Description

GrapheneOS is a privacy and security focused mobile operating system with Android app compatibility, developed as a non-profit open source project since 2014 (it was originally known as CopperheadOS). It starts from the Android Open Source Project and rebuilds the security model underneath: a fortified app sandbox, a hardened memory allocator, per-app network and sensor permissions, and complete verified boot. It ships with no Google apps or Play services at all — those can only be installed as ordinary sandboxed apps inside a profile, where they get no special privileges.

Key Features

• Hardened exploit mitigations — hardened_malloc, a hardened libc and app runtime, and a secure application spawning system that closes off whole classes of memory-corruption attacks.
• Sandboxed Google Play — Play Store and Play services are optional and run as regular apps inside a user or work profile, with the same sandbox as everything else.
• Network and Sensors permission toggles — revoke internet or sensor access per app, and per profile, on top of the standard Android permission model.
• Verified boot and hardware attestation — boot chain verification plus the Auditor app, which can verify a device locally or remotely against a trusted key.
• Vanadium — a hardened Chromium build used as both the default browser and the system WebView.
• Storage Scopes, Contact Scopes and Secure Paste — give an app only the files or contacts you pick, and control clipboard access per app instead of handing over the whole store.
• Physical port control — USB-C and pogo pin data can be disabled, or the port switched off entirely, to remove that attack surface.
• Profiles and anti-persistence — up to 32 user profiles, support for 128-character device passwords, a five-attempt fingerprint limit and reboot options that clear memory.
• First-party apps — Camera, PDF Viewer, the Auditor attestation app and Seedvault encrypted backups, all built to the same privacy standard as the OS.

Why Use GrapheneOS?

Most privacy ROMs add a blocker or two on top of stock Android. GrapheneOS works on the layer below — the sandbox, the allocator, the patch level — which is where targeted exploitation actually happens. The point is that you do not have to give up normal apps to get it: Play Store apps still install and work, they just do not come with system privileges attached.

Use Cases

• Journalists, activists and others with a threat model that includes targeted attacks rather than just ad tracking
• Replacing stock Android on a Pixel with something that gets security patches faster
• A hardened second profile on the same phone for sensitive work
• Using Play Store apps without granting Google’s services system-level access
• Verifying a device’s integrity remotely with hardware attestation

Supported devices

Official builds are Pixel-only: Pixel 6 and newer, plus Pixel Fold and Pixel Tablet. That restriction is deliberate — verified boot and the hardware security features the OS depends on are only fully available on Google’s hardware.

Related

Compare with CalyxOS, LineageOS and /e/OS.

Licence

MIT for GrapheneOS’s own code, with Apache-2.0 and other licences inherited from the Android Open Source Project it is built on.