95% of Android Apps Work, Test GrapheneOS App Compatibility
Roughly 95% of Android apps run fine on GrapheneOS, and most of the exceptions fall into one category: apps that lean on strict hardware integrity checks, banking apps chief among them. Sandboxed Google Play and hardware attestation are the two routes that make the difference between an app working and an app refusing to launch. Behaviour shifts as banks and app developers update their security policies, so testing your specific apps yourself is the only reliable way to know where you stand.
TL;DR:
- About 95% of Android apps are compatible with GrapheneOS, mostly failing due to strict hardware integrity verification systems used by certain banking apps or anti-cheat software.
- Sandboxed Google Play allows most apps relying on Play Services, including social media, gaming, and some banking features, to function properly on GrapheneOS.
- Apps demanding hardware-backed device integrity verification or full unmodified Android profiles, such as some secure banking or enterprise apps, are likely to fail due to OS modifications and security policies.
- Testing app compatibility in a dedicated profile before fully trusting an app is crucial, especially for banking and payments, since some features like NFC tap-to-pay are structurally blocked for privacy reasons.
- Using pre-installed or verified devices from vendors like NordSecure can simplify setup and provide clearer verification, reducing the risk of setup errors affecting app compatibility.
Table of Contents
- GrapheneOS app compatibility by status: what works, what doesn’t
- What sandboxed Google Play actually does
- Play Integrity vs hardware attestation: why some banking apps get blocked
- Category-by-category: banking, payments, maps, wallets, messaging and games
- How to test whether an app will actually work
- Fixing common compatibility problems
- NordSecure’s ready-made GrapheneOS phones and verification tools
- Where to check current compatibility reports
- Our take: test first, don’t take anyone’s word for it
- Sources
- FAQ
GrapheneOS app compatibility by status: what works, what doesn’t
Before troubleshooting anything, it helps to know which bucket your app falls into. Compatibility on GrapheneOS isn’t a simple yes or no. It splits into four practical tiers, and knowing which one applies to your app saves hours of guesswork.
Works natively, no Google Play needed. These apps ask nothing of Google Play Services and run exactly as they would on any Android phone. Signal, most note-taking apps, offline games, and open-source software from repositories like F-Droid fall here. You install the APK, and it behaves.
Works after installing sandboxed Google Play. This is the largest group of apps that would otherwise fail. They call on Play Services for push notifications, in-app billing, or basic device checks, and once sandboxed Play is installed, those calls succeed. Most social media apps, many games, and a good share of banking apps sit in this tier.
Partially works, with a specific feature missing. The app opens and mostly functions, but one feature is blocked. Google Pay’s NFC tap-to-pay is the classic example: the banking app itself works, but the contactless payment layer inside it does not. Some ride-hailing or delivery apps show a similar pattern where account login works but a payment step fails.
Does not work, full stop. A small number of apps refuse to run at all, usually because they demand STRONG_INTEGRITY verification tied to a stock, unmodified Android build, with no aftermarket OS permitted—no exceptions. Some competitive multiplayer games with aggressive anti-cheat systems land here, along with a handful of corporate mobile device management tools.
Where an individual app sits can change from one update to the next. A bank might tighten its checks this quarter and loosen them next quarter, and a game studio might swap anti-cheat vendors overnight. Two resources track this better than any static guide:
- Community compatibility trackers, such as the discussion thread on the GrapheneOS forum, where users report app-by-app results as they test them.
- Crowd-sourced datasets like the PrivSec banking apps compatibility report, which tracks regional banking apps specifically, since bank policies vary enormously by country.
Neither source is gospel. Treat them as a starting point, then verify against your own device and account before trusting an app with anything sensitive.
What sandboxed Google Play actually does
Sandboxed Google Play is the single biggest reason GrapheneOS app compatibility is as good as it is. It runs Google Play Services and the Play Store as an ordinary app with no special permissions, not as a privileged system component baked into the operating system the way it is on stock Android. That distinction matters more than it sounds.
On a standard Android phone, Google Play Services has deep hooks into the OS: it can read device identifiers, monitor other apps, and access system-level APIs that no ordinary app is allowed to touch. GrapheneOS strips all of that away and reimplements Play as a sandboxed compatibility layer that behaves like any other app you’d install from the Play Store. It still talks to Google’s servers and still provides the services apps expect, just without the privileged access.
Most of what apps actually need from Play still works inside that sandbox. According to GrapheneOS’s own usage documentation, the following keep functioning normally:
- Push notifications through Firebase Cloud Messaging
- In-app purchases and billing
- Automatic Play Store updates for installed apps
- Play Asset Delivery for large game files
- Dynamite modules that some apps load at runtime
What doesn’t survive the sandbox are the genuinely privileged functions: system-level location fusing that blends GPS with Wi-Fi and cell data at the OS layer, direct access to hardware identifiers for tracking purposes, and any function that assumes Play Services is running with system permissions. GrapheneOS reroutes basic location requests through its own privacy-respecting implementation instead, which is usually accurate enough for maps and ride-hailing apps but occasionally less precise indoors.
