GrapheneOS is a privacy and security focused mobile OS with Android app compatibility developed as a non-profit open source project. It's focused on the research and development of privacy and security technology including substantial improvements to sandboxing, exploit mitigations and the permission model. GrapheneOS also develops various apps and services with a focus on privacy and security. Vanadium is a hardened variant of the Chromium browser and WebView specifically built for GrapheneOS. GrapheneOS also includes our minimal security-focused PDF Viewer, our hardware-based Auditor app / attestation service providing local and remote verification of devices, and the externally developed Seedvault encrypted backup which was initially developed for inclusion in GrapheneOS.
GrapheneOS improves the privacy and security of the OS from the bottom up. It deploys technologies to mitigate whole classes of vulnerabilities and make exploiting the most common sources of vulnerabilities substantially more difficult. It improves the security of both the OS and the apps running on it. The app sandbox and other security boundaries are fortified. GrapheneOS tries to avoid impacting the user experience with the privacy and security features. Ideally, the features can be designed so that they're always enabled with no impact on the user experience and no additional complexity like configuration options. It's not always feasible, and GrapheneOS does add various toggles for features like the Network permission, Sensors permission, restrictions when the device is locked (USB peripherals, camera, quick tiles), etc. along with more complex user-facing privacy and security features with their own UX.
The features page provides an overview of the substantial privacy and security improvements added by GrapheneOS to the Android Open Source Project.
Official releases are available on the releases page and installation instructions are on the install page.
No Google apps or services
GrapheneOS will never include either Google Play services or another implementation of Google services like microG. Those are not included in the Android Open Source Project and are not required for baseline Android compatibility. Apps designed to run on Android rather than only Android with bundled Google apps and services already work on GrapheneOS, so a huge number of both open and closed source apps are already available for it.
AOSP APIs not tied to Google but that are typically provided via Play services will continue to be implemented using open source providers like the Seedvault backup app. Text-to-speech, speech-to-text, geocoding, accessibility services, etc. are examples of other open Android APIs where we need to develop/bundle an implementation based on existing open source projects. GrapheneOS is not going to be implementing these via a Google service compatibility layer because these APIs are in no way inherently tied to Google services.
We're developing a minimal Play services compatibility layer as a regular app without any special privileges. The app will provide a stub implementation of the entire Play services API pretending the servers are down and the functionality is unavailable. It will always be disabled by default since apps will detect Play services is available and will try to use it rather than alternatives. As an example, Signal would try to use a non-functional FCM implementation rather than their own server push implementation. The intention is that users will only enable this in profiles dedicated to running apps with an unnecessary hard dependency on Play services. We'll likely prevent enabling it in the owner profile to help users avoid those kinds of pitfalls.
Our Play services app won't have any special privileges or whitelisting in the OS like Play services or microG. There will be no support for bypassing arbitrary signature checks like the microG signature spoofing patch since it substantially compromises the OS security model and breaks other security features like verified boot. Instead, our app will be signed with a GrapheneOS Play services key and the only OS support for the app will be presenting the GrapheneOS Play services key as the Google Play services key.
Ideally, Google themselves would support installing the official Play services as a regular Android app, rather than taking the monopolistic approach of forcing it to be bundled into the OS in a deeply integrated way with special privileged permissions and capabilities unavailable to other service providers competing with them. Even though we would never include it in GrapheneOS, it would be great if users did have the option to install Play services as a regular app in specific profiles. It's unfortunate that the approach taken to it is so deeply integrated and anti-competitive. GrapheneOS users can still choose to use Google services if they choose, but largely only via a browser. A few of their apps like Google Maps do work with reduced functionality without Play services but most won't.
GrapheneOS was founded as an open source project in late 2014. It was formerly known as CopperheadOS. For more details, see the history page.
See the FAQ section on our upstream work improving privacy and security for billions of users by getting a subset of our changes into core infrastructure projects.
Copyright and licensing
GrapheneOS is permissively licensed and has never used copyright assignment, so the work is owned by the developers. See the FAQ entry on copyright and licensing for more details.
See the FAQ section on the roadmap.
See the FAQ section on device support.