How to Verify Your GrapheneOS Device Is Running Genuine Software
When you buy a pre-flashed phone, a reasonable question is: how do I know it actually runs what it claims to? That question deserves a direct answer, not a promise.
Verified boot is Android’s mechanism for answering it. This guide explains what it does, why it matters, and how you can use it to confirm your device runs genuine, unmodified GrapheneOS — using public tools and your own eyes, not our word.
What Verified Boot Actually Does
Every time your phone powers on, the bootloader checks a cryptographic signature against the operating system. If the OS has been tampered with — even a single changed file — the signature fails and the device refuses to boot normally.
GrapheneOS uses its own signing keys, separate from Google’s. When verified boot is enabled and re-locked with GrapheneOS keys, the device can only boot GrapheneOS. It cannot silently boot a modified or substituted OS. There is no workaround for this at the software level.
This is the property that makes pre-flashed phones verifiable. The trust does not rest on a seller’s assurance. It rests on a cryptographic check your device performs independently, every time it starts.
Prerequisites
- A Google Pixel phone running GrapheneOS with verified boot re-locked
- A computer with Android Debug Bridge (ADB) installed
- USB cable
No additional software is required.
Step 1: Enable Developer Options
- Open Settings → About phone
- Tap Build number seven times
- Enter your PIN if prompted
- Developer Options is now available under Settings → System → Developer Options
Step 2: Enable USB Debugging
- Go to Settings → System → Developer Options
- Enable USB debugging
- Connect your phone to your computer via USB
- On the phone, tap Allow when prompted to authorise the connection
Step 3: Check the Verified Boot State
Open a terminal on your computer and run:
adb shell getprop ro.boot.verifiedbootstate
You should see:
green
What each value means:
| Value | Meaning |
green | Verified boot is active; the OS matches the signed key. This is what you want. |
yellow | Verified boot is active, but with a user-installed key (custom OS, re-locked). Also acceptable if expected. |
orange | Bootloader is unlocked. The OS is not verified at boot. |
red | Verification failed. The device did not pass its integrity check. |
On a NordSecure device, you should see green . This means the device booted GrapheneOS using its official signing key, and the bootloader is re-locked.
Step 4: Verify the GrapheneOS Signing Key
Seeing green confirms verification is active. The next step confirms whose key is being used — specifically, that it is GrapheneOS’s official key and not a substitute.
Run:
adb shell keystore_cli_v2 get-cert-chain
This outputs the certificate chain used by the verified boot key. Cross-reference the fingerprint against the official GrapheneOS public key, available at grapheneos.org/install/verified-boot .
GrapheneOS also publishes a detailed verification guide. The fingerprints are stable and independently documented.
Step 5: Confirm the Build
Run:
adb shell getprop ro.build.fingerprint
This returns the exact build installed on your device — model, OS version, and build date. You can compare this against the official GrapheneOS release page at grapheneos.org/releases to confirm you are on the correct, current build.
What You Have Now Confirmed
By completing these steps, you have independently verified:
- Verified boot is active and passing — the OS matches the signed key at every boot
- The signing key belongs to GrapheneOS — not a third party, not the seller
- The installed build matches an official release — and can be compared against public release notes
No part of this process requires you to trust NordSecure’s word. The checks are performed by your device and verified against GrapheneOS’s public documentation.
A Note on Re-Locked Bootloaders
A common concern with pre-flashed devices is whether the bootloader has been properly re-locked. An unlocked bootloader means verified boot is disabled and the OS cannot be cryptographically confirmed. The getprop ro.boot.verifiedbootstate command returning green directly confirms the bootloader is locked and verification is active.
If you purchased a NordSecure device and see anything other than green , contact us before using the phone.
Summary
Verified boot is not a marketing claim. It is a hardware-level cryptographic check that runs every time your device starts. These five steps let you confirm — using ADB and GrapheneOS’s public documentation — that your phone is running exactly what it says it is.
Security you can verify is security you can trust.
NordSecure ships pre-configured Google Pixel phones running GrapheneOS, with verified boot re-locked before shipping. Every device is flashed, checked, and shipped ready to verify.
Keep reading
Ready to act on this? how we prove every phone we ship is genuine.
Written by
The NordSecure team · Privacy & security
Written by the people who flash, harden and support the devices and private connectivity NordSecure sells — so what you read here comes from the same hands that build the product.
Read next
How to Harden Your Android Phone: The Complete Security Checklist for 2026
You don’t need to switch operating systems to significantly improve your phone’s security. Stock Android, properly configured, is dramatically more secure and private than the factory defaults most people never touch. This guide walks you…
Why Your Smartphone Is the Biggest Security Risk You’re Ignoring
Most people lock their front door every night. They wouldn’t leave their wallet on a park bench. Yet that same person carries a device in their pocket containing their bank accounts, private messages, photos, work emails, home address,…
GrapheneOS Review: The Most Secure Mobile OS You’ve Never Heard Of
If you’ve ever wondered whether your smartphone truly keeps your data private — this article is for you. Most people trust that their phone’s built-in security is “good enough.” But for an increasingly aware group of professionals,…
Ready for a phone that's private by default?
Skip the setup — we flash, harden, and verified-boot re-lock it for you. Travelling instead? Grab an anonymous data eSIM.