Prerequisites
What you need before touching anything.
GrapheneOS is a hardened, open-source Android build focused on security and privacy: verified boot, a hardened kernel and WebView, and optional sandboxed Google Play. The Pixel 8 Pro (codename husky) is one of the officially supported devices. To install it you need:
- The phone — ideally a carrier-agnostic (unlocked) Pixel 8 Pro. Carrier variants flash a carrier ID that can disable bootloader unlocking.
- A computer with 2 GB+ free memory and 32 GB+ free storage, running a supported OS — Windows 10/11, macOS Sonoma (14) / Sequoia (15) / Tahoe (26), Arch Linux, Debian 12/13, Ubuntu 22.04/24.04/25.04, Linux Mint 21/22/LMDE 6, ChromeOS, GrapheneOS, or a Play-Protect-certified Android 14–17 device.
- A supported browser for the web installer: Google Chrome, Microsoft Edge, Chromium (not the Ubuntu Snap build — its WebUSB is broken), Brave (with Shields disabled), or Vanadium. No incognito/private windows, no Flatpak or Snap browser packages.
- A good USB-C cable, plugged directly into a rear port or laptop port — no hubs, no front panel. Bad cables are the single most common cause of failed installs.
Before you start
Backup, updates, and choosing the right device.
- Back up everything. Photos, messages, 2FA seeds, authenticator data — the whole install path erases the phone, and unlocking wipes the secure element too. Assume nothing survives.
- Update the phone to the latest stock Android over the air first. You want the newest firmware on the device before flashing; GrapheneOS also flashes the latest firmware early in its own process.
- If you haven't bought the phone yet: get an unlocked, carrier-agnostic unit. On carrier variants, the carrier can disable bootloader unlocking via a carrier ID burned into the
persistpartition, and support staff often can't or won't lift it. - Charge the phone and keep it plugged in during the install.
Enable OEM unlocking
A software switch that allows the bootloader to be unlocked.
- Open Settings → About phone and tap Build number seven times until “You are now a developer” appears.
- Go to Settings → System → Developer options and toggle on OEM unlocking.
- On carrier-sold variants, this step needs an internet connection so the stock OS can check whether the device was sold locked.
Prepare the installer
Two routes — pick one. The web installer is recommended.
Route A runs entirely in your browser (WebUSB) and even works from another phone. Route B is the traditional command-line install. Both flash identical images.
Route AWeb installer — recommended
- Open grapheneos.org/install/web in a supported browser on the computer.
- Linux only: install udev rules so the device is usable as a non-root user:
sudo pacman -S android-udevDebian / Ubuntu instead
The udev rules on Debian/Ubuntu are old but cover Pixels — the USB IDs haven't changed in years.
sudo apt install android-sdk-platform-tools-common- Linux only: if a fastboot connection is refused with “device in use”, stop fwupd — it wrongly grabs devices via the fastboot protocol:
sudo systemctl stop fwupd.serviceRoute BCommand line — traditional
- Arch Linux ships a usable, current
fastbootin the official repos. Install the tools and OpenSSH (used to verify the downloads):
sudo pacman -S android-tools openssh android-udevDebian / Ubuntu instead
Debian/Ubuntu's fastboot packages are broken and years out of date — use Google's standalone platform-tools instead:
sudo apt install libarchive-tools openssh-client
curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-linux.zip
echo 'acfdcccb123a8718c46c46c059b2f621140194e5ec1ac9d81715be3d6ab6cd0a platform-tools_r35.0.2-linux.zip' | sha256sum -c
bsdtar xvf platform-tools_r35.0.2-linux.zip
export PATH="$PWD/platform-tools:$PATH"The sha256sum -c check confirms you got the official archive. The PATH export only applies to the current terminal.
- Confirm the version — it must be at least 35.0.1:
fastboot --versionExpected output, e.g.: fastboot version 35.0.2-12147458
Boot to fastboot & unlock the bootloader
The moment the phone stops being “stock”.
- Power off the phone. Then hold Volume Down while it boots (or reboot and hold Volume Down immediately).
- Wait for the red warning triangle and the words “Fastboot Mode”. Do not press the power button to start — leave it paused for the installer to connect.
- Connect the USB cable. On Linux, the udev rules must be in place before the device is plugged in.
Now unlock. In the web installer, click Unlock bootloader:
# Equivalent CLI command:
fastboot flashing unlockConfirm the prompt on the phone — Volume keys to select, power to confirm. This wipes all data and the secure element.
Flash GrapheneOS
Factory images replace the stock OS and wipe everything again.
The installer handles firmware, reboots, and the OS flash automatically. The phone should stay untouched until it's done.
Route AWeb installer
- Click Download release — the factory images for your device (a couple of GB, extracted in your browser's storage).
