You've just installed GrapheneOS — or you're about to hit the power button for the first time. This guide covers your first hour: what that unusual boot screen means, how to get around, and the settings worth changing on day one, while the phone is still empty and every choice is easy.
That yellow boot screen is a feature, not a warning
Every time a GrapheneOS phone starts, it shows a yellow notice with an ID — often alarming the first time, but this is expected behaviour on every GrapheneOS device. It appears because the phone is running an operating system you chose rather than Google's, and it doubles as something stock phones never give you: a boot-time integrity check.
The ID on that screen is your operating system's verification fingerprint. It should stay the same from boot to boot, and you can compare it against the official verified-boot hashes GrapheneOS publishes for your exact Pixel model at grapheneos.org — proof, every single startup, that nobody has tampered with your system.
Good to know
If that ID ever changes when you haven't installed an update, don't unlock the phone — verify against the published hashes first. That's the exact scenario verified boot exists to catch.
Finding your way around — especially if you're coming from iPhone
Swipe left or right on the home screen to move between app pages, and flick gently upward from the middle of the screen to open your full apps library — you can scroll it or search it. To go home from any app, one gentle swipe up from the bottom edge; a slower swipe up shows your open apps, and flicking one upward closes it.
Your notifications live behind a gentle swipe down from the top of the screen. The small icons in the top corner are just a shortlist of recent notifications — a common worry is that they represent background processes or something suspicious, but they're nothing more than unread notices. On GrapheneOS, notifications stay until you dismiss them: swipe each one away, or use clear all.
Swipe down a second time and you get the quick toggles — Wi-Fi, Bluetooth, torch, aeroplane mode and more. These are genuine kill switches on GrapheneOS, and the panel is fully customisable.
There's no back button drawn on screen: swipe inward from the left or right edge instead — anywhere you'd have looked for a back arrow. Screenshots are power + volume down together. Press and hold the power button for shutdown and restart options.
To rearrange the home screen, press and hold an app until you feel a slight rumble, then drag — to another spot, to the remove button (takes it off the home screen), or to uninstall.
Lock it down: PIN first, fingerprint second
Set a PIN before anything else goes on this phone: Settings → Security & privacy → Device unlock → Screen lock → PIN. A password is even stronger if you'll tolerate typing it — aim for more than 6 characters with some complexity.
Then add a fingerprint for convenient day-to-day unlocking: Settings → Security & privacy → Device unlock → Fingerprint unlock, then follow the prompts — press and lift your finger in different positions until it maps the print. You can enrol more than one finger.
Good to know
PINs and fingerprints are per profile on GrapheneOS. If you set up extra profiles later, each gets its own — same or different, your call.
The day-one hardening checklist
GrapheneOS ships with strong defaults, but a handful of settings push it further. Menus move between versions — if a path below doesn't match, use the search bar inside the Settings app to find the setting by name.
Network behaviour: stop Wi-Fi and Bluetooth from ever turning themselves back on (when you switch them off, they should stay off — unlike normal phones, where apps can quietly re-enable them), block connections to ancient WEP-encrypted networks, and turn off notifications about available public networks so you're never nudged onto an unsecured hotspot. If you use your hotspot: give it a long password, a name that doesn't identify you or the device, and WPA3/WPA2 security. Set Bluetooth to switch itself off after a minute without a connection.
NFC: unless you genuinely use it, turn it off. Contactless card data has been read by pocket-sized cloning tools, and a radio you never use is attack surface for nothing.
Lock screen: hide sensitive notification content (so messages and one-time codes aren't readable on a locked phone), turn off tap-to-check and lift-to-check so the screen only wakes when you press the button, set screen timeout to 1 minute, make the power button lock instantly rather than after a delay, and disable media and camera controls on the lock screen.
Auto-reboot: set the phone to restart itself after a period without an unlock (12–18 hours suits most people). A freshly rebooted phone holds its data in the strongest encryption state — this one setting defeats a whole class of advanced data-extraction tools used against lost and seized phones.
Sensors: GrapheneOS gives every app a sensors permission that other Androids don't have. Deny it by default — apps that don't need your gyroscope, barometer and compass get zeroed readings instead of a fingerprintable motion profile.
USB port: under Settings → Security & privacy → Exploit protection, set the USB-C port to charging-only. Malicious cables and keystroke-injection gadgets that impersonate keyboards simply don't work against a port that won't carry data.
Mobile network: once your SIM is in, open Settings → Network & internet → SIMs → your SIM and turn on 2G network protection — 2G is obsolete for coverage but still exploited by fake-tower interception rigs. In the same section, set your preferred network type to 4G/LTE: it disables a mountain of legacy and bleeding-edge radio code. Honest caveat: this hardens the phone against remote exploitation — it is not encryption for your calls and texts, so keep using end-to-end encrypted apps for anything sensitive.
Good to know
Start strict, relax deliberately. It's far easier to loosen one setting when it genuinely bothers you than to remember to tighten twenty settings later.
Phone set up and locked down? Next stop: getting your apps on board — see our guide to app stores and sandboxed Google Play on GrapheneOS.
Was this guide helpful?
Know someone who needs this? Send them the guide.