Security Guide book

In this book we will try to keep up with the latest security features and best practices.

We have 3 chapters so far, for iOS, Android and GrapheneOS. You can access them from the left sidebar.

iOS 26.4 Security and Privacy Settings Guide

A comprehensive guide to configuring security and privacy settings on iOS 26.4 (the latest version as of March 24, 2026) to protect your personal data and secure your iPhone.

What’s New in iOS 26

iOS 26 (released September 15, 2025) represents Apple’s biggest security and privacy update in years. Apple jumped from iOS 18 to iOS 26 to align version numbers with the year across all operating systems.

Major Security & Privacy Additions in iOS 26

• Wi-Fi Aware – Secure peer-to-peer connections without internet access points
• Post-Quantum Cryptography – Hybrid key exchange protecting against future quantum computing threats
• Expanded Passkey Support – Automatic passkey creation and migration from passwords
• Advanced Tracking Protection for All Browsing – Anti-fingerprinting expanded beyond Private Browsing
• Wired Accessories Security – Explicit permission controls for USB-C/Lightning accessories
• Enhanced Parental Controls – Stronger child account management and content filtering
• Password Version History – Track changes to saved passwords over time
• Secure Password Export – FIDO Alliance standard for moving credentials between managers
• Liquid Glass Design – New translucent interface (including privacy-focused opacity controls)

iOS 26.2 Security Updates (December 2025)

• 26+ security vulnerabilities patched, including two actively exploited WebKit zero-days
• AirDrop security codes – One-time codes for sharing with unknown contacts
• Hidden Photos fix – Addressed vulnerability allowing unauthorized access
• FaceTime caller ID spoofing – Patched to prevent impersonation attacks
• iMessage privacy controls – Improved data handling

iOS 26.2.1 (January 26, 2026)

iOS 26.2.1 is a minor update focused on new hardware support and bug fixes.

New Features:

• AirTag (2nd Generation) support – Required for the new AirTag with:
  • Second-generation Ultra Wideband (UWB) chip for 50% longer Precision Finding range
  • Precision Finding on Apple Watch (Series 9+, Ultra 2+) for the first time
  • 50% louder speaker for easier locating and enhanced anti-stalking measures
  • Expanded Bluetooth range for better Find My network detection
  • Share Item Location with 36+ airlines for lost luggage recovery

Bug Fixes:

• Emergency calling fix for older mobile phones
• Unspecified stability improvements

Security Notes:

• No published CVE entries for iOS 26.2.1 itself
• Users on iOS 26-compatible devices should update to maintain security (older iOS versions only receive certificate updates)

Also Released:

• iOS 18.7.4, iOS 16.7.13, iOS 15.8.6, iOS 12.5.8 – Certificate updates for iMessage, FaceTime, and Apple account sign-in (valid until January 2027)

iOS 26.3 (February 11, 2026)

iOS 26.3 addresses 37 security vulnerabilities including one actively exploited zero-day, adds new privacy controls, and introduces a data transfer tool for users switching to Android.

Security Fixes:

• Actively exploited zero-day (CVE-2026-20700) – A memory corruption flaw in the dyld dynamic link editor that allowed arbitrary code execution. Apple says it “may have been exploited in an extremely sophisticated attack against specific targeted individuals” on versions before iOS 26.
• 3 kernel/privilege escalation flaws – Including CVE-2026-20617 and CVE-2026-20615 (CoreServices race condition and path handling bugs allowing root privileges) and CVE-2026-20626 (kernel root privilege escalation)
• Sandbox escape (CVE-2026-20667) – A logic flaw in libxpc allowing apps to break out of the sandbox
• Remote file write (CVE-2026-20660) – A CFNetwork path handling vulnerability allowing remote attackers to write arbitrary files
• Lock screen photo access (CVE-2026-20642) – A bug in Photos allowing someone with physical access to view photos from the lock screen
• Accessibility data leaks (CVE-2026-20674) – Sensitive user information viewable on a locked device
• Additional fixes in WebKit, ImageIO, CoreAudio, Game Center, Messages, Shortcuts, and StoreKit

New Features:

• Limit Precise Location – Reduces what cellular carriers can infer about your location to neighborhood-level instead of street-level precision. Requires iPhone 16e or iPhone Air (C1/C1X modem). Currently supported by Boost Mobile (US), EE/BT (UK), Telekom (Germany), and AIS/True (Thailand).
• Transfer to Android – A new proximity-based tool for migrating photos, messages, notes, apps, passwords, and phone number to an Android device. Health data and locked notes remain on iPhone.
• Encrypted RCS messaging support – System-level support for encrypted Rich Communication Services messaging is now present in the OS code, pending carrier activation.

EU-Only Features (Digital Markets Act compliance):

• Notification forwarding – Forward iPhone notifications to third-party wearables (not just Apple Watch)
• Proximity pairing – One-tap pairing for third-party headphones and smartwatches, similar to AirPods

iOS 26.3.1 (March 4, 2026)

iOS 26.3.1 is a minor maintenance update released alongside Apple’s March 2026 product announcements. It focuses on new hardware support, performance improvements, and bug fixes.

New Hardware Support:

• iPhone 17e – Full support for the newly announced iPhone 17e
• Studio Display (2026) – Compatibility with the new Studio Display
• Studio Display XDR – Compatibility with the new Studio Display XDR

Improvements:

• Improved app responsiveness and smoother multitasking
• Minor storage optimization compared to iOS 26.3
• Unspecified bug fixes and stability improvements

Security Notes:

• No published CVE entries for iOS 26.3.1 itself
• Users on older iOS versions can update to iOS 18.7.6 for legacy security patches

iOS 26.4 (March 24, 2026)

iOS 26.4 addresses 41 security vulnerabilities across Critical (7), High (17), Medium (15), and Low (2) severity levels, and makes Stolen Device Protection automatically enabled for all users.

Security Fixes:

• Kernel memory corruption (CVE-2026-20698) – Critical memory corruption flaw in the kernel allowing system termination or kernel memory corruption
• Kernel use-after-free (CVE-2026-20687) – Critical use-after-free vulnerability in the kernel with improved memory management
• Printing sandbox escape (CVE-2026-20688) – Critical path handling flaw in the printing subsystem allowing sandbox escape
• Keychain access (CVE-2026-28864) – Critical vulnerability allowing a local attacker to access Keychain items
• Telephony buffer overflow (CVE-2026-28858) – Critical buffer overflow in the telephony stack
• WebKit Same Origin Policy bypass (CVE-2026-20643) – Critical flaw allowing malicious web content to circumvent the Same Origin Policy
• WebKit sandbox escape (CVE-2026-28859) – Critical vulnerability allowing restricted web content to escape the WebKit sandbox
• Stolen Device Protection bypass (CVE-2026-28895) – Physical access vulnerability bypassing Stolen Device Protection
• Siri information disclosure (CVE-2026-28856) – Information disclosure from a locked device via Siri
• Mail privacy bypass (CVE-2026-20692) – Bypass of Mail Privacy Protection settings for IP hiding and remote content blocking
• Additional 31 fixes across Accounts, Audio, Baseband, CoreMedia, Crash Reporter, curl, GeoServices, iCloud, libxpc, 802.1X, and more

Stolen Device Protection — Now Auto-Enabled:

Other Changes:

• Playlist Playground – AI-powered playlist creation from text descriptions in Apple Music
• 8 new emoji – Including orca, trombone, ballet dancer, and landslide
• Offline Music Recognition – Identify songs in Control Center without internet
• CarPlay chatbot support – Third-party AI chatbot integration in CarPlay
• Keyboard typo fix and general stability improvements

1. Device Authentication

Face ID / Touch ID Setup

Biometric authentication provides secure and convenient device access.

How to set up Face ID:

1. Open Settings
2. Tap Face ID & Passcode
3. Enter your passcode
4. Tap Set Up Face ID
5. Follow on-screen instructions to position your face
6. Move your head in a circle to complete the scan

Configure Face ID uses:

• iPhone Unlock
• iTunes & App Store purchases
• Apple Pay
• Password AutoFill
• Other Apps (toggle individually)

Strong Passcode Configuration

How to set a strong passcode:

1. Go to Settings > Face ID & Passcode
2. Tap Change Passcode
3. Tap Passcode Options
4. Select Custom Alphanumeric Code (8-12 random characters recommended)

Two-Factor Authentication (2FA)

How to enable 2FA:

1. Go to Settings > [Your Name] > Sign-In & Security
2. Tap Turn On Two-Factor Authentication
3. Tap Continue
4. Enter a trusted phone number
5. Verify with the code sent to your phone

Auto-Lock Settings

1. Go to Settings > Display & Brightness > Auto-Lock
2. Select a time interval (30 seconds to 5 minutes recommended)

Security Keys for Apple Account

Security keys are small external devices that look like a thumb drive or tag. They provide extra protection for your Apple Account by replacing the standard six-digit verification code with a physical device as the second factor in two-factor authentication. Because they are physical, they help prevent attackers from intercepting or requesting your second factor through phishing.

