blog

How to set up GrapheneOS

The holy grail of mobile de-Googlification.

 ·  16 min read

By Sky  ·  @countrmeasure

A phone boot screen showing the word 'GrapheneOS'.

The Google integrations embedded in my Android phones always made me feel uncomfortable, and getting Google out of my phone always seemed to me like the holy grail of mobile.

Although I’ve wanted to do it for a long time, until now it was always too hard and involved sacrificing too much functionality.

GrapheneOS is the first solution I’ve found for the Google problem that feels robust, polished and complete.

GrapheneOS describes itself as “an open source privacy and security focused mobile OS with Android app compatibility”. My understanding of mobile operating systems is not very sophisticated though, so I think of it as Android with the Google creepiness removed and extra security added in.

This is a step-by-step guide to setting up a Pixel 3a with it.

We’ll take a fresh GrapheneOS installation – which is intentionally bare-bones – and turn it into an elegant device with all the functionality you need for daily use.

Let’s see what that looks like.

Before

This is what we’ll start with.

The GrapheneOS home screen with default background and apps
The home screen on a fresh GrapheneOS install.

After

And this is what we’ll end up with.

The GrapheneOS home screen with black background and numerous apps
The GrapheneOS home screen after we've set it up.

Security and privacy caveat

The point of this process, for me, is to have a phone which works well for day to day tasks without Google or Apple peering over my shoulder at everything I do with it.

I’m not holding out anything I recommend as security or privacy best-practice. This is simply a guide to how I make GrapheneOS work in a way that suits my needs.

So let’s get started.

Step 0: Fit a case and screen protector

Sooner or later we all drop our phone or carry it in the same pocket as our keys. Protect it from your mistakes with a case and screen protector and it will last longer and stay in better condition.

This is a non-technical but important part of setting up a phone. Don’t put it off for later or it may never happen.

For the Pixel 3a, I can recommend the Spigen Tough Armour case and Spigen GLAS.tR SLIM screen protector. They’re not cheap, but they are good quality.

Step 1: Install GrapheneOS

As I mentioned, I’m not going to go into any detail about how to install GrapheneOS. The GrapheneOS installation guide explains the process well, so follow it and come back here when you’re done.

Once you’ve finished installing GrapheneOS, keep your phone connected to your computer because we’ll be using adb at different times throughout the setup process. This will require you to have USB debugging toggled to on in Settings > System > Advanced > Developer options.

Step 2: Set up ad-blocking

Setting up system-wide ad-blocking means you should never see ads in a browser or an app.

  1. Go to Settings > Network and Internet > Advanced > Private DNS.

  2. Select Private DNS provider hostname, enter dns.adguard.com then tap SAVE.

Step 3: Connect to wi-fi

  1. Open the Quick Settings menu by swiping down once from the top of the screen.

  2. Long-press on the wi-fi icon, toggle Use Wi-Fi to on, and connect to a wi-fi network.

Step 4: Configure Vanadium

Vanadium is browser bundled with GrapheneOS.

We want to make sure it can install apps, and set its default search engine.

  1. Go to Settings > Apps and notifications > Advanced > Special app access > Install unknown apps > Vanadium.

  2. Toggle Allow from this source to on.

  3. Open Vanadium by tapping on the greyscale Chromium icon.

  4. Inside Vanadium go to Settings > Search engine, then select DuckDuckGo.

Step 5: Install F-Droid

F-Droid is a catalogue of free open-source (FOSS) Android apps. It’s like the Google Play Store, but all the apps it contains are FOSS. There are a lot of excellent apps in there – more than I realised before I started using it.

You’ll need F-Droid to install apps later in this guide, and you’ll also need it over time to find and install apps as the need for them arises.

  1. In Vanadium, browse to https://f-droid.org.

  2. Tap the DOWNLOAD F-DROID button.

  3. Tap Download in the Download file dialog.

  4. Tap OK in the This type of file can harm your device notification.

  5. Once the FDroid.apk file has downloaded, tap Open in the notification.

  6. Tap INSTALL in the F-Droid Do you want to install this application? dialog.

  7. Tap DONE in the F-Droid App installed dialog.

Step 6: Install Signal

Signal is a secure messaging app which can seamlessly manage all your messaging, both encrypted messages and conventional texts.

We’ll use it as a drop-in replacement for the default Messaging app.

