GrapheneOS compatibility checker
GrapheneOS is a privacy-hardened Android that runs only on Google Pixel hardware — because Pixels let the bootloader be re-locked with the new OS's own keys, the step that makes verified boot trustworthy. Pick your phone below to see whether it's supported and, just as important, how long it will keep getting security updates.
Why Pixel only
GrapheneOS depends on a hardware feature most phones lock away: the ability to re-lockthe bootloader after installing a different operating system, using that OS's own signing keys. That's what lets the phone prove, at every boot, that it's running unmodified software.
Google Pixel is the mainstream line that allows this without giving up the security guarantees. Samsung's Knox, Apple's locked ecosystem, and most other Androids either block re-locking or trip irreversible security fuses — so they can't offer the same verifiable integrity, whatever custom software you put on them.
Supported now vs supported for long
"Supported" is time-bound. GrapheneOS keeps a Pixel going only while Google ships it security patches — 7 years from launch on the Pixel 8 and newer, 5 years on the 6 and 7 series. Two Pixels bought the same day can have very different amounts of life left, which is why the checker shows the window, not just a yes/no.
Do it yourself, or don't
Installing GrapheneOS is free and well-documented — if you're comfortable flashing a phone, do it yourself. If you'd rather skip the process and the risk of getting the verified-boot re-lock wrong, that's the service NordSecure sells: a supported Pixel, flashed, hardened, and re-locked, with every step testable by you afterwards.
GrapheneOS compatibility checker — common questions
- Which phones can run GrapheneOS?
- Only Google Pixel phones, and only while Google still ships them security updates. GrapheneOS needs hardware that allows the bootloader to be re-locked after installing a new OS — Pixels support this and mainstream Samsung, Apple and other Android phones do not. That's a hardware limitation, not a preference.
- Why does GrapheneOS only support Pixels?
- Verified boot only means something if the bootloader can be re-locked with the installed OS's own keys, so the phone can cryptographically prove it's running unmodified software. Pixel is the mainstream line that permits this while keeping the security guarantees intact — which is why it's the reference hardware for the project.
- My Pixel says 'end-of-life' — can I still install it?
- Technically you may be able to, but you shouldn't rely on it as a privacy device. Once Google stops shipping security patches for a model, GrapheneOS can't provide complete security coverage either — so an end-of-life phone misses fixes for newly-discovered vulnerabilities. For a device whose whole point is security, an in-support model is the honest choice.
- How long will my Pixel keep getting updates?
- The Pixel 8 and newer carry Google's 7-year guarantee from launch; the Pixel 6 and 7 series are on the older 5-year window. So a Pixel 6 reaches end-of-support years before a Pixel 9 bought the same day. The checker flags which window your model is on.
- Do I have to install it myself?
- No. Installing GrapheneOS is genuinely free and the project publishes clear instructions, so you can do it yourself. If you'd rather not, NordSecure sells Pixels with GrapheneOS professionally installed, hardened, and verified-boot re-locked — every step done and testable by you afterwards.
Related free tools
What NordSecure does about it
A free test tells you what's leaking. Fixing it usually means changing the device or the connection, not just the browser tab — which is exactly what NordSecure sells, without a name or an account.