Requirements:

• At least two FIDO® Certified security keys (e.g., YubiKey 5C NFC, YubiKey 5Ci, or FEITIAN ePass K9 NFC)
• iOS 16.3 or later
• Two-factor authentication already enabled on your Apple Account
• A modern web browser

Compatible connector types:

• NFC — Works with iPhone via tap (contactless)
• USB-C — Works with iPhone 15 or later and most Mac models
• Lightning — Works with iPhone 14 and earlier
• USB-A — Works with older Mac models

How to add security keys:

1. Go to Settings > [Your Name] > Sign-In & Security
2. Tap Two-Factor Authentication
3. Tap Security Keys
4. Tap Add Security Keys
5. Follow the on-screen instructions
6. You can add up to six keys total

What security keys protect:

• Signing in to your Apple Account on a new device or on the web
• Resetting your Apple Account password or unlocking your account
• Adding or removing security keys

2. Stolen Device Protection

Stolen Device Protection adds security when your iPhone is away from familiar locations.

Key Features

Biometric Authentication Required (no passcode fallback):

• Accessing passwords stored in iCloud Keychain
• Using saved payment methods in Safari
• Turning off Lost Mode
• Erasing all content and settings
• Viewing Apple Card virtual card number
• Opening locked and hidden apps

Security Delay (1-hour wait + second biometric scan):

• Changing Apple Account password
• Signing out of Apple Account
• Turning off Stolen Device Protection
• Changing Face ID or Touch ID settings
• Changing device passcode
• Resetting all settings
• Turning off Find My

How to Enable

1. Go to Settings > Face ID & Passcode
2. Enter your passcode
3. Scroll down and tap Stolen Device Protection
4. Toggle on

Note: As of iOS 26.4, Stolen Device Protection is automatically enabled for all users after updating. The steps above are only needed if you previously disabled it.

Configuration Options

• Away from Familiar Locations – Security features activate only when away from home/work
• Always – Security features are always active

Requirements

• iOS 17.3 or later (enhanced in iOS 26, auto-enabled in iOS 26.4)
• Two-factor authentication enabled
• Face ID or Touch ID configured
• Device passcode set
• Find My enabled
• Significant Locations enabled

3. App Privacy Controls

App Tracking Transparency

How to configure:

1. Go to Settings > Privacy & Security > Tracking
2. Toggle Allow Apps to Request to Track off to block all tracking
3. Or manage individual app permissions below

App Privacy Report

View detailed app data access:

1. Go to Settings > Privacy & Security > App Privacy Report
2. Toggle on App Privacy Report
3. Review 7-day history of sensor, camera, microphone, and network access

Clipboard Access Alerts

iOS 26 continues to notify you whenever apps access your clipboard, preventing silent data harvesting.

Review All Permissions

1. Go to Settings > Privacy & Security
2. Review each category: Location, Contacts, Photos, Microphone, Camera, etc.
3. Revoke unnecessary permissions

4. Location Services

Per-App Location Settings

For each app, choose:

• Never – No location access
• Ask Next Time Or When I Share – Prompts each time
• While Using the App – Access only when app is open
• Always – Background access (use sparingly)

Precise vs. Approximate Location

1. Go to Settings > Privacy & Security > Location Services
2. Select an app
3. Toggle Precise Location off for approximate area sharing

Significant Locations

1. Go to Settings > Privacy & Security > Location Services > System Services
2. Tap Significant Locations
3. View, toggle off, or clear history

5. Lock and Hide Apps

How to Lock an App

1. Touch and hold the app icon on Home Screen
2. Tap Require Face ID (or Touch ID/Passcode)
3. Confirm your choice

How to Lock and Hide an App

1. Touch and hold the app icon
2. Select Hide and Require Face ID
3. App moves to Hidden folder in App Library

To access hidden apps:

1. Swipe left to App Library
2. Scroll to bottom, tap Hidden folder
3. Authenticate with Face ID/Touch ID

What Happens When Apps Are Locked

• No notification previews
• Hidden from Spotlight search
• Hidden from Siri suggestions
• Call history from locked apps is hidden

Integration with Stolen Device Protection

When Stolen Device Protection is enabled, locked apps can only be opened with Face ID/Touch ID—passcode fallback is disabled.

6. Safari Privacy Settings

Advanced Tracking and Fingerprinting Protection (NEW in iOS 26)

iOS 26 expands anti-fingerprinting protection to all browsing, not just Private Browsing:

1. Go to Settings > Apps > Safari > Advanced
2. Set Advanced Tracking and Fingerprinting Protection to All Browsing

This normalizes browser data to make your device look generic to tracking scripts, significantly reducing fingerprinting effectiveness.

Private Browsing with Face ID Lock

1. Go to Settings > Apps > Safari
2. Enable Require Face ID to Unlock Private Browsing

Hide IP Address

1. Go to Settings > Apps > Safari > Hide IP Address
2. Choose:
   • Trackers Only – Hides IP from known trackers
   • Trackers and Websites – Hides IP from all sites (requires iCloud+ Private Relay)

Intelligent Tracking Prevention

1. Go to Settings > Apps > Safari
2. Enable Prevent Cross-Site Tracking

Fraudulent Website Warning

1. Go to Settings > Apps > Safari
2. Enable Fraudulent Website Warning

Link Tracking Protection

iOS 26 automatically strips tracking parameters (UTMs) from URLs in Safari Private Browsing, Messages, and Mail.

7. Mail Privacy Protection

Features

• Hides your IP address from senders
• Prevents open tracking
• Blocks invisible tracking pixels

How to Enable

1. Go to Settings > Apps > Mail > Privacy Protection
2. Enable Protect Mail Activity

Or configure separately:

• Hide IP Address
• Block All Remote Content

8. Passwords App

iOS 26 significantly enhances the standalone Passwords app.

New Features in iOS 26

• Password Version History – View previous passwords for any account with timestamps
• Secure Export – FIDO Alliance standard for moving passwords, passkeys, and verification codes to other managers
• Automatic Passkey Upgrades – When you sign in with a password, system can create a passkey for next time
• Credential Management Endpoints – Prompts to upgrade passwords to passkeys
• Websites to Exclude – Manage sites where passwords shouldn’t be saved

How to Access

1. Open the Passwords app
2. Authenticate with Face ID/Touch ID

View Password History

1. Open Passwords
2. Select a saved login
3. Tap View History (appears when multiple versions exist)

Export Passwords Securely

1. Open Passwords
2. Tap Settings (gear icon)
3. Select Export Passwords
4. Choose destination app (uses encrypted FIDO Alliance format)

Security Alerts

The app warns about:

• Credentials in known data breaches
• Weak passwords
• Reused passwords

9. Advanced Data Protection for iCloud

End-to-end encryption for the majority of your iCloud data.

What It Protects (25 categories total)

• iCloud Backup (including Messages)
• iCloud Drive
• Photos
• Notes
• Reminders
• Safari Bookmarks
• Voice Memos
• Freeform boards
• And more…

Cannot be encrypted:

• iCloud Mail, Contacts, Calendars (due to interoperability requirements)

How to Enable

1. Go to Settings > [Your Name] > iCloud
2. Tap Advanced Data Protection
3. Tap Turn On Advanced Data Protection
4. Set up recovery method first:
   • Recovery Contact – Trusted person to help regain access
   • Recovery Key – 28-character code to store securely

10. Lockdown Mode

Who Should Use It

• Journalists, activists, diplomats
• High-profile individuals
• Anyone targeted by mercenary spyware

What Lockdown Mode Does

• Messages: Most attachments blocked
• Web: Complex technologies disabled (JIT JavaScript)
• FaceTime: Incoming calls blocked from unknown contacts
• Photos: Location excluded from shared photos
• Device: Wired connections blocked when locked
• Wireless: 2G cellular disabled, won’t auto-join insecure Wi-Fi

How to Enable

1. Go to Settings > Privacy & Security
2. Scroll down and tap Lockdown Mode
3. Tap Turn On Lockdown Mode
4. Tap Turn On & Restart
5. Enter your passcode

11. Communication Safety & Parental Controls

Enhanced Parental Controls (iOS 26)

iOS 26 significantly strengthens parental controls:

• Child Accounts – Create or move kids into managed accounts easily
• Communication Controls – Decide who children can text/call
• Third-Party App Management – Control messaging in gaming and social apps
• Unknown Number Blocking – Block calls/messages from unknown numbers
• Age Limits – Set strict age limits for app downloads
• Explicit Content Detection – Blurs inappropriate content in shared albums and FaceTime

Communication Safety

Protects children from sensitive content in Messages:

1. Go to Settings > Screen Time
2. Tap Communication Safety
3. Toggle on Communication Safety

Sensitive Content Warning (Adults)

1. Go to Settings > Privacy & Security > Sensitive Content Warning
2. Toggle on to blur sensitive images

12. Safety Check

Quickly review and reset access you’ve granted to others.

