Step 2 · The Switch

Install GrapheneOS – Step by Step

Don't worry: the web installer does most of the work. Set aside roughly 30–45 minutes. You don't need any prior knowledge – just a suitable Pixel, a USB cable and a computer.

Before you start – what you'll need

📱 A suitable Pixel

A supported Google Pixel (see below). Important: don't buy a carrier-branded/"carrier-locked" model – that blocks unlocking.

💻 Computer + cable

A machine (Linux, Windows or macOS) with a current Chromium-based browser (e.g. Chrome, Edge, Brave – needed for WebUSB; Firefox won't work), plus a working USB-C data cable.

⏱️ A little time & calm

Work through the steps unhurried. Charge the Pixel above 50%. Don't unplug anything during the installation.

Back up your data & do it at your own risk: the installation wipes the device completely – back up everything important first. The old IT adage applies: no backup = no mercy. 🙂 You carry out these steps at your own responsibility; no liability is accepted for data loss or damage to the device. When in doubt, follow the official guide at grapheneos.org.

Supported devices (as of 2026)

GrapheneOS only supports Google Pixel devices – because of their hardware security. The newer the device, the longer you'll receive security updates.

Recommended (longest support) best choice

  • Pixel 10 / 10 Pro / 10 Pro XL / 10a
  • Pixel 9 series (9, 9 Pro, 9a)

Very good & cheaper

  • Pixel 8 / 8 Pro / 8a
  • Pixel 7 / 7 Pro / 7a

Still an option (budget)

  • Pixel 6 / 6 Pro / 6a
  • Support ends sooner – check the end date.
Tip: Check the current device list and each model's update end date directly on grapheneos.org. A Pixel a-model (e.g. the 9a) is usually the best value for money.

The installation in 8 steps

The official route is the web installer at grapheneos.org/install/web. It walks you through almost everything automatically. Prefer to do it by hand? Then jump to the manual command-line installation further down.

Prepare the Pixel & enable developer options

Set it up on first boot and connect to Wi-Fi (for updates). Then open Settings → About phone and tap the build number 7 times until "You are now a developer" appears.

Allow OEM unlocking

Under Settings → System → Developer options, enable the "OEM unlocking" option. If it can't be turned on (greyed out), the device is unfortunately carrier-branded and unsuitable.

Switch to the bootloader (fastboot)

Turn the device off. Then hold Volume Up + Volume Down + Power together until the fastboot menu appears. Now connect the Pixel to the computer via USB.

Open the web installer

On the computer, open grapheneos.org/install/web in a Chromium-based browser (e.g. Chrome, Edge, Brave). Read along with the steps there – the guide on this website complements them but does not replace them.

Unlock the bootloader

In the installer, click "Unlock bootloader" or run the command shown. Confirm on the Pixel using the buttons. This wipes the device. Afterwards the bootloader is open for the installation.

Flash GrapheneOS

In the installer, click "Download & verify release" and then "Flash". The installer downloads the matching factory image, verifies it cryptographically and writes it. This takes a few minutes – don't unplug anything.

Re-lock the bootloader (important!)

After flashing, run the "Lock bootloader" step. This activates verified boot with your system and protects against tampering. Do not skip this step.

Reboot & set up

Choose "Reboot" and unplug the USB. GrapheneOS starts up. Follow the initial setup and set a strong PIN/passphrase. Done – you now have a hardened, Google-free system.

Security note: Download GrapheneOS only via the official installer at grapheneos.org. Never via third-party mirrors, YouTube links or "ready-made" devices from unknown sources.

Alternative: manual installation via the command line (CLI)

The web installer above is the best route for almost everyone. If you'd rather have full control, can't use WebUSB, or are flashing your own builds, go with the manual installation via the terminal. The result is identical – you just type the steps yourself.

What you need: a machine running Linux, macOS or Windows (at least 2 GB of free RAM, 32 GB of storage), the right Pixel, a good USB-C cable (no hub) and a terminal. Step 1 (enabling developer options + OEM unlocking) is identical to the web route above – do it first.

Open a terminal

Use the same terminal window for the entire installation. On Windows, open a regular (non-administrative) PowerShell – not the old Command Prompt. Remove the interfering curl alias once:

Windows only (PowerShell) 
Remove-Item Alias:Curl

Get fastboot (platform-tools)

You need a current fastboot (at least version 35.0.1). On Arch the package is enough; otherwise use Google's official standalone platform-tools.

