Best practices

The essentials

• Verify and factory reset any preinstalled device, including ours. See how.
• Keep updates on. Reboot when prompted. Security updates are the single most important protection.
• Never unlock the bootloader again unless you're reinstalling. An unlocked bootloader disables verified boot protections.
• Leave OEM unlocking disabled.
• Use the bundled Vanadium browser or another Chromium-based browser with strong sandboxing.

Lock screen

• Use a random 6+ digit PIN or a passphrase. Fingerprint unlock is convenient. GrapheneOS can also require a PIN in addition to the fingerprint (two-factor fingerprint unlock).
• Turn on PIN scrambling to make shoulder-surfing and smudge attacks harder.
• Keep auto reboot enabled. After a period without unlocking, the phone reboots and your data returns to its fully encrypted "at rest" state. Shorten the timer if that suits you.
• Consider setting a duress PIN/password, which wipes the device when entered. Understand exactly how it works first, because it's irreversible.
• Hide sensitive notification content on the lock screen.

Use profiles to separate identities

Each user profile has its own encryption keys and apps. A common setup:

• Owner profile: trusted, essential apps only. No Google Play if you can avoid it.
• Secondary profile: sandboxed Google Play plus apps that need it (banking, ride-share, work). End the session when you're done to put it back at rest.
• Temporary profiles: create one for a single need, then delete it.

Notifications from secondary profiles can be forwarded to the active profile if you want them.

Apps & permissions

• Install apps from sources you trust and keep the number of apps small. Every app adds attack surface.
• Use Storage Scopes and Contact Scopes instead of granting full file or contact access.
• Revoke the Network permission for apps that don't need the internet (calculators, offline tools, and so on), and the Sensors permission where it isn't needed.
• Grant location "only while in use" and turn off precise location where possible.
• Review permissions periodically using the Privacy dashboard in Settings.

Network

• Use a reputable VPN if it fits your threat model. The GrapheneOS FAQ mentions the official WireGuard and Mullvad apps. A VPN shifts trust to the VPN provider; it doesn't make you anonymous.
• For system-wide ad blocking, a Private DNS (DNS-over-TLS) provider with blocklists is the lightweight option. Don't combine Private DNS with a VPN.
• Disable Wi-Fi and Bluetooth when you don't need them. GrapheneOS already randomizes Wi-Fi MAC addresses per connection by default.
• Consider "LTE only" mode to reduce attack surface (it disables 2G/3G). This is a hardening measure, not a way to make the cellular network trustworthy.

Communications

• Use end-to-end encrypted messaging (e.g. Signal) for anything sensitive. Treat SMS and regular calls as readable by carriers.
• Move account 2FA from SMS to an authenticator app or a hardware security key.
• Add a SIM PIN to protect against someone moving your SIM to another phone.

Backups

GrapheneOS includes the Seedvault encrypted backup tool (Settings → System → Backup). Back up to a USB drive or a storage location you control, and write down the recovery code. Some apps opt out of backups; use their own export features (e.g. Signal's encrypted backup). Test restoring before you depend on it.

Things to avoid

• Rooting the phone or installing "Magisk"-style modules. This breaks the security model.
• Unofficial "GrapheneOS" builds or mods from third parties, including any reseller.
• Spoofing tools to pass Play Integrity. These are fragile and weaken security.
• Giving anyone, including us, your PIN, passwords or remote access to your phone.
• Unverified third-party install guides. Use the official ones.