainium: direct updates from developers

optional: sandboxed google play
if you need google apps (banking, uber, etc):
1. apps > install apps
2. install "google play services"
3. install "google play store"
4. sign in with google account

these run sandboxed without system privileges.

WHAT WORKS PERFECTLY:
- banking apps (chase, wells fargo, venmo)
- ride sharing (uber, lyft)
- social apps (signal, telegram, instagram)
- productivity (zoom, slack, office apps)
- streaming (spotify, youtube, netflix)
- nfc payments (google pay in sandboxed play)

WHAT DOESN'T WORK:
- android auto (google dependency)
- some games with anti-cheat
- google assistant voice commands
- automatic google photos backup

COMMON INSTALLATION ISSUES:
"device not detected"
- try different usb cable
- install google usb drivers (windows)
- enable usb debugging in developer options

"oem unlocking grayed out"
- ensure device is updated to latest android
- factory reset if using pixel 6a
- check that device isn't carrier locked

"installation failed"
- use official web installer only
- avoid unofficial guides or tools
- ensure sufficient storage on computer

"bootloop after installation"
- rarely happens with web installer
- try factory reset in recovery mode
- contact grapheneos support if persists

SECURITY FEATURES YOU GET:
- hardened memory allocator (catches exploits)
- network permission controls (block app internet access)
- sensor permissions (control camera, mic, location access)
- storage scopes (limit file access per app)
- verified boot (prevents malware persistence)
- regular security updates (often faster than stock android)

UPDATING GRAPHENEOS:
updates arrive monthly:
1. settings > system > system update
2. download and install automatically
3. reboot when prompted

updates maintain all your data and apps.

THREAT MODEL REALITY:
grapheneos protects against:
- corporate surveillance and tracking
- malicious apps and malware
- network-level attacks
- device exploitation
- data mining and profiling

grapheneos doesn't protect against:
- targeted government attacks with unlimited resources
- physical device access if unlocked
- social engineering and user error
- compromised apps you explicitly install

realistic protection: excellent defense against 99% of threats normal people face.

WHY GRAPHENEOS OVER ALTERNATIVES:
vs lineageos: much stronger security, verified boot, regular updates
vs calyxos: more hardened, better app sandboxing, titan chip support
vs stock android: no google surveillance, granular permissions, privacy controls
vs /e/os: actually maintained, security-focused, proper implementation

grapheneos is the gold standard for android privacy/security.

GETTING HELP:
official sources only:
- website: https://grapheneos.org
- installation guide: https://grapheneos.org/install/web
- faq: https://grapheneos.org/faq
- matrix chat: https://app.element.io/#/room/#grapheneos:grapheneos.org

avoid: unofficial guides, youtube tutorials, reddit posts
reason: they often contain outdated or incorrect information

THE BOTTOM LINE:
installing grapheneos is easier than most people think. the web installer handles all technical complexity. if you can follow step-by-step instructions and are comfortable with wiping your phone, you can do this.

total time investment: 1-2 hours including backup/restore
difficulty level: moderate (requires following directions carefully)
technical knowledge needed: minimal (web installer does the work)

your pixel becomes significantly more private and secure while maintaining 95% of normal android functionality.

considering the switch? backup your data, buy a supported pixel, and follow the official installation guide at https://grapheneos.org/install/web

your future private self will thank you.

// next post: first 24 hours with grapheneos - essential apps and settings
// practical privacy that actually improves your mobile experience