How to Access

1. Go to Settings > Privacy & Security
2. Tap Safety Check

Options

Manage Sharing & Access: Granular control over individual permissions

Emergency Reset: Immediately stops all sharing, resets permissions, signs out of iCloud on other devices

Quick Exit: Instantly returns to Home Screen (progress saved)

13. Find My iPhone

How to Enable

1. Go to Settings > [Your Name] > Find My
2. Tap Find My iPhone
3. Enable:
   • Find My iPhone
   • Find My Network (locate even when offline)
   • Send Last Location

Activation Lock for Parts (iOS 26)

iOS 26 extends Activation Lock to individual components (batteries, cameras, displays), making stolen parts unusable.

AirTag (2nd Generation) - iOS 26.2.1 Required

The new AirTag (released January 26, 2026) requires iOS 26.2.1 or later and includes significant security and tracking improvements:

Enhanced Finding Capabilities:

• 50% longer Precision Finding range via second-generation Ultra Wideband chip
• Precision Finding on Apple Watch – Works on Apple Watch Series 9+, Ultra 2+ (first time on wrist)
• Expanded Bluetooth range – Better detection by Find My network devices
• 50% louder speaker – Easier to locate and harder for stalkers to mask

Anti-Stalking Improvements:

• Louder alert sounds when separated from owner’s device
• Improved detection notifications on iPhones
• Same separation alert timing (approximately 8 hours)

Share Item Location:

• Securely share AirTag location with airlines for lost luggage
• 36 airlines supported at launch, 15+ more coming
• End-to-end encrypted sharing

How to Set Up AirTag (2nd Gen):

1. Ensure iOS 26.2.1 is installed
2. Bring AirTag near your iPhone
3. Tap Connect when prompted
4. Name your AirTag and assign an emoji
5. Register to your Apple ID

14. Advertising and Tracking Controls

Disable Advertising Identifier

1. Go to Settings > Privacy & Security > Tracking
2. Toggle off Allow Apps to Request to Track

Disable Apple Personalized Ads

1. Go to Settings > Privacy & Security > Apple Advertising
2. Toggle off Personalized Ads

Analytics & Improvements

1. Go to Settings > Privacy & Security > Analytics & Improvements
2. Toggle off data sharing options

15. Apple Intelligence Privacy

On-Device Processing

Most Apple Intelligence features process data locally on your device.

Private Cloud Compute

For complex requests:

• Uses Apple’s Private Cloud Compute
• Data never stored on servers
• Cryptographically verified privacy

Control AI Learning

1. Go to Settings > Apple Intelligence & Siri
2. Scroll to Apps
3. Toggle off Learn from this App for sensitive apps

16. Wi-Fi Aware & Network Security (NEW in iOS 26)

Wi-Fi Aware

A new peer-to-peer networking framework allowing secure connections without access points:

• Direct encrypted links between devices
• Ideal for file transfers, gaming, media streaming
• No internet connection required
• Third-party apps can use this for secure local sharing

Post-Quantum Cryptography (iOS 26)

iOS 26 adds hybrid post-quantum key exchange to TLS connections:

• Pairs classic elliptic curve math with lattice-based schemes
• Protects current data against future quantum computing threats
• Works automatically with Apple’s networking frameworks

Limit Precise Location (NEW in iOS 26.3)

Reduces the location precision available to your cellular carrier from street-level to neighborhood-level.

How to enable:

1. Go to Settings > Privacy & Security > Location Services > System Services
2. Tap Limit Precise Location
3. Toggle on

Requirements:

• iPhone 16e or iPhone Air (devices with Apple C1/C1X modem)
• Carrier support: Boost Mobile (US), EE/BT (UK), Telekom (Germany), AIS/True (Thailand) at launch

Captive Assist

When you connect to public Wi-Fi by filling out a form, iOS 26 can automatically share that form information with your other Apple devices, making it easier to connect securely.

17. Wired Accessories Security (NEW in iOS 26)

Enhanced USB-C/Lightning Port Security

iOS 26 gives you explicit control over what happens when accessories connect:

How to configure:

1. Go to Settings > Face ID & Passcode
2. Scroll to Accessories
3. Choose behavior:
   • Allow when unlocked (default)
   • Always ask
   • Never allow

Why This Matters

• Malicious cables can extract data while appearing to charge
• Compromised chargers in public places pose real risks
• You now get immediate notification when a cable tries to do more than charge
• Stops “juice jacking” attacks at airports, hotels, and other public charging stations

18. AirDrop Security (NEW in iOS 26.2)

One-Time AirDrop Codes

iOS 26.2 introduces secure codes for sharing with unknown contacts:

How it works:

1. When sharing with someone not in your contacts, generate a temporary code
2. The receiver displays the code on their device
3. Sender enters the code to complete transfer
4. Code is valid for 30 days for that contact

Tighter Proximity Detection

AirDrop now shows only devices within close physical proximity, reducing:

• Accidental transfers
• Unsolicited content (“AirDrop spam”)
• Faster peer-to-peer connections in crowded areas

19. Additional Security Recommendations

Lock Screen Security

Disable Control Center from lock screen:

1. Go to Settings > Face ID & Passcode
2. Under Allow Access When Locked, toggle off:
   • Control Center
   • Notification Center
   • USB Accessories

Automatic Software Updates

1. Go to Settings > General > Software Update
2. Tap Automatic Updates
3. Enable all options including Security Responses & System Files

Lock Screen Notifications

1. Go to Settings > Notifications > Show Previews
2. Select When Unlocked or Never

Liquid Glass Opacity (iOS 26)

For better readability and reduced glare:

1. Go to Settings > Display & Brightness > Liquid Glass
2. Choose Clear (sharper) or Tinted (softer, less glare)

Restart After Security Updates

After installing iOS 26.2 or any security update, restart your device. Some spyware lives only in volatile memory and is cleared by a reboot.

Erase Data After Failed Attempts

1. Go to Settings > Face ID & Passcode
2. Enable Erase Data (erases after 10 failed passcode attempts)

Quick Reference: Essential Settings Checklist

Conclusion

iOS 26.4 represents the latest in Apple’s most comprehensive security and privacy update cycle to date. Key priorities:

1. Update to iOS 26.4 immediately – Patches 41 CVEs including 7 Critical kernel, WebKit, and Keychain vulnerabilities
2. Enable lockdown mode – Prevents sophisticated spyware attacks
3. Stolen Device Protection (auto-enabled in 26.4) – Prevents thieves from accessing data even with your passcode
4. Turn on Advanced Data Protection – End-to-end encrypts your iCloud data
5. Enable Advanced Tracking Protection for All Browsing – Major anti-fingerprinting improvement
6. Configure Wired Accessories security – Protects against malicious charging cables
7. Use Passkeys – Let iOS 26 automatically upgrade your passwords to phishing-resistant passkeys
8. Restart after updates – Clears memory-resident threats

By configuring these settings, you significantly strengthen your privacy and security against both common and sophisticated threats.

Last updated: March 24, 2026 | Applies to iOS 26.4 Device requirements: iPhone 11 or later (A13 Bionic chip minimum) AirTag (2nd Generation) requires iOS 26.2.1 or later Limit Precise Location requires iPhone 16e or iPhone Air

Android 16 Security and Privacy Settings Guide

A comprehensive guide to configuring security and privacy settings on Android 16 to protect your personal data and secure your device.

What’s New in Android 16

Android 16, released in June 2025, represents Google’s most significant security update, featuring a comprehensive “Advanced Protection Mode” that consolidates multiple security features into one easy toggle.