  1. In Vanadium, browse to https://signal.org/android/apk/.

  2. Scroll down past the Danger zone heading and then tap the Download button.

  3. Tap Download in the Download file dialog.

  4. Tap OK in the This type of file can harm your device notification.

  5. Once the Signal-website-univeral-release…apk file has downloaded, tap Open in the notification.

  6. Tap INSTALL in the Signal Do you want to install this application? dialog.

  7. Tap DONE in the Signal App installed dialog.

  8. Go to Settings > Apps and notifications > Advanced > Special app access > Install unknown apps > Signal.

  9. Toggle Allow from this source to on. Signal needs this permission to be able to update itself.

  10. Open the App Drawer by swiping up from the bottom of the screen, long-press on Signal, then tap the App info popover which appears.

  11. Tap Permissions and move Camera, Contacts, Microphone, Phone, SMS and Storage from the DENIED list to the ALLOWED list.

Step 7: Transfer Signal messages from your old phone

You can skip this step if you don’t have Signal messages that you want to transfer from your old phone.

If you’re already a Signal user and want to transfer your existing Signal messages to this phone, you first need to make a Signal backup following their instructions, then continue on.

On your computer

Here’s how I copied the Signal backup directory from my old phone to my computer:

$ adb pull /sdcard/Signal

Then, from the same directory as the previous command, this copied it onto the Pixel 3a:

$ adb push Signal /sdcard/

Step 8: Register and configure Signal

  1. Put your SIM card into the phone. Signal needs this to register the new device.

  2. Open the Signal app and follow its setup/registration process. If you have a backup to restore, make sure you select the RESTORE BACKUP button when it’s presented on the Restore from backup? screen.

  3. After the registration step in which you enter your name, Signal shows some action confirmations towards the top of the screen in white text on a blue background.

  4. Tap the Use as default SMS app action confirmation, then select Signal in the dialog which appears, then tap SET AS DEFAULT.

  5. Tap the Import system SMS action confirmation.

  6. Tap the x in the top right corner of the Invite your friends! action confirmation.

  7. Tap the Optimize for missing Play Services action confirmation then tap ALLOW in the Let app always run the background? dialog.

Step 9: Install Tor Browser and Orbot

Tor Browser is a browser which uses onion routing.

Orbot is a proxy which can route your internet traffic through the TOR network.

These apps can make what you do with your phone more private.

  1. In F-Droid, go to Settings > Repositories.

  2. Toggle Guardian Project to on.

  3. Go to the F-Droid Latest screen, search for Tor Browser and install it.

  4. On the F-Droid Latest screen, search for Orbot and install it.

  5. Open Orbot, go into its Settings and toggle Start Orbot on Boot to off.

  6. Exit Orbot.

  7. Go to Settings > Apps and notifications > Default apps > Browser app then tap Vanadium. Installing Tor Browser unsets Vanadium as the default browser, so we have to reset it here.

Step 10: Install OsmAnd~

OsmAnd~ is an offline maps and navigation app.

  1. In F-Droid, find and install Maps & GPS Navigation OsmAnd+ (known as OsmAnd~).

  2. Open the App Drawer, long-press on OsmAnd~, then tap the App info popover which appears.

  3. Tap Permissions and move Location and Storage from the DENIED list to the ALLOWED list. For Location, choose Only while app is in use.

  4. Open OsmAnd~.

  5. Tap the GET STARTED button.

  6. Tap SKIP on the Download map screen, then tap SELECT in the Skip downloading maps dialog.

  7. On the Map screens that follow keep selecting your location as the options become more specific.

  8. When you see a Standard map option, tap it. This will download a map for your area. OsmAnd~ is an offline tool, so it needs to download maps of areas in which it will be used.

  9. In the World overview map notification which appears next, tap DOWNLOAD.

Step 11: Install Aurora Store

Aurora Store is a FOSS client for the Google Play Store.

You can use it to install apps which are available for free in the Google Play Store.

  1. In F-Droid, find and install Aurora Store.

  2. Open the App Drawer, long-press on Aurora Store, then tap the App info popover which appears.

  3. Tap Permissions and move Storage from the DENIED list to the ALLOWED list.

  4. Go to Settings > Apps and notifications > Advanced > Special app access > Install unknown apps > Aurora Store.

  5. Toggle Allow from this source to on.

  6. Open Aurora Store.

  7. On the Welcome screen tap NEXT.

  8. On the Accounts screen tap ANONYMOUS. This will allow you to install apps without having to authenticate to the Play Store with a Google account of your own.

Step 12: Add a weather shortcut

As a rule, weather apps just repackage data from national weather services.

Rather than installing a weather app, we’ll go straight to the source and keep it simple by adding a shortcut to the relevant weather service to the home screen.

