This guide will show you the steps to install the latest GrapheneOS ROM and subsequently lock the bootloader. Flashing a custom ROM opens the floodgates for a plethora of customizations and tweaks. However, there’s always an element of risk involved, not just from the bricking point of view but even due to the fact that the ROMs might not have done enough to provide a safe, secure, and stringent private ecosystem for its user base.
While that stands true for most of the ROMs, however, there are, thankfully, a couple of exceptions as well, and GrapheneOS is a part of it. Without a shadow of a doubt, this ROM is probably the safest and most secure currently available for Android devices. With a slew of strict privacy measures that it has undertaken [see the complete list below], you are bound to remain within the safest environment that any ROM can offer.
And the best part? You can even relock the bootloader after flashing GrapheneOS, thereby adding an additional layer of security. So without any further ado, let’s get you acquainted with all the privacy and security features that it has to offer, after which, we will make you aware of its flashing steps as well. Follow along.
Table of Contents
What is GrapheneOS?
GrapheneOS is a custom ROM based on Android Open Source Project that focuses more on privacy and security instead of bundling tons of customizations and features. With a plethora of strict privacy measures combined with the ability to relock the bootloader, it can easily claim the throne of being the most secure custom ROM out there [look elsewhere CalyxOS users!].
Features of GrapheneOS?
Some of GrapheneOS’s noteworthy features include [you may go through their complete feature list here].
- More complete patching
- Sandboxed Google Play
- Android Auto
- Network permission toggle
- Sensors permission toggle
- Storage Scopes
- Contact Scopes
- Broad carrier support without invasive carrier access
- LTE-only mode
- Wi-Fi privacy
- Private screenshots
- Closed device identifier leaks
- PIN scrambling
- Privacy by default
- Supports longer passwords
- Auto reboot
- Clearing sensitive data from memory
- Duress PIN/Password
- More secure fingerprint unlock
- Improved user profiles
- More user profiles
- End session
- Disabling app installation
- Install available apps
- Notification forwarding
How to Install GrapheneOS ROM and Lock Bootloader

There exist two different methods through which you can flash this ROM- WebUSB-based installer and the command-line installation. The former is an automatic flashing process whereas the latter is a manual one. we have listed both these methods below. Go through them once and then try out the one that is in sync with your requirements.
Moreover, before starting with either of the two methods, please take a backup of all the data on your device. Droidwin and its members wouldn’t be held responsible in case of a thermonuclear war, your alarm doesn’t wake you up, or if anything happens to your device and data by performing the below steps.
Using WEbUSB Installer
- Download and extract Android SDK Platform Tools on the PC.
- Enable USB Debugging and connect the device to PC via USB.
- Then open Command Prompt inside the platform-tools folder.
- Now type the below command to boot your device to Fastboot:
adb reboot bootloader
- Once done, head over to the Graphene WEB USB Installer.
- Now click on Unlock Bootloader and proceed with the steps.
- Then click on Download Release to download GrapheneOS.
- Now click on Flash Release to flash this build to your device.
- Finally, click on Lock Bootloader, if required [see FAQ 1,2].
- Regarding disabling the OEM Unlock toggle, refer to FAQ 3.
That’s it. These were the steps to install GrapheneOS ROM on your device and lock the bootloader. Let’s now check out how this could be done the manual way.
Using Command Line Method
- Download and extract Android SDK Platform Tools on the PC.
- Enable USB Debugging and connect the device to PC via USB.
- Then open Command Prompt inside the platform-tools folder.
- Now type the below command to boot your device to Fastboot:
adb reboot bootloader
- After that, type the below command to unlock the bootloader:
fastboot flashing unlock
- Once it’s done, reboot your device back to the Fastboot Mode.
- Now download the GrapheneOS for your device from this link.
- Then extract it and launch the flash_all.bat file to start flashing.
- Once done, the device will boot to the newly flashed GrapheneOS.
- If you want to relock the bootloader, then refer to FAQs 1 and 2.
- Regarding disabling the OEM Unlock toggle, check out FAQ 3.
That’s it. These were the steps to flash the GrapheneOS on your device and lock the bootloader. If you have any queries concerning the aforementioned steps, do let us know in the comments. We will get back to you with a solution as soon as possible.
FAQ 1: Should I Relock the Bootloader on GrapheneOS?
Relocking the bootloader after flashing the GrapheneOS should only be done if you are cent percent sure that the flashing has been done successfully and the avb_pkmd.bin file has been flashed as well. Moreover, your device should not be rooted and there should not be any custom binary installed as well.
All in all, the best time frame to carry out this procedure is right after “flashing the ROM > booting to the OS > booting back to the Fastboot Mode” because at that point in time you only have files from GrapheneOS. Moreover, once you have successfully locked the bootloader, you will not be able to root the device, install any modules, or flash custom binaries until you unlock it once again. So keep these points in mind and only then proceed with the relocking steps.
FAQ 2: How to Relock Bootloader on GrapheneOS?
- If you are using the WEbUSB Installer, then just click on Relock Bootloader and it will get the job done for you.
- On the other hand, if you are using the Command Line Method, then flash GrapheneOS > boot to OS > boot to Fastboot Mode via adb reboot bootloader > then use the “fastboot flashing lock” command to get this job done.
FAQ 3: Should you Disable the OEM Unlocking Toggle?
No, you shouldn’t. Although disabling it will give you the perfect secure environment, but if something goes wrong during the usage of this ROM, then you’ll run out of luck. This is because the bootloader is already locked and if your device gets into a bootloop or softbrick state, then you wouldn’t be able to recover it as unbricking the device requires an unlock bootloader which in turn requires the OEM Unlock toggle to be enabled. Since that is currently disabled and you cannot access the OS to enable it, your device might end up as a paperweight! So if you are planning to recock the bootloader, then at least keep the OEM Unlock enabled at all times.