You can install sandboxed Play in your main (owner) profile or in a separate user profile, and this choice matters more than people expect. Installing it in a dedicated profile, separate from your everyday apps and personal data, means that even if a Play-dependent app ever misbehaves or a Google server-side change causes odd behaviour, it stays contained to that profile. Your primary profile, and anything you keep away from Google entirely, remains untouched.
Pro Tip: Set up sandboxed Play in a second profile dedicated purely to apps that demand it, banking, maps, whatever needs it. Keep your main profile Google-free. If something goes wrong in the sandboxed profile, you can wipe just that profile without losing anything else on the phone.
Play Integrity vs hardware attestation: why some banking apps get blocked
Banking apps are the most common source of frustration for anyone checking GrapheneOS app compatibility, and the reason comes down to two competing integrity systems that developers can choose between.
Play Integrity is Google’s app-facing verification system, and it reports back three tiers of trust: basicIntegrity, ctsProfileMatch, and STRONG_INTEGRITY. basicIntegrity just confirms the device isn’t obviously rooted or emulated, and most apps that check this pass fine on GrapheneOS. ctsProfileMatch demands that the device runs an unmodified build that matches Google’s Compatibility Test Suite exactly, which an aftermarket OS like GrapheneOS cannot satisfy, because it is, by definition, modified. STRONG_INTEGRITY layers hardware-backed key attestation on top of that, and this is where the strictest banking apps and a handful of games draw the line.
Hardware attestation is a different, older, and more flexible mechanism. Rather than asking “is this exactly Google’s stock build,” it asks the device’s secure hardware to cryptographically prove which OS is running and that it booted through a verified chain. GrapheneOS supports this fully. It ships a published attestation.json file containing verified boot fingerprints that an app’s backend can check against, allowing it to trust a genuine GrapheneOS installation without requiring it to be stock Android.
The practical difference: an app built to check ctsProfileMatch will fail on GrapheneOS regardless of what you do, because sandboxed Play cannot forge a stock-Android profile it doesn’t have. An app built to accept hardware attestation, or one that only checks basicIntegrity, will typically pass without issue.
Community estimates put overall compatibility at roughly 95%, with banking and other integrity-dependent apps accounting for the bulk of the remainder and a small number of unrelated outliers making up the rest. That’s a strong figure for an OS that deliberately removes Google’s privileged access, but it also means the apps that fail tend to be exactly the ones people care most about getting right.
Sandboxed Play can satisfy Play Integrity checks in many cases, because the Play Services layer itself is a certified component that can pass verification even while sandboxed. But GrapheneOS’s own usage guide is candid that some apps demanding STRONG_INTEGRITY with strict device certification flags will still fail, sandboxed Play or not. There’s no user-side fix for that. The only real lever is developer adoption of hardware attestation, and GrapheneOS actively encourages developers to make that switch, arguing that hardware-backed attestation is a stronger security model than a software profile match that can, in principle, be spoofed on other devices anyway.
Category-by-category: banking, payments, maps, wallets, messaging and games
Compatibility patterns differ sharply by app category, and knowing which category you’re dealing with tells you what to expect before you even install anything.
Banking and payment apps
Most banking apps work on GrapheneOS once sandboxed Google Play is installed, though results vary bank by bank and country by country. The common fix, if login or balance checks fail on first attempt, is installing sandboxed Play in a dedicated profile and retrying. A GrapheneOS forum thread dedicated to exactly this question collects working configurations reported by users across dozens of institutions.
The persistent limitation, and the one no workaround currently solves, is Google Pay’s contactless NFC payment feature. GrapheneOS deliberately restricts system-level access to the phone’s NFC Secure Element, which Google Pay requires to tokenise card details for tap-to-pay. This isn’t a bug to fix; it’s a deliberate privacy and security boundary GrapheneOS draws around that hardware component, and community discussion confirms it’s a structural incompatibility rather than a temporary gap. Some banks build their own NFC payment implementation directly into their app rather than relying on Google Pay, and those occasionally work, but there’s no universal rule; check your specific bank rather than assuming either way.
Maps and GPS
Navigation apps generally work, but expect small differences. GrapheneOS reroutes location requests through its own implementation rather than Google’s privileged fused location provider, which is usually close enough for driving directions but can be less precise indoors, in dense cities, or the moment you exit a tunnel. Permission prompts also behave slightly differently, since GrapheneOS enforces more granular location controls than stock Android by default.