  1. In Vanadium, browse to your national weather service, then navigate to the forecast page for your city or region.

  2. Tap the 3 vertical dots in the top right corner of the screen and select Add to Home screen.

  3. In the Add to Home Screen dialog, enter Weather and then tap Add.

  4. In the Add to Home Screen confirmation dialog, tap ADD AUTOMATICALLY.

Step 13: Remove unused apps from the App Drawer

Some apps which are bundled with GrapeheneOS are unlikely to be used often, so we’ll remove them from the App Drawer to keep it as uncluttered as possible.

One is Auditor which verifies the integrity of the operating system.

Others are Calendar, Gallery and PDF Viewer, because in the next step we’ll install alternatives to each of them which have more functionality.

  1. Open the App Drawer.

  2. Long-press on Auditor, then tap the App info popover which appears.

  3. Tap FORCE STOP, then tap OK in the confirmation dialog.

  4. Tap DISABLE, then tap DISABLE APP in the confirmation dialog.

  5. Repeat this process for Calendar, Gallery and PDF Viewer.

Step 14: Install other apps from F-Droid

We’ll also install some other apps using F-Droid to provide various functionality.

After you install each app, open it and approve the permissions it requests.

  1. AnkiDroid - Flashcard study aid.

  2. AntennaPod - Podcast manager and player.

  3. Feeder - Feed reader.

  4. KeePassDX - Password manager.

  5. Loop Habit Tracker - Habit tracker.

  6. Markor - Note taker.

  7. MuPDF viewer - Document viewer.

  8. NewPipe - YouTube frontend.

  9. Simple Calendar Pro - Calendar.

  10. Simple Gallery Pro - Photo and video gallery.

  11. Syncthing - Decentralised file synchronisation.

  12. Termux - Terminal emulator.

  13. VLC - Media player.

Step 15: Usability improvements

I find that these modifications to the default settings make the phone feel more natural and more pleasant to use.

  1. Settings > Battery - Toggle Battery percentage to on.

  2. Settings > Display > Adaptive brightness - Toggle Adaptive brightness to on.

  3. Settings > Display > Advanced - Toggle Auto-rotate screen to on.

  4. Settings > Display > Night light - Tap Schedule and select Turns on from sunset to sunrise.

  5. Settings > Security > Fingerprint - Tap Fingerprint + PIN and follow the prompts. Enrol the index finger of both hands so you can unlock the phone one-handed with either hand. Now you can touch the fingerprint sensor to wake your phone and unlock it in the one operation, which is very convenient.

  6. Settings > Sound > Advanced - Toggle all sliders under OTHER SOUNDS AND VIBRATIONS to off.

  7. Settings > System > Advanced > Developer options - Toggle Disable Bluetooth A2DP hardware offload to on. Then from the Restart Device? dialog, tap RESTART. Changing this setting is a workaround for a bug (which may be fixed by the time you read this) which causes audio to play over the phone speakers even when a Bluetooth audio device is connected. If you can connect a Bluetooth device and play audio through it, you don’t need to do this.

  8. Settings > System > Date & time - Toggle Use locale default to off.

  9. Settings > System > Date & time - Toggle Use 24 hour format to on.

  10. Settings > System > Gestures > System navigation - Select Gesture navigation.

  11. Settings > System > Languages & input > Languages - Add English (Australia), then remove English (United States). This is what I do, and you should modify this for your language.

  12. Settings > System > Languages & input > Virtual keyboard > Android Keyboard (AOSP) > Appearance & Layouts > Theme - Select Material Dark.

  13. Settings > System > Languages & input > Virtual keyboard > Android Keyboard (AOSP) > Preferences - Toggle Vibrate on keypress to off.

  14. Settings > System > Languages & input > Virtual keyboard > Android Keyboard (AOSP) > Text correction - Toggle Personalised suggestions to on.

Step 16: Set a wallpaper

I like to set a plain black wallpaper.

The file I use is a 1 pixel by 1 pixel black image called black.png.

On your computer

Download the black image file from the link above, then cd into the directory you saved it to.

Copy it to the phone with:

$ adb push black.png /sdcard/Wallpaper/black.png

On your phone

  1. Go to Settings > Display > Wallpaper, then tap Wallpapers.

  2. Tap My photos.

  3. Tap the 3 vertical dots in the top right corner of the screen and select Show internal storage.

  4. Tap the hamburger (3 horizontal lines) in the top left corner of the screen then tap Pixel 3a, then Wallpaper, then black.png.

