What this is

A Google Pixel 8a handset, refurbished and reflashed with GrapheneOS, a security- and privacy-hardened mobile OS based on the Android Open Source Project. The bootloader is re-locked under GrapheneOS signing keys, so verified boot is active and the device is delivered in the same state a careful self-installer would reach.

The Pixel 8a is on the official GrapheneOS device list. The 8th-generation Pixels expose ARM's hardware memory tagging (MTE), which GrapheneOS uses by default to make whole classes of memory-corruption exploits fail fast. Combined with the hardened_malloc allocator, hardware-backed verified boot with rollback protection, the Titan M2 secure element, and an IOMMU-isolated baseband, this is a defensible baseline against remote and opportunistic attackers.

Honest positioning

GrapheneOS raises the cost of compromising the OS. It does not change the laws of physics or radio. The baseband still talks to the carrier over protocols you cannot trust, your SIM and IMEI still identify you, and a determined adversary with physical possession of an unlocked phone still wins. This product is for buyers who understand their threat model and want a clean, attested, hardened Android they can run sandboxed Google Play on only if and when they choose.

This is lawful privacy hardening. It is not a tool for evading lawful interception, and nothing here defeats a court-ordered, on-device search of a phone you have been compelled to unlock.

Usage guide

Before you start

The device ships already running GrapheneOS with the bootloader re-locked. You do not need to reflash it to use it. This guide covers verifying that state, daily use, hardening, and re-installing from scratch if you ever want to.

Verify integrity first

Do this before trusting the device.

1. Check the boot state. Power off, then hold Volume Down while powering on to reach the bootloader. A locked bootloader with GrapheneOS keys shows a yellow boot warning with a key fingerprint. Compare that fingerprint against the official values on the GrapheneOS install page.
2. Run hardware attestation. Install the Auditor app (bundled with GrapheneOS) and run a local self-attestation, or pair with a second Android device for remote attestation. Auditor uses the Titan M2 hardware key to prove the OS is genuine GrapheneOS and the bootloader is locked. This is the strongest check available.

If the boot state is not yellow/locked, or attestation fails, stop and reflash from scratch (see below).

First-boot setup

• Set a strong PIN or passphrase (6+ digits minimum; a passphrase is much stronger). This is the root of disk encryption.
• Decide whether you need Google services at all. If you do, install sandboxed Google Play — ideally in a separate user profile so it never touches your main profile. It runs as a normal unprivileged app with no special access.
• Use the built-in Vanadium browser for the hardened default; add F-Droid or Aurora Store for apps only as needed.

Daily use and hardening

Exploit-protection settings

• USB-C port control (Settings → Security → Exploit protection): the default *Charging-only when locked* blocks data over USB while locked, cutting a major physical attack surface. Set it stricter if you never need USB data.
• Auto-reboot timer: by default the phone reboots after a period of inactivity, returning it to the more secure Before-First-Unlock state where keys are not in memory. Keep it short if you are concerned about seizure.
• Per-app Network and Sensors permissions: deny network to apps that have no business phoning home; deny sensors to apps that should not read the gyroscope/accelerometer.

Scopes instead of blanket permissions

• Storage Scopes and Contact Scopes let an app believe it has full access while you actually grant nothing or a curated subset. Prefer these over granting real Contacts/Storage permissions. See the usage guide.

Duress PIN (use with care)

Settings → Security & privacy → Device unlock → Duress password sets an alternate code that triggers an immediate, irreversible factory wipe of all profiles and encryption keys. Understand that this is destructive and unrecoverable. It mitigates device seizure; it does not protect you if you are compelled to enter your real PIN. Know the law in your jurisdiction before relying on it.

Network and metadata hygiene

• The baseband and SIM identify you to the carrier regardless of the OS. For network-level privacy, route traffic through Tor via Orbot or a trusted VPN — GrapheneOS does not do this for you.
• Per-connection MAC randomization is on by default for Wi-Fi; keep it on.
• Treat SMS and voice calls as unencrypted. Use end-to-end encrypted messaging (e.g. Signal) for anything sensitive.

Updating

GrapheneOS updates over the air automatically. Keep Automatic reboot enabled so security updates fully apply. Vendor firmware/security support for the Pixel 8a runs through May 2031; after that, the hardware no longer receives Google firmware patches and you should plan to migrate.

Reflashing from scratch

If you want to reinstall yourself, follow the official web installer: enable OEM unlocking, unlock the bootloader (wipes data), flash via a WebUSB-capable browser (Chromium/Vanadium/Chrome, not the Snap/Flatpak builds), then re-lock the bootloader — locking is what enables verified boot with your keys. Verify with Auditor afterward.