The difference that counts
Not just another crypto phone
GrapheneOS is an open operating system for your phone, built by security researchers and used by journalists, lawyers and doctors. On paper it resembles the “crypto phones” that all collapsed between 2016 and 2021, yet structurally it is their opposite.
- in development since
- 2014in development since
- servers we operate
- 0servers we operate
- source code public
- 100%source code public
The track record
Why the closed model fails
These five services sold subscriptions to a closed network and called themselves uncrackable. All of them opened up in one go. The figures come from the public press releases of Europol and the FBI.
- 2016
Ennetcom
19.000users
Dutch police seized the servers in Canada and lifted the keys straight off them. One location, every user.
- 2018
Phantom Secure
10.000+devices
The CEO pleaded guilty and the network was dismantled. The encryption was never the weak point, the company behind it was.
- 2020
EncroChat
115 mlnmessages read
Police put software on the servers and read along for months across some 60,000 users. Over 6,500 arrests followed.
- 2021
Sky ECC
1 mrdmessages intercepted
Around 70,000 users believed they were safe. The network was broken open and the messages ended up in case files.
- 2021
ANOM
800+arrests
The kicker: the FBI was the provider itself. The device was a trap from day one, and closed code made that impossible to see.
None of these cases started with broken encryption. They all started at the company, the server or the owner, which is to say at exactly the things GrapheneOS does not have.
These networks were sold almost exclusively to criminal customers, which is precisely why they drew attention. We cite them as a lesson in engineering, not as a comparison: GrapheneOS is ordinary open software for people with a legitimate reason for privacy.
Encryption
From your PIN to unreadable data
Encryption is not a switch that is on or off, it is a chain. Every link below has to hold, and the strongest one is not in software but in a separate chip.
- PIN
Your PIN, stored nowhere
The code itself is not on the device. It is only an ingredient used to derive the key, so there is nothing stored that reveals it.
- CHIP
Titan M2, a separate chip
Combining your code with the key happens inside a dedicated security chip. That chip slows every attempt, which makes endless guessing hopeless.
- FBE
Every file its own key
Storage is not one big encrypted blob but encrypted per file. Separate profiles therefore hold keys that are independent of each other.
- BFU
Before the first unlock: sealed
Just after powering on, no key exists in memory at all. At that point there is simply nothing to read, not even with specialised equipment.
- AUTO
Automatically back to sealed
If the device sits unused for a while it reboots itself and everything returns to that sealed state. A lost phone therefore protects itself.
Leaked documentation from forensics firm Cellebrite showed their equipment could not extract data from GrapheneOS devices built after 2022, while it could from stock Android. That is down to this chain, not to one clever trick.
Zero-days and spyware
Pegasus and the hole nobody knows yet
Commercial spyware such as Pegasus uses flaws the manufacturer does not know about yet, a so-called zero-day. Against those, "updating on time" by definition does not help. So GrapheneOS takes a different approach.
How an attack like that works
A message or image arrives and you do not even have to tap it. The software that automatically processes that file contains a bug, and through that bug the attacker’s code suddenly runs. From there it tries to escape the app to reach your messages, microphone and camera. GrapheneOS puts a brake on every one of those steps.
Less code to break in through
These attacks arrive through components that process data automatically, such as the handling of an incoming image. GrapheneOS switches off features and drivers you do not use, so a portion of those routes simply is not there anymore.
Memory bugs break off immediately
Nearly all of these exploits abuse memory-management bugs. GrapheneOS uses a stricter memory system that aborts such abuse at the moment it happens. That also works against flaws nobody knows yet, because no specific patch is required.
In hardware on the newest Pixels
From the Pixel 8 onwards that memory check sits in the processor itself, which makes it considerably more thorough than a software check. GrapheneOS enables it by default for the system and you can switch it on per app as well.
Inside does not mean everywhere
If an attack does succeed it stays stuck in the app it entered through. Without network permission that app cannot send anything out, and your separate profiles stay unreadable behind their own keys.
A reboot clears it out
Much of this spyware does not embed itself permanently but lives in working memory. The automatic reboot clears that memory, so such an infection is gone afterwards.
Updates with nobody in between
Patches come straight from the GrapheneOS project, often faster than on devices where a manufacturer and carrier sit in between. With flaws like these, that difference in days is the whole difference.
To stay honest: nobody can guarantee an attack with a multi-million budget will never succeed. What you can do is make it so expensive and unreliable that it is not worth it, and that is exactly what these layers do.
The pattern
Three mistakes, every single time
The networks differed in name and price, but kept making the same structural choices.
- 01
A single point to attack
All messages ran through the provider’s servers. Take that one point and you take everyone at once. With Ennetcom, one seizure in Canada was enough.
- 02
Code nobody was allowed to see
Closed software means you cannot verify the claims. With ANOM the provider was the FBI itself, and that stayed invisible for years precisely because nobody could look inside.
- 03
Sold only to the underworld
These devices were so expensive and so aimed at criminal customers that owning one became evidence in itself. A phone that singles you out does not protect you.
Side by side
Why GrapheneOS does not share that fate
Not a longer key or smarter marketing, but a different model: there is simply no party that can betray you.
- Source code
- Closed crypto phoneClosed. You had to take the seller at his word.
- GrapheneOSPublic. Anyone can read it and build it themselves.
- Where the server sits
- Closed crypto phoneWith the provider. Every message ran through one point.
- GrapheneOSNowhere. There is no service, no account, no central server.
- One search warrant means
- Closed crypto phoneEveryone is exposed. That is exactly what happened five times.
- GrapheneOSOnly that one device. There is nothing central to demand.
- Who else uses it
- Closed crypto phoneAlmost exclusively the underworld. Owning one was suspicious by itself.
- GrapheneOSJournalists, lawyers, doctors and security researchers.
- What it cost
- Closed crypto phoneThousands of euros per six months, locked into a subscription.
- GrapheneOSThe operating system is free. You only pay for the phone.
- If the provider disappears
- Closed crypto phoneYour device is a brick and your contacts are unreachable.
- GrapheneOSNothing changes. Your phone keeps getting updates without us too.
Under the hood
What the device actually does
Six protections you can verify yourself, none of them dependent on us.
Verified boot
At every start the device checks whether the system matches the official build. If anything deviates, you see it on screen before you enter your PIN.
Per-app permissions
Network and sensors are separate permissions that are off by default. An app without network access cannot send anything, not even quietly in the background.
Duress PIN
A second PIN that irreversibly wipes the keys when entered. For situations where you are forced to unlock the device.
Hardened memory
GrapheneOS replaces core Android components with stricter versions. That closes off whole categories of attack before anyone tries them on you.
Google in a box
Play Services can run sandboxed as an ordinary app, without system privileges. Your apps work, but Google is not sitting in the core of your device.
Strongest when switched off
The device reboots automatically after a period of disuse, putting everything back behind encryption. The USB port can be disabled entirely while the screen is locked.
Staying honest
What it does not solve for you
Anyone telling you a phone makes you untouchable is selling you something. These are the limits.
- It does not protect you from your own habits. Log in with your own name or reuse passwords and the operating system stops mattering.
- It does not protect the other side of the conversation. What you send also sits on the recipient’s device, with their settings and their risk.
- It does not make you anonymous. Your provider still sees that there is traffic, just not what is inside. For that you need a VPN or Tor.
- It does not make anything legal that was not. We sell privacy to people with ordinary lives and ordinary reasons, not an escape route.
Ready to look at one?
Our phones arrive ready to use with GrapheneOS and the apps already configured. Come by in Enschede and check the verified boot fingerprint with us before you pay.