  5. Tap Set wallpaper at the top of the screen.

  6. Select Home screen and lock screen in the Set wallpaper confirmation dialog.

Step 17: Configure the Quick Settings menu

  1. Swipe down from the top of the phone twice to open the Quick Settings menu.

  2. Tap the edit (pencil) icon in its lower left corner.

  3. In the top row, put Wi-Fi, Hotspot, Bluetooth.

  4. In the second row, put Dark theme, Location, Do Not Disturb.

  5. In the third row, put Mobile data, Battery Saver, Aeroplane mode.

  6. In the fourth row, put Torch, Night Light, Auto-rotate.

  7. All other icons go in the DRAG HERE TO REMOVE section at the bottom of the screen.

  8. Tap the back arrow at the top left of the screen.

Step 18: Set up your home screen

  1. For each icon on your home screen, long-press on it, drag it to the far right side of the screen, wait for the next screen with the other app icons on it to appear, then place it on that screen. This will move all the icons to the one screen, and the screen which was to the right of the home screen now becomes the home screen.

  2. Remove Messages from the home screen by long-pressing it, dragging it to the REMOVE text at the top of the screen and dropping it there. Then do the same for MuPDF and Vanadium.

  3. Open the App Drawer.

  4. Long-press on Clock, drag it upwards and then place it on the home screen. Then do the same with Files and Gallery.

  5. In the Favourites Bar at the bottom of the screen, beside Phone , put Signal, Clock, Vanadium, and Camera.

  6. In the top row of the home screen put the general utility apps: AnkiDroid, Calendar, Habits, OsmAnd~ and Weather.

  7. In the second row of the home screen put the media apps: AntennaPod, Feeder, Gallery, NewPipe, and VLC.

  8. In the third row of the home screen put the system utility apps: Files, Markor, Syncthing and Termux.

  9. In the fourth row of the home screen put the privacy and security apps: KeePassDX, Orbot and Tor Browser.

  10. In the fifth row of the home screen put the catalogue apps: Aurora Store and F-Droid.

Step 19: Set up Seedvault backups

Seedvault is an encrypted backup app which is bundled with GrapheneOS.

For this step, you’ll need a USB flash drive (with a USB-C adapter) which will be the target for the backup. Ideally it will be at least the same size as your phone’s storage, which for a Pixel 3a is 64GB.

The data which Seedvault backs up doesn’t include your phone’s shared storage, and backups for that will be handled in the next step.

  1. Go to Settings > System > Backup

  2. A 12-word recovery code is displayed. Record it somewhere secure.

  3. Tap the CONFIRM CODE button.

  4. Enter the recovery code and tap the DONE button.

  5. Plug the flash drive into the phone.

  6. Tap CANCEL in the F-Droid Open F-Droid to handle… dialog.

  7. Tap your flash drive’s name on the Choose where to store backups screen.

  8. Toggle Backup my data to on on the Backup screen.

  9. Tap the 3 vertical dots in the top right corner of the screen and select Backup now to run your first backup.

Step 20: Set up shared storage backups

Because Seedvault doesn’t back up the phone’s shared storage, we need to back up shared storage in a separate step.

I recommend backing it up to a second flash drive which is fully encrypted.

  1. Plug the flash drive into your computer, then mount and unlock it.

  2. Connect the phone to the computer.

  3. Copy the phone’s shared storage to the flash drive.

It may not be necessary to do this right now, as you’ve just set your phone up and the amount of data in shared storage is probably minimal. This is a procedure you should carry out regularly from now on though.

I had wanted to be able to recommend a way to back up shared storage directly from the phone into an encrypted container on the same flash drive we used for the Seedvault backup in the step above. I experimented with using EDS Lite to do that, but couldn’t find a way that was simple and robust, so I think the method I’ve recommended is the best for most people.

Do you really need an email app?

This guide doesn’t mention installing an email app because I don’t think it’s something that should be done without careful thought. I don’t access my email on my phone.

Many peoples’ email contains a lot of information about them. It can also be used to reset important passwords.

If you lose possession of your phone while it’s unlocked, which is entirely possible given that it’s a device you use in one hand in public places, your email app will be available to the person who finds or takes it.

I’m not saying you shouldn’t install an email app, but I am saying that unless there is a compelling reason for you to have access to email on your phone, consider not installing one.

Try out other apps too

Many other non-FOSS apps with Play Services dependencies can be installed from Aurora Store and will often work with more functionality than you might expect.

If you’re not sure about an app, just try it. You might be pleasantly surprised.

GrapheneOS is fantastic

I’m thoroughly enjoying the de-Googlified GrapheneOS experience.

I really do feel like at last I’ve found the holy grail of mobile.

If that was interesting, how about this?