Major Security & Privacy Additions

• Advanced Protection Mode – One-tap activation of all major security features
• Identity Check – Biometric authentication required for sensitive settings when away from trusted locations
• AI-Powered Privacy Controls – Contextual permission management based on usage patterns
• Enhanced Theft Protection – Theft Detection Lock, Offline Device Lock, Inactivity Reboot
• Intrusion Logging – Encrypted activity logs for post-breach analysis (coming in QPR3, March 2026)
• USB Protection – Default charging-only mode when locked
• Improved Scam Detection – Real-time AI-powered scam call and message protection
• Enhanced Factory Reset Protection – Stolen devices become harder to use
• Trade-in Mode – Secure device preparation for resale
• Fixed Approximate Location – Prevents apps from inferring precise location through workarounds
• Local Network Protection – New runtime permission for local network access
• Restore Credentials – Seamless passkey migration to new devices

Device Requirements

• Android 16 stable released June 2025
• Available on Google Pixel and expanding to other manufacturers
• Some features require specific hardware (e.g., motion sensors for Theft Detection Lock)

1. Advanced Protection Mode

Advanced Protection Mode is Android 16’s flagship security feature—a single toggle that activates Google’s strongest device protections.

What It Enables

Device Security:

• Theft Detection Lock (AI-powered theft detection)
• Offline Device Lock (locks when disconnected)
• Inactivity Reboot (restarts after 72 hours locked)
• USB Protection (charging-only when locked)

App Security:

• Google Play Protect (cannot be disabled)
• Blocks installation from unknown sources
• Android Safe Browsing

Network Security:

• Disables 2G connections
• Blocks auto-reconnect to insecure networks
• Forces HTTPS in Chrome

Communication Protection:

• Scam Detection in Phone app
• Spam filtering in Google Messages
• Unsafe link warnings

Coming Soon:

• Intrusion Logging (encrypted activity logs)
• Enhanced app permission controls

How to Enable

1. Open Settings
2. Tap Security & Privacy
3. Tap Advanced Protection
4. Toggle on Device Protection
5. Tap Turn on and then Restart

Who Should Use It

• Journalists, activists, public figures
• Anyone wanting maximum protection
• Users who don’t need to sideload apps

Considerations

• Cannot sideload apps from unknown sources
• JavaScript optimizer disabled in Chrome (may break some websites)
• Some call screening may flag legitimate calls
• Easy to turn on/off, so no harm in trying

Google Advanced Protection Program

The Advanced Protection Program is Google’s strongest account-level security offering, separate from the device-level Advanced Protection Mode above. It is designed for people at high risk of targeted online attacks, such as journalists, activists, political campaign staff, and anyone managing sensitive information.

What it protects:

• Phishing defense — Requires a passkey or FIDO-compliant security key to sign in. Unauthorized users cannot access your account even if they have your password.
• Download safety — Enhanced screening for file downloads; app installations restricted to verified sources like Google Play Store and device manufacturer app stores.
• Third-party access control — Only Google apps and verified third-party apps can access your Google Account data, and only with your permission.

How to enroll:

1. Go to Google Advanced Protection Program
2. Sign in with the Google Account you want to protect
3. Set up a passkey or register a FIDO-compliant security key (e.g., Google Titan Security Key)
4. Follow the enrollment steps

Requirements:

• A passkey or FIDO-compliant security key
• A Google Account with 2-Step Verification enabled

2. Device Authentication

Screen Lock Options

Android 16 supports multiple screen lock methods:

How to configure:

1. Go to Settings > Security & Privacy > Device Unlock > Screen Lock
2. Choose your lock type:
   • PIN – 6+ digits recommended
   • Password – Most secure (alphanumeric)
   • Pattern – Less secure, avoid simple patterns
   • Fingerprint – Convenient biometric
   • Face Unlock – Available on supported devices

Best Practice: Use a PIN with 6+ digits or an alphanumeric password. Add fingerprint for convenience.

Two-Factor Authentication (2FA) for Google Account

How to enable:

1. Go to Settings > Google > Manage your Google Account
2. Tap Security
3. Under “How you sign in to Google,” tap 2-Step Verification
4. Follow setup instructions
5. Add multiple verification methods (authenticator app, backup codes, security key)

Biometric Settings

1. Go to Settings > Security & Privacy > Device Unlock > Fingerprint (or Face Unlock)
2. Add your biometrics
3. Configure what biometrics can unlock (device, apps, payments)

Security Keys for Google Account

Security keys are physical devices that serve as a second authentication factor for your Google Account. They replace SMS or authenticator app codes with a physical device you must have present, making phishing attacks ineffective.

Requirements:

• A FIDO2-compliant security key (e.g., Google Titan Security Key, YubiKey 5 series)
• Google Account with 2-Step Verification enabled

Compatible connector types:

• NFC — Tap the key against the back of your Android phone
• USB-C — Plug directly into your phone or computer
• USB-A — For computers with USB-A ports
• Bluetooth — Google Titan Security Key supports BLE pairing

How to add a security key:

1. Go to Settings > Google > Manage your Google Account
2. Tap Security
3. Under “How you sign in to Google,” tap 2-Step Verification
4. Tap Security key
5. Follow the on-screen instructions to register your key

What security keys protect:

• Signing in to your Google Account on a new device or browser
• Accessing sensitive account settings
• Signing in to apps and services that use Google authentication

Using your security key on Android:

• NFC keys: When prompted, tap the key against the back of your phone
• USB keys: Plug the key into your phone’s USB-C port when prompted
• Bluetooth keys: Pair once, then press the button on the key when prompted

3. Identity Check

Identity Check requires biometric authentication for sensitive actions when you’re away from trusted locations—similar to iOS’s Stolen Device Protection.

What It Protects

When outside trusted locations, biometric authentication is required for:

• Changing device PIN or password
• Changing biometric settings
• Disabling theft protection
• Accessing passkeys
• Factory resetting the device
• Changing Google Account settings

How to Enable

1. Go to Settings > Security & Privacy > Device Unlock > Theft Protection
2. Tap Identity Check
3. Follow setup instructions
4. Add trusted locations (home, work)

Requirements

• Android 16 on supported devices (Pixel, Samsung One UI 7, others)
• Screen lock and biometrics enabled
• Location services enabled

Best Practice

• Only add truly trusted private locations
• Never add public places as trusted locations

4. Theft Protection

Android 16 consolidates multiple theft protection features.

Theft Detection Lock

Uses AI and device sensors to detect if someone snatches your phone and runs.

How to enable:

1. Go to Settings > Google > All services > Theft Protection
2. Toggle on Theft Detection Lock

How it works:

• Monitors motion sensors, Wi-Fi, and Bluetooth
• Automatically locks screen if theft is detected
• Won’t trigger during stable connections

Offline Device Lock

Automatically locks your device if it goes offline (thief turns off internet).

How to enable:

1. Go to Settings > Google > All services > Theft Protection
2. Toggle on Offline Device Lock

Failed Authentication Lock

Locks device after repeated failed unlock attempts.

How to enable:

1. Go to Settings > Google > All services > Theft Protection
2. Toggle on Failed Authentication Lock (may be on by default)

Inactivity Reboot

Automatically restarts device after 72 hours of being locked, making data unreadable until fresh unlock.

Enabled automatically with Advanced Protection

Remote Lock

Lock your device remotely via Find My Device with security challenge question.

Factory Reset Protection

Enhanced in Android 16 to restrict all functions on devices reset without authorization.

5. App Permissions

Permission Manager

Review and control what data apps can access:

1. Go to Settings > Security & Privacy > Privacy Controls > Permission Manager
2. Review each category:
   • Location
   • Camera
   • Microphone
   • Contacts
   • Files and media
   • Calendar
   • Phone
   • SMS
   • Body sensors / Health
   • Nearby devices

Permission Options

For each app, you can choose:

• Allow all the time – Background access (use sparingly)
• Allow only while using the app – Access only when app is open
• Ask every time – Prompts each use
• Don’t allow – No access

One-Time Permissions

For camera, microphone, and location, you can grant one-time access that revokes when you close the app.

Auto-Reset Unused App Permissions

Android automatically resets permissions for apps you haven’t used in a while.

