Please use Chrome or Edge on a desktop computer
This tool talks to your phone directly over USB, which needs desktop Chrome or Edge. Safari, Firefox, and phones/tablets can’t do it. Open this page on a laptop or desktop in Chrome or Edge, and plug your Pixel in with a USB cable.
Get your phone ready
Three quick things on the phone first. Take your time — nothing starts until you’re ready.
Want it done for you, plus extras?
The complete security setup adds a Threema licence, 6 months Mullvad VPN, and a 12-month data eSIM, pre-configured and delivered — on top of the free hardening this tool already does.
See complete setup packages — from A$369Turn on Developer Options
On the phone: Settings → About phone, then tap Build number seven times until it says “You are now a developer”.
Turn on “OEM unlocking”
In Settings → System → Developer options, switch OEM unlocking on.
⚠ If “OEM unlocking” is greyed out, your phone is carrier-locked and can’t be used until the carrier unlocks it. This is the one thing we can’t work around.
Boot into fastboot mode
Power the phone off. Then hold Volume-Down + Power together until you see the fastboot screen (a start-up menu with an Android robot). Plug it into this computer with a USB cable.
Connect your Pixel
Click Connect, then pick your phone in the browser’s USB prompt. We’ll check it’s a supported Pixel and ready to unlock.
✓ Pixel detected
This phone isn’t supported
We detected “”. This tool supports Pixel 6 and newer. Double-check you’re on the right phone and that it’s in fastboot mode.
Install GrapheneOS
This unlocks the bootloader, installs GrapheneOS, and locks it again — all automatically. Unlocking erases everything on the phone, so make sure anything important is backed up first. Keep the cable plugged in the whole time.
- Unlock the bootloader
- Download GrapheneOS
- Install GrapheneOS
- Re-lock the bootloader
Your browser is low on storage for the download. Use a normal (non-incognito) window and free up some disk space.
Bootloader tools — if something goes wrong
Manual fastboot controls to recover a stuck phone: get it into or out of the bootloader, or unlock / re-lock by hand if a step above stalls. The phone must be showing the fastboot screen and connected.
Your phone is rebooting
GrapheneOS is starting up for the first time. This is normal and takes a minute or two — the screen may go dark or show a start-up animation. When it finishes you’ll land on the “Welcome to GrapheneOS” setup screen — walk through it using the choices below (they’re set for privacy), then tap the button at the very bottom.
On the phone — first-time setup. Follow these in order. Where we’ve picked an option, it’s the privacy-first choice.
- Welcome → tap Start / Next.
- Wi-Fi → Skip / Don’t connect. Setup runs completely offline — apps come over the USB cable, not the internet. You add Wi-Fi later.
- Date & time → leave automatic, Next.
- Location → turn Location OFF, and turn the GrapheneOS geocoder ON (it does address look-ups on-device instead of via Google).
- Screen lock / PIN → set a PIN only you know (6+ digits). We never see it — pick it yourself.
- Fingerprint → No / Skip. A PIN can’t be taken from you the way a fingerprint can. Add one later only if you want to.
- Crash/usage reporting prompt → No thanks.
- Security preview releases → leave OFF. Stable gets the same security patches, fully tested — no beta surprises on your daily phone.
- Restore apps & data → Skip / Don’t restore.
- Swipe-to-navigate tutorial → do it, Next.
- “You’re all set” → tick Disable OEM unlocking if it’s offered (locks the bootloader toggle — extra tamper protection), then Finish.
You’ll end on the standard home screen — black background with the app dock (not the white welcome screen). Once you’re there, tap below.
Reconnect for setup
To finish setting up, turn on USB debugging in the new GrapheneOS, then reconnect.
- On the phone, finish the first-time GrapheneOS welcome screens (you can skip most of them).
- Settings → About phone → tap Build number 7 times to unlock Developer options.
- Settings → System → Developer options → turn on USB debugging AND turn on “Stay awake” (keeps the screen on while charging — GrapheneOS cuts the USB data connection whenever the screen locks, which drops the setup, so this is important).
- Click the button below and tap Allow if the phone asks — often it connects on its own.
✓ Connected
Go offline
Before anything installs, the phone drops off every network. Apps come over the USB cable, not the internet — so nothing on this device is reachable while it’s set up. Peace of mind, confirmed on the phone itself.
Set up profiles
GrapheneOS can run separate user profiles — each fully isolated, with its own apps, data and encryption. Pick how many, and how apps spread across them. Apps download once, then clone into the others.
Installing apps
Every app comes straight from its official source and is verified before it installs. Phantom Protocol is always included — it’s the core of your protection. Pick any others you want.
🔐 Your Threema licence
Threema Libre needs this licence to activate. Open Threema on the phone and, on its licence screen, type in the key below yourself, then tap Activate. Typing it in is deliberate — it means you hold the secret, not us.
—
After it activates, lock the app: in Threema → Settings → Privacy → App lock, set a PIN/passphrase and a short auto-lock timeout — so Threema stays locked even when the phone is unlocked.
🔒 Your Mullvad VPN account
Mullvad is included free with this device and already has time on it. There’s no email and no password — this 16-digit number is the account. Open Mullvad on the phone and, on its login screen, type the number below in yourself, then tap Log in. Typing it means you’ve got your account number down — nobody can recover it for you.
—
Write this number down and keep it safe. It’s the only way back into the VPN — nobody can recover it for you, and there’s no email to reset it against.
Log in and connect before the Harden step — that step locks Mullvad in as the always-on VPN, and it’s skipped if the app isn’t connected yet.
Set up protection
Activate Phantom Protocol — your wipe/duress/lockdown app — as a device admin, so its wipe is OS-enforced and it can’t be casually removed. This is admin level, not device owner — so there’s no “managed by your organization” banner.
Everything your protection does
One tap arms the whole defensive layer over USB. The items marked in app are the ones only you can set — your secret phrases and PINs never pass through this tool.
USB-C security mode
One control over the whole USB-C port posture. Charge-only is the secure default.
⚠️ Arm USB / inactivity wipe triggers LAST
Don’t enable “wipe on USB connection while locked” or a short inactivity-wipe timer yet. Setup runs over this USB cable and the phone auto-locks after 15s once hardened — arming those now would wipe the phone mid-setup. Do them as the final on-phone step, after the phone is unplugged and sealed.
You chose USB Tripwire — the OS-level charge-only part is set. The actual wipe-on-USB arming is this deferred step: do it inside Phantom Protocol only after the phone is off this cable.
Applying security
One tap locks the phone down. Each line turns green as it’s done.
Setting up your eSIM
We’ll turn on eSIM support here. If you bought the complete security setup, your activation QR is in your email — otherwise this just enables eSIM for whichever SIM you plan to use.
⚠️ STOP — do these 3 IN ORDER before scanning
- Restart the phone (button below) — settles the radios after setup.
- When it’s back, connect Wi-Fi on the phone. An eSIM downloads over the internet — it will FAIL with no network.
- Only then does the QR unlock below to scan.
⚠ This is your only chance to save this — once you continue past setup, the tool can’t show it to you again.
📸 Take a photo of the QR/instructions below now — this screen won’t come back.
Final lockdown
The last step seals the phone: USB port to charging-only, Developer options hidden, and USB debugging turned off. After this the setup tool can’t talk to the phone any more — which is exactly the point.
All done
Your Pixel is now a fully configured, hardened GrapheneOS phone.