- Click Flash release and wait. The script flashes the latest firmware, reboots back into the bootloader, and flashes the OS. Don't interact with the device while it runs.
Route BCommand line
- Grab the official signing key and the factory images for the Pixel 8 Pro (
husky). Replace<VERSION>with the current release from grapheneos.org/releases:
curl -O https://releases.grapheneos.org/allowed_signers
curl -O https://releases.grapheneos.org/husky-install-<VERSION>.zip
curl -O https://releases.grapheneos.org/husky-install-<VERSION>.zip.sig- Verify the signature. Anyone can host a ZIP; this check is how you know it's actually GrapheneOS. The key itself comes from the site above, cross-published on GitHub, Bluesky and X.
ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s husky-install-<VERSION>.zip.sig < husky-install-<VERSION>.zipExpected output: Good "factory images" signature for contact@grapheneos.org with ED25519 key SHA256:AhgHif0mei+9aNyKLfMZBh2yptHdw/aN7Tlh/j2eFwM
- Extract, enter the directory, and flash:
bsdtar xvf husky-install-<VERSION>.zip
cd husky-install-<VERSION>
bash flash-all.shmacOS / Windows instead
Same steps, with the standard tar instead of bsdtar.
tar xvf husky-install-<VERSION>.zip
cd husky-install-<VERSION>
bash flash-all.shLock the bootloader
Critical — this is what makes verified boot meaningful.
Locking the bootloader enables full verified boot: every boot verifies the firmware and OS, rollback protection is enforced, and fastboot can no longer flash, format, or erase partitions. Any modification to the OS partitions is detected.
The phone is back in the bootloader after flashing. Lock it now — before using the device:
# Web installer: click "Lock bootloader"
fastboot flashing lockConfirm on the device (volume keys + power). Locking wipes all data again — which is fine, since the fresh install has nothing on it yet.
First boot & verify
Boot, harden, and confirm the install is genuine.
- Boot the phone — power button with the default “Start” option selected. The yellow notice appears briefly; note the hash shown.
- Disable OEM unlocking again. The final screen of first-time setup has an “OEM unlocking” toggle, checked by default — uncheck it. It stays available in developer settings if you ever need it.
- Verify with Auditor. Install the Auditor app on a second Android device and pair via QR code. It uses hardware attestation to confirm the firmware, OS, and boot chain are genuine — without trusting the phone itself. Results show on the second device, not the one being verified.
- Check the verified-boot key hash. On the yellow boot notice, the Pixel 8 Pro (8th-gen) shows the full SHA-256. It must match the official value:
896db2d09d84e1d6bb747002b8a114950b946e5825772a9d48ba7eb01d118c1cA mismatch means the OS wasn't signed by the official key — stop and investigate before putting data on the device. (Verified boot itself enforces this automatically; the manual check is a belt-and-braces confirmation.)
Quick checklist
Further reading: the usage guide, the FAQ, and the official community channels — people are almost always around to help if you get stuck.
What you gain, what you may lose
A fair accounting before you make it yours — no hype, no fear. GrapheneOS is a trade, not a miracle.
Installation is the easy part. The harder question is whether the life after it suits you. GrapheneOS removes Google's reach from your device, and that single decision quietly reshapes what your phone can and can't do. The honest truth in 2026 is that it has never been closer to a drop-in replacement for stock Android — but it is not identical, and the differences matter. Consider them before you commit.
What you gain
- Your privacy back. No Google telemetry by default. Nothing phones home with your location, habits, or what you type.
- Hardened against the real world. A hardened kernel and WebView, a stricter app sandbox, and hardware memory tagging that stops whole classes of attacks before they start.
- Verified boot you can actually trust. The OS is checked on every boot, and you can prove it's genuine with hardware attestation — not just take someone's word for it.
- No carrier or vendor bloat. A clean, quiet system you decide what goes into.
- Updates on your terms. Monthly security patches, delivered by the project directly — not gated on a carrier or an update channel.
- Long support. The Pixel 8 Pro is guaranteed security updates through the next several years.
What you may lose
- Google Pay / tap-to-pay, permanently. It needs system-level NFC access GrapheneOS will never grant. No update will change this. Carry a card, or a watch with its own NFC.
- A few banking apps. Most work with sandboxed Google Play; a few that demand Google's device certification still block you. Check yours before switching.
- Google's ecosystem glue. Full Google app cross-features and some account integrations are reduced. The essentials — messages, maps, mail, streaming — work; the magic links between them may not.
- Android Auto, in part. It works now, but it can take extra setup and has occasional rough edges on the road.
- RCS hiccups. Google Messages' rich-chat can drop after updates. SMS and MMS are rock solid; RCS sometimes needs a nudge.
- Zero apps out of the box. No Play Store, no defaults. You'll assemble your own stack — part of the point, but a small chore at first.