1. Go to Settings > Apps > [App name] > Permissions
2. Ensure Pause app activity if unused is enabled

AI-Powered Permission Controls (Android 16)

Android 16 introduces contextual permission management:

• System evaluates if permission requests match your usage patterns
• Unusual requests (e.g., location at midnight) may trigger additional confirmation
• Detailed permission logs explain automated decisions

Local Network Protection (New in Android 16)

Apps now need explicit permission to access your local network (smart home devices, etc.):

1. Go to Settings > Security & Privacy > Privacy Controls > Permission Manager
2. Review Nearby devices and Local network permissions

6. Location Services

Global Location Settings

1. Go to Settings > Location
2. Toggle Use location on or off

Per-App Location Permissions

1. Go to Settings > Location > App location permissions
2. For each app, choose:
   • Allowed all the time
   • Allowed only while using
   • Ask every time
   • Not allowed

Precise vs. Approximate Location

Android 16 fixes a flaw that allowed apps to infer precise location even with approximate permission.

How to configure:

1. Go to Settings > Location > App location permissions > [App]
2. Toggle Use precise location off for apps that don’t need exact coordinates

Location History

1. Go to Settings > Google > Manage your Google Account > Data & privacy
2. Under “History settings,” review Location History
3. Turn off or set auto-delete (3 months, 18 months, 36 months)

7. Private Space

Private Space lets you hide and secure sensitive apps behind a separate authentication.

Features

• Hidden apps in a separate space
• Separate Google account for private apps
• Requires PIN/biometric to access
• Apps don’t appear in app drawer, search, or notifications

How to Set Up

1. Go to Settings > Security & Privacy > Private Space
2. Follow setup instructions
3. Create or sign into a Google account for Private Space
4. Set up lock (PIN, pattern, or password)

Adding Apps to Private Space

1. Open Private Space (swipe up and scroll to bottom of app list)
2. Tap Install apps
3. Install or move apps to Private Space

Best Practice

Use Private Space for:

• Banking and financial apps
• Personal health apps
• Sensitive documents
• Apps you want to keep private

8. Google Play Protect

Play Protect scans your device for harmful apps.

Features

• Automatic app scanning
• Real-time threat protection
• Identifies harmful apps and malware
• Cannot be disabled when Advanced Protection is on

How to Check Status

1. Open Google Play Store
2. Tap your profile icon
3. Tap Play Protect
4. Tap Scan to run manual scan

Settings

1. In Play Protect, tap Settings (gear icon)
2. Ensure Scan apps with Play Protect is on
3. Enable Improve harmful app detection to send unknown apps to Google

Live Threat Protection (Android 16)

Enhanced scanning detects apps that:

• Change their icon to hide
• Attempt to evade detection
• Show malicious behavior

Available on Pixel 6+ and newer devices from other manufacturers.

9. Google Password Manager & Passkeys

Google Password Manager

Built-in password manager that syncs across devices.

How to access:

1. Go to Settings
2. Search for Password Manager
3. Or open the Passwords app

Features:

• Save and autofill passwords
• Generate strong passwords
• Password checkup (finds weak, reused, compromised passwords)
• Syncs to Google Account

Passkeys

Passkeys are phishing-resistant replacements for passwords.

Benefits:

• More secure than passwords
• Cannot be phished
• Synced across devices via Google Password Manager
• Authenticate with fingerprint, face, or PIN

How to use passkeys:

1. When a site/app supports passkeys, you’ll be prompted to create one
2. Confirm with your screen lock (fingerprint, face, PIN)
3. Passkey is saved to Google Password Manager
4. Sign in using your device’s biometric/PIN

Automatic Passkey Creation (Android 16):

• When you sign in with a password, Android can automatically create a passkey for future use

Restore Credentials (Android 16):

• When setting up a new device, passkeys and app credentials transfer automatically

Settings

1. Go to Settings > Passwords, passkeys & accounts
2. Configure your password manager
3. Enable Offer to save passwords
4. Enable Automatically create a passkey to sign in faster

10. Scam & Spam Protection

In-Call Protection (Android 16)

Blocks dangerous actions during calls with non-contacts:

• Cannot sideload apps for the first time
• Cannot disable Google Play Protect
• Cannot grant accessibility permissions
• Screen-sharing reminder when call ends

Scam Detection in Phone App

AI-powered real-time scam detection warns you during suspicious calls.

Types detected:

• Package delivery scams
• Job-seeking scams
• Toll road and billing scams
• Crypto scams
• Financial impersonation
• Gift card and prize scams
• Tech support scams

How to enable:

1. Open Phone app
2. Tap More (⋮) > Settings > Caller ID & spam
3. Enable See caller and spam ID
4. Enable Filter spam calls

Scam Detection in Messages

Detects suspicious conversation patterns and unsafe links.

How to enable:

1. Open Messages app
2. Tap More (⋮) > Settings > Spam protection
3. Enable Enable spam protection

OTP Protection (Android 16)

One-time passwords won’t show on lock screen for devices that:

• Haven’t been recently unlocked
• Aren’t connected to known Wi-Fi

11. Network Security

Disable 2G

2G networks are vulnerable to interception and cell site simulators.

How to disable (if not using Advanced Protection):

1. Go to Settings > Network & internet > SIMs > [Your SIM]
2. Toggle off Allow 2G

Wi-Fi Security

Disable auto-join for insecure networks:

1. Go to Settings > Network & internet > Internet
2. Tap Network preferences
3. Disable Connect to open networks

Forget insecure networks:

1. Go to Settings > Network & internet > Internet > Saved networks
2. Remove networks you don’t trust

VPN

Use a VPN on public Wi-Fi:

1. Go to Settings > Network & internet > VPN
2. Configure your VPN provider

DNS Settings

Use encrypted DNS:

1. Go to Settings > Network & internet > Private DNS
2. Select Private DNS provider hostname
3. Enter a provider (e.g., dns.google or cloudflare-dns.com)

12. USB Protection

Android 16 defaults USB connections to charging-only when locked.

Features

• Prevents data transfer via USB when device is locked
• Protects against “juice jacking” attacks at public charging stations
• Blocks physical data extraction attempts

How It Works

When Advanced Protection is enabled:

• USB defaults to charging-only when locked
• Must unlock device to enable data transfer

Manual Configuration

1. Go to Settings > Connected devices > USB
2. When connected, choose Charging only unless you need data transfer

13. Find My Device

How to Enable

1. Go to Settings > Security & Privacy > Find My Device
2. Toggle on Use Find My Device
3. Ensure location is enabled

Features

• Locate your device on a map
• Play sound to find nearby device
• Secure device (lock with message)
• Erase device remotely
• Locate offline devices using nearby Android devices

Find My Device Network

Android can find your device even when offline using Bluetooth signals from nearby Android devices.

1. Go to Settings > Google > All services > Find My Device
2. Toggle on Find your offline devices

Using Find My Device

1. Go to android.com/find or use Find My Device app on another device
2. Sign in with your Google Account
3. Select your device
4. Choose action: Locate, Play Sound, Secure Device, Erase Device

14. Advertising & Tracking Controls

Delete Advertising ID

Disabling AAID makes it harder for advertisers to track you.

How to delete:

1. Go to Settings > Security & Privacy > Privacy Controls > Ads
2. Tap Delete advertising ID
3. Confirm

Disable Personalized Ads

1. Go to Settings > Google > Ads
2. Toggle off Opt out of Ads Personalization

Unknown Tracker Alerts

Android detects unfamiliar tracking devices (like AirTags) moving with you.

