Before we start: you need the right hardware. Go grab a refurbished Pixel from Reebelo — 6a and up will work, but I’d recommend a 7 or 8 series for the best experience. (See Part 1 for why Pixels and what makes GrapheneOS different). Avoid carrier variants (Verizon, AT&T) because their bootloaders are often locked. You want an unlocked or carrier-free model.
You’ll also need a computer with a Chromium-based browser. Chrome, Brave, Edge — any of those work. Firefox won’t work for the web installer (WebUSB limitation). I use Brave.
And a USB-C cable that can actually transfer data, not just charge. Some cables are charge-only. If the installer can’t see your phone, that’s the first thing to check.
Step 1: Backup everything
Factory reset is coming. You will lose everything on the phone. Back up your seed phrases, your Signal messages, your 2FA seeds — everything. This is not the step to rush through.
Step 2: Enable Developer Options and OEM Unlock
On your Pixel running stock Android:
- Go to Settings > About phone > Build number
- Tap Build number seven times until it says you’re a developer
- Go back to Settings > System > Developer options
- Enable OEM unlocking
- Enable USB debugging
OEM unlocking may take a minute to activate while the phone phones home to Google’s servers. If it’s greyed out, you either have a carrier-locked device or you need to connect to the internet and wait.
Step 3: Boot into the bootloader
Power off the phone. Then hold Power + Volume Down until you see a screen with a little Android robot and some text. That’s the bootloader. Don’t be intimidated — you’re not doing anything irreversible yet.
Step 4: Open the web installer
On your computer, go to:
https://grapheneos.org/install/web
Select your device model from the dropdown. The page will give you device-specific firmware and instructions.
Plug your phone into the computer.
Click “Connect” on the web installer page. A browser dialog will pop up asking which device to connect to. Select your Pixel.
Step 5: Unlock the bootloader
The web installer will guide you through this. Use the volume buttons to move around and the power button to confirm on the phone screen. The bootloader unlock wipes the phone — that’s expected. After it completes, the phone reboots back into the bootloader.
This is the point of no return. Once the bootloader is unlocked, some banking apps and streaming services may stop working on stock Android (they detect the unlocked bootloader). But we’re installing GrapheneOS, so it doesn’t matter — we’ll lock it again later.
Step 6: Flash GrapheneOS
The web installer handles everything from here. It downloads the latest build, flashes the firmware, reboots into the bootloader interface, and flashes the OS. You’ll see a progress bar. Let it run. Don’t unplug the cable. Don’t touch the phone.
The whole process takes maybe 5–10 minutes depending on your internet speed.
Step 7: Lock the bootloader
After flashing completes, the phone should be back in the bootloader. Use the volume keys to navigate to “Lock bootloader” and press the power button to confirm.
Yes, lock it. This is important. An unlocked bootloader is a security risk — someone with physical access to your phone could flash a malicious OS. Locking it restores the verified boot chain. Only your GrapheneOS installation will boot.
Step 8: Reboot
Select “Start” from the bootloader menu. The phone will boot into GrapheneOS for the first time. You’ll see the initial setup screen — clean, minimal, no Google login prompt trying to eat your data.
You’re in
That’s it. No adb commands to memorize. No downloading factory images manually. No terminal voodoo. The web installer does the heavy lifting. The hardest part is waiting for the page to detect your phone.
A few things to note:
- If the installer says “No device detected” — try a different cable, a different USB port, or restart the phone in bootloader mode and try again.
- If OEM unlocking was greyed out — you have a carrier-locked phone. This won’t work. Get a different device.
- If you’re on Linux — the web installer also works. You may need to set up udev rules for the Pixel, but Brave/Chrome will usually prompt you to do that.
Next up is Part 3, where we set up the phone for actual daily use — multiple profiles, the app stores I actually use (Obtainium, Aurora Store, Accrescent, Zap Store), and how to build a GrapheneOS setup you can live with every day.