Crypto wallets
Cryptocurrency wallet apps are, on the whole, one of the smoother categories. Most function normally, since they rarely depend on Google Play Services for core wallet operations. The exception worth flagging: wallets that use FIDO2 hardware security keys or rely on a phone’s secure element for biometric authentication may behave differently depending on how that particular Pixel model’s secure element is exposed to third-party apps under GrapheneOS.
Messaging and social apps
Messaging apps split cleanly along the same lines as everything else. Apps with no Play dependency (Signal being the obvious example) work immediately. Apps that rely on Play for push notifications, most mainstream messaging and social platforms, need sandboxed Play installed but then function normally, including message delivery, media uploads, and calling. The one caveat: cloud backup features tied to a Google account may behave inconsistently if you’re running a fully de-Googled setup, so keep a manual export of anything you can’t afford to lose.
Games with anti-cheat and enterprise MDM
This is where GrapheneOS app compatibility hits its hardest wall. Competitive multiplayer games using kernel-level or STRONG_INTEGRITY-based anti-cheat systems are designed specifically to reject anything other than a stock, unmodified Android build, and there is currently no reliable workaround. The same applies to enterprise mobile device management (MDM) software used by employers, which frequently checks for a fully locked-down, vendor-verified device state that an aftermarket OS cannot present, even one as security-focused as GrapheneOS. If your job requires a specific MDM profile, assume it won’t work and plan for a separate work device instead of fighting the OS.
How to test whether an app will actually work
Guesswork wastes time. A short, repeatable test sequence tells you within minutes whether an app is going to work, need sandboxed Play, or refuse outright.
- Update GrapheneOS first. Compatibility shifts with every OS release, so start from the current build.
- Decide your profile strategy. Pick whether the app goes in your main profile or a dedicated Play-enabled profile, and set that profile up before installing anything.
- Gather fallback details. Note your account login, and check whether the provider offers a web version you could use if the app fails entirely.
- Install sandboxed Play in your chosen profile, then install the app from the Play Store within that same profile.
- Test the critical flow first, not peripheral features. For a banking app, that means login and a balance check. For a messenger, that means sending and receiving a message.
- Read any error message carefully. A generic “device not supported” message usually signals a Play Integrity failure. A crash on launch often signals a missing system API that sandboxed Play can’t provide.
- Check feature-specific limitations separately. Confirm whether NFC payment or biometric unlock works, since these can fail independently of the core app.
- Record the outcome, including OS version, app version, and the exact error text if something failed.
That last step matters more than it seems. A structured test like installing in a separate profile, attempting the core workflow, then falling back to the web version is exactly what experienced GrapheneOS users report as the most reliable diagnostic, and capturing the precise error text is what turns a vague “it doesn’t work” into something a community tracker or app support team can actually act on.
Pro Tip: Screenshot the exact error message before you do anything else. “Device integrity check failed” and “network error” point to completely different problems, and support teams (or fellow users on a compatibility thread) can’t help you without that detail.
Fixing common compatibility problems
Most compatibility failures fall into a handful of repeatable patterns, and most of them have a fix worth trying before you give up on an app.
- Reinstall in the correct order. If an app fails after installing sandboxed Play, uninstall the app, clear any leftover data, restart the profile, reinstall sandboxed Play, then reinstall the app fresh. Order matters more than people expect.
- Try a clean profile. A brand-new user profile with nothing else installed removes every variable except the app itself, which is the fastest way to confirm whether a conflict is app-specific or profile-specific.
- Check exploit-protection compatibility toggles. GrapheneOS includes hardening features that occasionally interfere with an app’s own anti-tamper checks. Toggling native debugging or specific exploit protections off for that one app, cautiously, and only for apps you trust, sometimes resolves crashes that look unrelated to Play Integrity.
- Recognise when sandboxed Play won’t help. If the error explicitly references
STRONG_INTEGRITYor a device certification failure, no reinstall or profile change will fix it. That’s a developer-side decision, not a configuration problem. - Use the web version as a bridge. Most banks, and a surprising number of other services, offer a full-featured web app that covers everything short of push notifications.
- File the result somewhere useful. If an app fails, report it to the community compatibility thread or the app’s own support channel, mentioning GrapheneOS by name and the exact error. Developer awareness is slowly what shifts apps from “blocked” to “supported.”
NordSecure’s ready-made GrapheneOS phones and verification tools
Testing app compatibility yourself takes time, and setting up GrapheneOS from scratch, unlocking the bootloader, flashing the OS, re-locking verified boot, adds a technical barrier that puts plenty of privacy-conscious buyers off before they start. There are vendors that sell Google Pixel phones with GrapheneOS pre-installed, verified boot re-locked, and no Google account or telemetry.