How to check:

1. Go to Settings > Security & Privacy > More security & privacy > Unknown tracker alerts
2. Ensure it’s enabled

15. Google Account Privacy

Privacy Checkup

1. Go to Settings > Google > Manage your Google Account
2. Tap Data & privacy
3. Tap Review your privacy settings

Activity Controls

Control what Google saves about your activity:

1. Go to Settings > Google > Manage your Google Account > Data & privacy
2. Under “History settings,” review:
   • Web & App Activity – Search and app activity
   • Location History – Places you’ve been
   • YouTube History – Videos watched

For each:

• Turn off to stop saving
• Enable auto-delete (3, 18, or 36 months)

Privacy Dashboard

View recent permission usage:

1. Go to Settings > Security & Privacy > Privacy Controls > Privacy dashboard
2. See which apps accessed location, camera, microphone in last 24 hours

16. Chrome & Browser Privacy

Safe Browsing

Enable Enhanced Protection:

1. Open Chrome
2. Tap More (⋮) > Settings > Privacy and security > Safe Browsing
3. Select Enhanced protection

Privacy Settings

1. Open Chrome > Settings > Privacy and security
2. Configure:
   • Clear browsing data – Regularly clear history, cookies, cache
   • Always use secure connections – Forces HTTPS
   • Do Not Track – Send request to sites (limited effectiveness)
   • Preload pages – Disable for more privacy

Incognito Mode

For private browsing:

1. Open Chrome
2. Tap More (⋮) > New Incognito tab

Third-Party Cookies

1. Go to Chrome > Settings > Site settings > Cookies
2. Select Block third-party cookies

17. Additional Security Recommendations

Software Updates

1. Go to Settings > System > Software update
2. Enable automatic updates
3. Install security patches promptly

Lock Screen Notifications

1. Go to Settings > Notifications > Notifications on lock screen
2. Choose Show sensitive content only when unlocked or Don’t show any notifications

App Installation from Unknown Sources

1. Go to Settings > Apps > Special app access > Install unknown apps
2. Ensure all apps show Not allowed
3. Only enable temporarily when needed, then disable

Backup Encryption

1. Go to Settings > Google > Backup
2. Ensure Backup by Google One is on
3. Backups are encrypted with your screen lock

SIM Lock

1. Go to Settings > Security & Privacy > More security & privacy > SIM lock
2. Toggle on Lock SIM
3. Set a PIN (different from screen lock)

Repair Mode (Android 16)

Securely prepare device for repair without exposing data:

1. Go to Settings > System > Repair Mode
2. Follow instructions to wipe data while allowing hardware diagnostics

Trade-in Mode (Android 16)

Safely prepare device for resale:

1. Go to Settings > System > Trade-in Mode
2. Allows buyer to test hardware without accessing personal data

Quick Reference: Essential Settings Checklist

Conclusion

Android 16 represents Google’s most comprehensive security update, with Advanced Protection Mode making it easy to enable maximum security with one toggle. Key priorities:

1. Enable Advanced Protection Mode – Activates all major security features at once
2. Set up Identity Check – Protects sensitive settings when away from trusted locations
3. Enable Theft Protection features – Theft Detection Lock, Offline Device Lock, Remote Lock
4. Use Passkeys – More secure than passwords, phishing-resistant
5. Review app permissions regularly – Revoke unnecessary access
6. Delete your Advertising ID – Reduces tracking
7. Keep software updated – Security patches are critical

By configuring these settings, you significantly strengthen your privacy and security against both common threats and sophisticated attacks.

Last updated: January 2026 | Applies to Android 16 Note: Settings may vary slightly by device manufacturer (Pixel, Samsung, etc.)

GrapheneOS Security & Privacy Settings Guide

Latest Stable Release: 2026012100 (January 21, 2026)

Latest Beta/Alpha Release: 2026012800 (January 28, 2026)

Based on Android 16 QPR2

Current Version Information:

• Stable Release: 2026012100 (January 21, 2026)
• Beta/Alpha Release: 2026012800 (January 28, 2026)
• Security Preview: 2026012801 (includes patches through June 2026 ASB)
• Android Base: Android 16 QPR2 (BP4A.251205.006)
• Kernel Versions: 6.1.161 (GKI LTS), 6.6 LTS, 6.12.67 LTS
• Vanadium Browser: 144.0.7559.109.0

1. Overview

GrapheneOS is a privacy and security-focused mobile operating system based on the Android Open Source Project (AOSP). It is designed for users who require the highest level of mobile security, including journalists, activists, security researchers, and privacy-conscious individuals. Notably, Edward Snowden has publicly endorsed GrapheneOS as his mobile OS of choice.

What’s New in 2025-2026

Latest Beta Release (2026012800 - January 28, 2026):

• FusedLocationProvider: Restored pre-16-QPR1 GNSS usage policy (uses GNSS for both balanced and high power requests)
• Sandboxed Google Play: Added special case for SMS permission to enable SMS-based authentication for apps using Google Play services
• Sandboxed Google Play: Prevented Play Store from attempting to install unnecessary “Device configuration” package
• Improved secure app spawning compatibility with anti-tampering checks in certain apps
• Settings: Now requires device restart after changing secure app spawning setting
• Network Location: Renamed “GrapheneOS proxy” to “GrapheneOS Apple proxy” for clarity
• Network Location: Added “Apple China” server choice for China data compliance
• Pixel 8a, 9th/10th gen: Disabled NTP usage in Samsung gnssd
• Improved UI for Network/Sensors permissions in permission manager
• Fixed Material 3 Expressive styling for Contact/Storage Scopes UI
• Kernel 6.12 updated to 6.12.67
• Vanadium updated to 144.0.7559.109.0

Current Stable Release (2026012100 - January 21, 2026):

• Fixed upstream infinite loop bug in ProtoFieldFilter.skipBytes() causing system unusability in early boot
• libpng: Backported security patches
• Removed unused INTERNET permission from Pixel Camera Services
• Kernel 6.1 updated to 6.1.161, Kernel 6.12 updated to 6.12.66
• Vanadium updated through version 144.0.7559.90.0

Security Preview Release (2026012801):

• Includes patches through June 2026 Android Security Bulletin
• 8 Critical CVEs patched (CVE-2026-0039 through CVE-2026-0049)
• 38+ High-severity CVEs patched ahead of public disclosure
• Enable via Settings > System > System update > Receive security preview releases

Recent Major Features:

• Android 16 QPR2 base - Latest security patches and features
• Security Preview Releases - Get security patches months ahead of public disclosure
• Pixel 10 support - Full support for Pixel 10 family (no longer experimental as of January 2026)
• Private Space integration - Android 15+ feature fully supported as replacement for work profiles
• Enhanced memory tagging - Expanded MTE support for hardware-level memory safety
• Post-quantum cryptography - Hybrid key exchange in Vanadium browser
• Improved VPN leak protection - Comprehensive protection against all forms of VPN bypasses
• OEM partnership announced - Non-Pixel devices expected Q4 2026 or Q1 2027
• Lockscreen widget support - Enabled in December 2025 release

Key Differentiators from Stock Android

2. Supported Devices

GrapheneOS exclusively supports Google Pixel devices due to their hardware security features, including the Titan M2 security chip and hardware-backed attestation.

Currently Supported (Full Support)

Device Requirements

• OEM-unlockable bootloader - Carrier-locked devices (e.g., Verizon) are NOT supported
• Titan M/M2 security chip - Required for hardware-based security features
• Google hardware - Only official Pixel devices meet security requirements

Future Support

GrapheneOS announced in October 2025 a partnership with a “major Android OEM” to support Snapdragon-powered flagship devices, expected Q4 2026 or Q1 2027.

3. Installation

Prerequisites

• Unlocked Pixel device (not carrier-locked)
• Computer with Chrome/Chromium browser (for web installer)
• USB cable

Web Installer (Recommended)

1. Go to https://grapheneos.org/install/web
2. Connect your Pixel via USB
3. Follow on-screen instructions to:
   • Enable OEM unlocking in Developer Options
   • Unlock the bootloader
   • Flash GrapheneOS
   • Lock the bootloader (critical for security)

Important Notes

• Always lock the bootloader after installation - An unlocked bootloader defeats security
• Installation takes approximately 10-15 minutes
• All data will be erased during installation
• The web installer prevents bricking - it’s very safe

4. Initial Setup

Setup Wizard Security Features

GrapheneOS’s Setup Wizard includes enhanced security checks:

1. Bootloader Warning - Alerts if bootloader is unlocked with option to reboot to fastboot
2. OEM Unlocking Auto-Disable - Disables OEM unlocking at end of setup (toggle to opt-out)

Recommended Initial Configuration

After completing basic setup:

1. Set a strong lock method

   • Settings > Security & privacy > Device unlock > Screen lock
   • Use a strong password (16+ characters) or secure PIN (6+ digits)
   • Consider enabling Scramble PIN input layout

2. Configure fingerprint with 2FA PIN (optional)

   • Adds requirement to enter short PIN after fingerprint
   • Provides strong passphrase security with fingerprint convenience

3. Enable Duress PIN/Password

   • Settings > Security & privacy > Device unlock > Duress Password
   • Set BOTH a duress PIN and password
   • This will wipe the device instantly when entered

4. Review exploit protection defaults

   • Settings > Security & privacy > Exploit protection
   • Default settings are secure; customize as needed

5. Device Unlock & Authentication

Screen Lock Options

Location: Settings > Security & privacy > Device unlock > Screen lock

PIN Scrambling

Location: Settings > Security & privacy > Device unlock > Scramble PIN input layout

• Randomizes keypad layout each time
• Prevents shoulder-surfing and smudge attacks
• Recommended: Enable