Arch Linux 
sudo pacman -S android-tools android-udev
Debian / Ubuntu 
sudo apt install libarchive-tools android-sdk-platform-tools-common
curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-linux.zip
bsdtar xvf platform-tools_r35.0.2-linux.zip
export PATH="$PWD/platform-tools:$PATH"
macOS 
curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-darwin.zip
tar xvf platform-tools_r35.0.2-darwin.zip
export PATH="$PWD/platform-tools:$PATH"
Windows (PowerShell) 
curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-win.zip
tar xvf platform-tools_r35.0.2-win.zip
$env:Path = "$pwd\platform-tools;$env:Path"

Tip: Check the current version & checksums on the official CLI guide – the version number here is just an example.

Check the fastboot version

It must be at least 35.0.1:

fastboot --version

Boot into the bootloader & connect the device

Turn the device off, then hold the Volume Down button while powering on until "Fastboot Mode" with a red warning triangle appears. Do not press "Start". Now connect it via USB directly to a port (no hub).

Linux note: if the connection is blocked, fwupd can interfere – stop it temporarily with sudo systemctl stop fwupd.service.

Unlock the bootloader

On the device, confirm with the volume buttons and select with Power. This erases all data.

fastboot flashing unlock

Download & verify the factory images

First download the signing key, then your device's image along with its signature. Replace DEVICE (e.g. tegu for the Pixel 9a) and VERSION with the values from the releases page.

curl -O https://releases.grapheneos.org/allowed_signers
curl -O https://releases.grapheneos.org/DEVICE-install-VERSION.zip
curl -O https://releases.grapheneos.org/DEVICE-install-VERSION.zip.sig

Verify the signature (very important!):

Linux / macOS 
ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org \
  -n "factory images" -s DEVICE-install-VERSION.zip.sig < DEVICE-install-VERSION.zip

It worked if Good "factory images" signature for contact@grapheneos.org appears. If it doesn't: do not continue and download again.

Extract & flash

Extract the archive, switch into it, and run the flash script. The script flashes firmware + OS and reboots the device several times automatically – don't unplug anything.

Linux 
bsdtar xvf DEVICE-install-VERSION.zip
cd DEVICE-install-VERSION
bash flash-all.sh
macOS 
tar xvf DEVICE-install-VERSION.zip
cd DEVICE-install-VERSION
bash flash-all.sh
Windows (PowerShell) 
tar xvf DEVICE-install-VERSION.zip
cd DEVICE-install-VERSION
./flash-all.bat

Re-lock the bootloader (important!)

This activates verified boot with your system. Confirm on the device – this erases all data again. Never skip this step.

fastboot flashing lock

Boot & secure

Boot GrapheneOS with Power and "Start" selected. During the initial setup, leave the pre-selected "Disable OEM unlocking" switch enabled – this locks the bootloader against being unlocked again. Optionally, you can verify the installation with the Auditor app (hardware attestation) or via the verified-boot key hash shown on screen.

The original guide is authoritative. Commands, version numbers and device code names change. When in doubt, follow the official CLI installation guide step by step – without reordering, omitting or adding any steps.
Want to go back to Android? It works the same way – with the stock factory images. Beforehand, while unlocked, remove your own key: fastboot erase avb_custom_key.

First setup – the most important steps

Check for updates

System updates run automatically in the background. It doesn't hurt to take a look under Settings → System → Updates.

Set a strong lock

A 6-digit PIN is the minimum; a passphrase is better. It also protects the device encryption on reboot.

Browser: use Vanadium

The bundled browser Vanadium is hardened and the recommended default choice.

Set up app sources

Now you decide where apps come from: F-Droid, Aurora or Obtainium. → Go to the software page

Need Google apps? Then don't install Sandboxed Google Play in your main profile, but in a separate profile. Why and how – the next page explains it.
Next: set up profiles → Or go straight to the software

Problems? Quick troubleshooting

"OEM unlocking" is greyed out

The device is most likely carrier-branded. Such models can't be unlocked. Solution: use an open (SIM-/carrier-unlocked) Pixel.

The computer doesn't detect the Pixel in fastboot

Try a different USB cable and a direct USB port on the machine (no hub). On Windows, restart the browser if needed. Chrome/Edge requires WebUSB – Firefox doesn't work reliably for the web installer.

A warning message stays on screen after flashing

As long as you've re-locked the bootloader (step 7), everything is fine. A brief GrapheneOS splash screen is normal.

I forgot to "Lock bootloader"

No data loss needed: you can reopen the installer and run just the lock step. For security reasons, be sure to do this.