Nordsecure also publishes a step-by-step verification guide so you can independently confirm your device is running a genuine, unmodified GrapheneOS build rather than taking that claim on faith, and a free GrapheneOS Compatibility Checker to check whether a given Pixel model is supported before you buy anything.
| Buyer situation | Better fit |
|---|---|
| Comfortable flashing and re-locking bootloaders yourself | DIY install using GrapheneOS’s own documentation |
| Wants a verified, working device without the setup risk | Pre-configured Pixel from Nordsecure |
| Needs anonymous connectivity alongside the phone | Some providers offer prepaid eSIMs without requiring ID or KYC. |
| Testing app compatibility before committing to hardware | Nordsecure’s free compatibility checker |
Pairing a pre-hardened Pixel with an anonymous prepaid eSIM from Nordsecure’s regional and global plans is worth the extra cost specifically for people who need to be operational immediately, journalists on assignment, activists who can’t risk a misconfigured device, or anyone travelling who doesn’t want to hand over identification just to get a working data connection.
Where to check current compatibility reports
Static guides go stale. The GrapheneOS features page and usage guide are the two official references worth bookmarking, since they’re updated directly by the project and explain exactly what sandboxed Play does and doesn’t support.
For anything bank-specific, the PrivSec banking compatibility report tracks regional policy changes as they happen, which matters because banks adjust their integrity requirements far more often than GrapheneOS itself changes. Treat crowd-sourced entries as a strong starting signal, not a guarantee, and always confirm against your own account before trusting an app with money.
Our take: test first, don’t take anyone’s word for it
The conventional advice on this topic treats compatibility as a fixed list, this app works, that one doesn’t, when in reality it’s a moving target shaped by two things: whether Google Play is sandboxed correctly, and whether a developer chose hardware attestation over a stock-only integrity check. Everything else is downstream of that.
Where most guides fall short is stopping at “check a compatibility list” rather than teaching people to run their own five-minute test. Lists go stale the moment a bank tightens its policy. A profile-based test with a clear fallback plan doesn’t.
If you’re weighing GrapheneOS for the first time, prioritise the apps you cannot live without, banking and messaging usually, over broad compatibility claims. Test those specifically, in a dedicated profile, before committing. And if setting up the OS yourself feels like more risk than you want to take on, a verifiably pre-configured device removes that variable entirely without asking you to trust a marketing claim over your own inspection.
— Kaare
Sources
- Features overview | GrapheneOS
- Thread for discussing 3rd party app compatibility. – GrapheneOS Discussion Forum
FAQ
What phones will GrapheneOS work on?
GrapheneOS officially supports Google Pixel devices only, since it relies on Pixel-specific hardware security features like verified boot and the Titan security chip. It does not officially support phones from other manufacturers.
What are the downsides of GrapheneOS?
The main downsides are the loss of some privileged Google Play functions, occasional friction with banking apps that require strict integrity checks, and no support for Google Pay’s NFC contactless payments. A small number of games with strict anti-cheat and enterprise MDM tools also won’t run.
Does GrapheneOS support all Android apps?
No, but it comes close: community estimates put overall app compatibility at roughly 95%. The apps that fail are mostly ones demanding STRONG_INTEGRITY verification tied to an unmodified stock Android build.
Will my banking apps work on GrapheneOS?
Most banking apps work once you install sandboxed Google Play, though results vary by bank and country. Contactless NFC payments through Google Pay remain unsupported regardless of which bank you use, since GrapheneOS restricts system-level access to the NFC Secure Element.
Recommended
Written by
The NordSecure team · Privacy & security
Written by the people who flash, harden and support the devices and private connectivity NordSecure sells — so what you read here comes from the same hands that build the product.
Read next
5 Privacy First Paths to Run Google Maps on GrapheneOS
Five community-tested paths to run Google Maps on GrapheneOS, with step-by-step sandbox setup, a hybrid OSM workflow, or a turnkey preconfigured Pixel and… Share this: Share on X (Opens in new window) X Share on Facebook (Opens in new…
From First Boot, Set Up Push Notifications Privately on GrapheneOS
Set up and troubleshoot push notifications on GrapheneOS while limiting Google access. Follow the correct install order, add battery exceptions, or use… Share this: Share on X (Opens in new window) X Share on Facebook (Opens in new window)…
Not for Banking: Aurora Store Safety for Privacy Focused Android Users
Aurora Store works for everyday Android apps but lacks Google’s signed-update provenance. Read community-sourced risks, safe precautions, and a turnkey… Share this: Share on X (Opens in new window) X Share on Facebook (Opens in new window)…
Ready for a phone that's private by default?
Skip the setup — we flash, harden, and verified-boot re-lock it for you. Travelling instead? Grab an anonymous data eSIM.