Two-Factor Fingerprint Unlock

Location: Settings > Security & privacy > Device unlock

When enabled:

1. Authenticate with fingerprint
2. Then enter a short PIN to complete unlock

Benefits:

• Use a strong passphrase as primary unlock
• Convenience of fingerprint + short PIN for daily use
• Failed PIN attempts count toward lockout limit

Duress PIN/Password

Location: Settings > Security & privacy > Device unlock > Duress Password

• Both a duress PIN and password are required
• When entered anywhere credentials are requested (lockscreen, settings prompts):
  • Device is immediately and irreversibly wiped
  • All installed eSIMs are wiped
  • Wipe cannot be interrupted
  • Device is NOT bricked - can reinstall GrapheneOS

Critical Rules:

• If duress PIN equals your real PIN, the real PIN takes precedence (no wipe)
• Check local laws regarding evidence destruction before using
• Do NOT use simple sequences like 1234 that others might guess

Fingerprint Security Improvements

GrapheneOS limits fingerprint attempts to 5 total (vs 20 on stock Android with delays):

• Makes intentional lockout easy (use wrong finger 5 times)
• Significantly reduces brute-force risk

6. Exploit Protection

Location: Settings > Security & privacy > Exploit protection

GrapheneOS includes extensive hardening against memory corruption and other exploits.

Auto Reboot

Purpose: Returns device to “at rest” state, clearing encryption keys from memory

Recommendation: Set to 8-12 hours for higher security, or keep default 18 hours

How it works:

• Timer starts when device locks
• Unlocking any profile resets timer
• After timeout, device reboots to Before First Unlock (BFU) state
• All encryption keys cleared, data fully at rest

USB-C Port

See Section 12 for detailed configuration.

Wi-Fi Auto-Off

Purpose: Disables Wi-Fi after disconnect to reduce attack surface

• Options: 10 minutes, 30 minutes, 1 hour, 2 hours, Off
• Recommendation: 10 minutes

Bluetooth Auto-Off

Purpose: Disables Bluetooth after disconnect to reduce attack surface

• Options: Same as Wi-Fi
• Recommendation: 10 minutes

Secure App Spawning

Purpose: Each app gets unique randomized memory layout (ASLR secrets)

• Default: Enabled
• Effect: Prevents cross-app identifier leaks, hardens exploit mitigations
• Trade-off: Slightly slower cold app starts, slightly higher memory
• Recommendation: Keep enabled

Native Code Debugging

Purpose: Controls ptrace access for debugging

• Bundled apps: Always blocked
• User apps: Allowed by default (for compatibility)
• Recommendation: Disable for all apps unless needed for development

Dynamic Code Loading Toggles

Control JIT compilation and dynamic code loading:

Recommendation: Disable all for apps that don’t need them

7. Network Permission

Location: App info > Permissions > Network (per-app)

GrapheneOS adds a Network permission not available in stock Android.

How It Works

• When disabled, app sees network as “down” (not permission denied)
• Blocks both direct network access and localhost (prevents cross-profile communication)
• Apps handle gracefully since they think network is unavailable

Configuration

1. During app installation, toggle Network off if not needed
2. Or go to Settings > Apps > [App] > Permissions > Network

Use Cases

• Calculator apps: Don’t need network
• Offline games: Don’t need network
• Document editors: May not need network
• Privacy-sensitive apps: Prevent data exfiltration

8. Sensors Permission

Location: Settings > Apps > [App] > Permissions > Sensors

GrapheneOS adds a Sensors permission for:

• Accelerometer
• Gyroscope
• Compass/magnetometer
• Barometer
• Thermometer
• Other device sensors

How It Works

• When denied, apps receive zeroed sensor data
• Notification appears when app tries to access blocked sensors
• Does NOT affect Camera, Microphone, or Body Sensors (separate permissions)

Global Default

Location: Settings > Security & privacy > More security & privacy

Toggle: Deny Sensors permission by default for newly installed apps

Recommendation: Enable, then grant to apps that need it

9. Storage Scopes

Location: Settings > Apps > [App] > Permissions > Storage Scopes

A privacy-preserving alternative to granting full storage access.

How It Works

1. Instead of granting storage permission, enable Storage Scopes
2. App believes it has full storage access
3. App can only see files it created
4. Optionally add specific files/folders as “scopes” for app to access

Configuration

1. Go to app’s permissions
2. Instead of granting Files/Media, enable Storage Scopes
3. Add specific files/folders if app needs access to existing files

Limitations

• If app is uninstalled and reinstalled, it loses access to its previously created files
• Workaround: Grant access via SAF (Storage Access Framework) picker

Use Cases

• Photo editors: Give access only to specific folders
• Music players: Access only your music directory
• Document apps: Access only Documents folder

10. Contact Scopes

Location: Settings > Apps > [App] > Permissions > Contact Scopes

Alternative to granting full contacts access.

How It Works

1. Enable Contact Scopes instead of granting Contacts permission
2. App believes it has contacts access
3. By default, app sees empty contact list
4. Selectively add specific contacts or groups

Configuration

1. Go to app’s permissions
2. Enable Contact Scopes (don’t grant Contacts permission)
3. Add specific contacts the app should see

Use Cases

• Messaging apps: Share only contacts you message
• Social apps: Share only relevant contacts
• Business apps: Share only work contacts

11. User Profiles & Private Space

GrapheneOS significantly enhances Android’s profile system.

User Profiles

Location: Settings > System > Multiple users

GrapheneOS supports 32 profiles (vs 4 on stock Android).

Key Features:

• Each profile has completely separate apps, data, encryption keys
• Apps cannot communicate across profiles
• Separate VPN configurations per profile

Creating a Profile

1. Settings > System > Multiple users
2. Tap “Add user”
3. Configure profile name and settings

End Session

Completely shuts down a profile:

• Removes encryption keys from memory
• Stops all background processes
• Returns profile to “at rest” state

Private Space (Android 15+)

Location: Settings > Security & privacy > Private Space

An isolated workspace nested inside any user profile.

Advantages over Work Profile:

• Better OS integration
• Stronger isolation
• Lockable with separate authentication
• Hidden from app drawer when locked

Setup

1. Settings > Security & privacy > Private Space
2. Enter current PIN/password
3. Configure Private Space authentication

Key Behaviors

• When locked: Apps don’t run, no notifications
• Separate VPN configuration possible
• Apps show shield icon in launcher
• Can install apps directly or via Google Play (if installed in Private Space)

Recommendation: Use Private Space instead of work profiles managed by third-party apps

Notification Forwarding

Location: Within each profile’s settings

Forward notifications from background profiles to active profile:

• Disabled by default
• Enable per-profile where needed

12. USB-C Port & Pogo Pins Control

Location: Settings > Security & privacy > Exploit protection > USB-C port

Modes

How It Differs from Stock Android

Recommendation

• Default (Charging-only when locked) - Good for most users
• Charging-only - If you never use USB data
• Off - Maximum security, charge only when powered off

13. Wi-Fi & Bluetooth Privacy

Wi-Fi MAC Randomization

Location: Settings > Network & internet > Wi-Fi > [Network] > Privacy

GrapheneOS uses per-connection MAC randomization by default:

• New random MAC for each connection (not just per-network)
• DHCP state flushed before reconnecting
• Significantly harder to track across reconnections

Wi-Fi Auto-Off

Location: Settings > Security & privacy > Exploit protection

• Automatically disables Wi-Fi after disconnection
• Reduces attack surface when not actively using Wi-Fi

Bluetooth Privacy

• Set device name to something generic: Settings > Bluetooth > Device name
• Recommendation: Set to “Device” or similar
• Enable Bluetooth auto-off in Exploit protection

Scanning Settings

Location: Settings > Location > Location services

These allow location tracking even when Wi-Fi/Bluetooth are “off.”

14. VPN Configuration

Always-On VPN

Location: Settings > Network & internet > VPN > [Your VPN] > gear icon

GrapheneOS enables these toggles by default:

• Always-on VPN
• Block connections without VPN

Improved Leak Protection

GrapheneOS fixes multiple VPN leak vectors:

Per-Profile VPN

Each profile (user profile, Private Space) has independent VPN configuration:

• Can use different VPNs
• Can have different exit IPs/countries
• Complete isolation

Private DNS

Location: Settings > Network & internet > Private DNS

Recommendation: Use a privacy-respecting DNS provider:

• dns.quad9.net (Quad9)
• Custom NextDNS configuration
• Or your VPN’s DNS

Internet Connectivity Checks

Location: Settings > Network & internet > Internet connectivity checks

Options:

• GrapheneOS server (default) - Privacy-preserving
• Standard (Google) - For blending in
• Off - May cause issues with captive portals

15. Sandboxed Google Play

GrapheneOS allows running Google Play as a regular sandboxed app with no special privileges.

