GrapheneOS has robust defenses against data extraction, heavily relying on the standard security features provided by Android 17 and the most secure hardware available. Currently, only Pixels offer the necessary hardware security features and updates for GrapheneOS, but this will change in 2027 thanks to a collaboration with Motorola Mobility and advancements from Qualcomm.
Disk encryption provides strong protection for data. Even the most sophisticated attackers cannot directly break it; they need to exploit the OS while in the After First Unlock state or brute force the PIN/password. Android 16 QPR2 requires a secure element implementing rate limiting with ramping delays: 4 hours after 10 attempts and 41 days after 15 attempts, allowing only 20 attempts total. For usability, it rejects the most recent 5 unique failed attempts early to avoid wasting attempts on repeated errors. GrapheneOS only supports devices implementing the latest generation secure element rate limiting.
The secure element on supported devices also has insider attack resistance, requiring the Owner user to authenticate successfully before the firmware can be updated. A valid signing key and greater version number are not sufficient alone. This prevents any government from bypassing rate limiting by coercing a firmware update to remove it. Pixels have used a secure element with an internal timer for rate limiting and insider attack resistance since the Pixel 2 launched in late 2017.
GrapheneOS raises the character limit for passwords from 16 to 128, enabling the use of high-entropy diceware passphrases without relying on secure element rate limiting. To make strong passphrases convenient without compromising biometric unlock, GrapheneOS adds an optional second factor fingerprint PIN. The allowed fingerprint attempts are reduced from 20 to 5, and failing to enter the correct second factor PIN counts towards it. This allows for the use of 6-8 random diceware words as the main unlock method and a short PIN for fingerprint+PIN convenience.
GrapheneOS significantly improves exploit protections for the OS with hardened memory allocators and other features, heavily utilizing hardware-based security features including hardware memory tagging (MTE) to protect against exploits. It also adds specialized protection against attacks with physical access, such as blocking new USB connections at both software and hardware levels by default when locked and disabling USB data as soon as there are no active USB connections.
GrapheneOS shipped a locked device auto-reboot timer back in June 2021, which can be set between 10 minutes and 72 hours. We enabled it by default using 72 hours and then lowered it to 18 hours. The device automatically returns to Before First Unlock state due to our memory zeroing as part of OS teardown and booting.
Our duress PIN/password feature is a minor feature fitting into the bigger picture. It wipes the device when entered in any OS prompt for the current profile's PIN or password. It works across every profile, including secondary users and Private Spaces, not just the main user. GrapheneOS does not depend on the duress PIN/password to protect data, but it provides a tool among the major privacy and security improvements it offers as a whole.
For more features, see GrapheneOS's features page comparing it with standard Android 17, covering most major and minor features.
Blogger's Review: GrapheneOS continues to innovate in security, particularly enhancing data protection, user authentication, and defenses against physical attacks, setting a new standard for mobile OS security. These improvements not only bolster user privacy but also establish a benchmark for smartphone safety.