Key Properties

• Google Play runs as normal app - no system-level access
• Cannot access device identifiers (IMEI, etc.)
• All permissions revocable
• Only available within the profile where installed
• Location requests rerouted to GrapheneOS implementation by default

Installation

1. Open Apps (GrapheneOS app store)
2. Select Google Play services
3. Install (automatically includes Play Store)
4. Grant battery optimization exception for push notifications

Configuration

Location: Settings > Apps > Sandboxed Google Play

Profile Strategy

Option 1: Owner profile - Simplest, all apps can use Play services

Option 2: Separate profile - Install Play in secondary profile for isolation:

1. Create secondary user
2. Install sandboxed Google Play there
3. Install apps needing Play services there
4. Keep main profile Google-free

What Works

• App installations and updates
• In-app purchases
• Push notifications (with battery exception)
• Play Games services
• Play Asset/Feature Delivery
• Most apps requiring Play services

Revoking Permissions

You can revoke ANY permission from Google Play services:

• Location, Contacts, Camera, etc.
• May break specific functionality but app won’t crash

16. GrapheneOS Apps

GrapheneOS includes privacy and security-focused alternatives to standard apps.

Apps (App Store)

The GrapheneOS app repository:

• Updates GrapheneOS apps
• Provides sandboxed Google Play installation
• Will distribute hardened open-source apps in future

Vanadium Browser

Hardened Chromium-based browser with:

Security Features:

• Hardware memory tagging (MTE)
• Type-based Control Flow Integrity (CFI)
• JavaScript JIT disabled by default (per-site toggle)
• Dynamic code execution blocked for non-JIT processes
• Strict site isolation

Privacy Features:

• Built-in ad/tracker blocking (EasyList + EasyPrivacy)
• Third-party cookies disabled by default
• Enhanced state partitioning
• Reduced user agent / client hints
• DuckDuckGo default search

Configuration:

• JIT: Disabled by default, enable per-site via address bar menu
• Content filtering: Enabled by default, toggle per-site

Auditor

Hardware-based attestation app:

Purpose:

• Verify device authenticity and integrity
• Detect bootloader unlocking or OS tampering
• Monitor for security regressions

Setup:

1. Use another device as “Auditor”
2. On device to verify, open Auditor > Auditee
3. Scan QR code with Auditor device
4. Optionally set up remote attestation at attestation.app

Secure Camera

Privacy-focused camera app:

• EXIF metadata stripped by default
• Location tagging disabled by default
• No unnecessary permissions
• Open source

Secure PDF Viewer

Sandboxed PDF viewer:

• Isolated rendering
• Protection against malicious PDFs
• Pinch to zoom, text selection
• Encrypted PDF support

17. Backup & Encryption

Seedvault Encrypted Backup

Location: Settings > System > Backup

GrapheneOS includes Seedvault for encrypted backups.

Features:

• End-to-end encryption
• Local backup support
• Cloud storage support (any provider with storage app)

Setup:

1. Settings > System > Backup
2. Choose backup location
3. Set encryption password
4. Select apps to back up

Full-Disk Encryption

GrapheneOS uses Android’s file-based encryption with enhancements:

• 32-byte file name padding (vs 16 bytes)
• Per-profile encryption keys
• Hardware-backed key storage (Titan M2)

Data at Rest

Before First Unlock (BFU):

• Most data encrypted and inaccessible
• Only critical functions available

After First Unlock (AFU):

• Credential-encrypted data accessible
• Auto-reboot returns device to BFU state

18. System Updates

Automatic Updates

Location: Settings > System > System update

GrapheneOS provides seamless automatic updates:

• Downloads in background
• Installs without interrupting usage
• Automatic rollback if update fails
• A/B partition system for safety

Security Preview Releases

Location: Settings > System > System update > Receive security preview releases

Benefits:

• Get security patches months before public disclosure
• Currently includes patches through June 2026 ASB
• Same stability as regular releases

How It Works:

• GrapheneOS participates in Android security embargo
• Can ship patches before disclosure (unlike stock OS)
• Preview releases increment build number by 1

Recommendation: Enable for maximum security

Update Frequency

• Regular releases: Within days of Android security bulletin
• Preview releases: Months ahead of disclosure
• Feature updates: As developed

19. Advanced Settings

Connectivity Checks

Location: Settings > Network & internet > Internet connectivity checks

Controls which server verifies internet connectivity:

• GrapheneOS (default, private)
• Standard Android (Google, for blending in)
• Disabled

Attestation Provisioning

Location: Settings > Security & privacy > More security & privacy

Controls attestation key provisioning:

• GrapheneOS proxy (default, private)
• Direct (Google)

GNSS / Location

Network Location:

• GrapheneOS provides opt-in network location
• Uses proxy to Apple’s service (or direct)
• Building own database for future offline support

SUPL (Assisted GPS):

• Proxied through GrapheneOS by default
• Can switch to carrier default or disable

Clipboard Privacy

Location: Settings > Security & privacy > Privacy controls > Show clipboard access

Shows notification when apps access clipboard content from other apps.

Privacy Indicators

GrapheneOS enables location indicator (in addition to camera/mic):

• Green dot shows when any app accesses location
• Works for all location APIs (not just GNSS)

Accessibility Warning

NEVER grant Accessibility permission unless absolutely required:

• Extremely dangerous permission
• Can read all screen content
• Can perform actions on your behalf

20. Quick Reference Checklist

Essential Security Settings

• Lock bootloader after installation
• Strong password/PIN - 6+ digit PIN or 16+ char password
• Enable Scramble PIN - Settings > Security & privacy > Device unlock
• Set Duress PIN/Password - Both required
• Auto-reboot: 8-18 hours - Settings > Security & privacy > Exploit protection
• USB-C: Charging-only when locked (default)
• Wi-Fi/Bluetooth auto-off: 10 minutes
• Enable VPN with lockdown - Block connections without VPN
• Enable Security Preview releases - Get patches early

Privacy Settings

• Disable Wi-Fi/Bluetooth scanning - Settings > Location
• Use per-connection MAC randomization (default)
• Set generic Bluetooth name - “Device”
• Use Private DNS - Quad9 or similar
• GrapheneOS connectivity checks (default)
• Review app Network permissions - Deny where not needed
• Enable Sensors deny by default - Settings > Security & privacy

Per-App Best Practices

• Deny Network for apps that don’t need internet
• Deny Sensors for apps that don’t need motion data
• Use Storage Scopes instead of full storage access
• Use Contact Scopes instead of full contacts access
• Disable native debugging - Settings > Security & privacy > Exploit protection
• Review all permissions after installation

Advanced Hardening

• Separate profile for Google Play - Isolate from main profile
• Use Private Space for sensitive apps
• Enable Auditor remote attestation - attestation.app
• Disable all dynamic code loading for apps that don’t need it
• Set auto-reboot to minimum tolerable (4-8 hours for high security)
• Consider Charging-only USB if you never use data transfer

Additional Resources

• Official Documentation: https://grapheneos.org
• Features Overview: https://grapheneos.org/features
• Usage Guide: https://grapheneos.org/usage
• FAQ: https://grapheneos.org/faq
• Releases: https://grapheneos.org/releases
• Discussion Forum: https://discuss.grapheneos.org
• Community:
  • Matrix: #community:grapheneos.org
  • Discord: discord.com/invite/grapheneos
  • Reddit: r/GrapheneOS
  • X/Twitter: @GrapheneOS
  • Mastodon: @GrapheneOS@grapheneos.social
  • Bluesky: @grapheneos.org

Document Information:

• Guide Version: 1.2
• Last Updated: January 31, 2026
• GrapheneOS Stable Release: 2026012100 (January 21, 2026)
• GrapheneOS Beta Release: 2026012800 (January 28, 2026)
• Android Base: Android 16 QPR2 (BP4A.251205.006)
• Vanadium Browser: 144.0.7559.109.0
• Supported Devices: Pixel 6 through Pixel 10 families

GrapheneOS is under active development. Security preview releases provide patches months ahead of public disclosure (currently through June 2026). Check official documentation at grapheneos.org for the latest features and recommendations.