# GrapheneOS

895 Hacker News commenters recommended GrapheneOS and 312 criticized it, November 2025 to November 2026. It was recommended in 13 of 13 months; owners who said how long report a median of 1 years (87 owners). It meets the Hacker Approved badge rule.

**Verdict:** A hardened, privacy-focused Android that just works, with fine-grained permissions and optional sandboxed Google Play, though some banking apps refuse to run on it.

## Why people recommend it

- Strong security hardening by default (8 comments): "GrapheneOS adds the option to set a 2nd factor PIN for fingerprint unlock to make using a strong passphrase convenient without the downsides of biometric-only unlock." ([source](https://news.ycombinator.com/item?id=49059706)) "GrapheneOS is not going to compromise on privacy or security, and so far, pixel devices are the only devices meeting the hardware security requirements." ([source](https://news.ycombinator.com/item?id=50168783)) "For me it's the added security features: per-app network permissions, scoped storage/contacts permissions, and a bunch of system hardening measures." ([source](https://news.ycombinator.com/item?id=48567565))
- Optional sandboxed Google Play (5 comments): "Graphene also allows changing (or disabling) connections to Google via their proxy for: Widevine checks, Internet Connectivity checks, certificate transparency, PSDS, and SUPL." ([source](https://news.ycombinator.com/item?id=49776787)) "GrapheneOS does better at deGoogling than other OSes, including adding features to the OS so people have fewer reasons to install Sandboxed Google Play" ([source](https://news.ycombinator.com/item?id=50168612)) "It is significantly easier to the point it is entirely optional. GrapheneOSs privacy and security features do not make avoiding google more difficult." ([source](https://news.ycombinator.com/item?id=50210927))
- Granular network and storage permissions (3 comments): "GrapheneOS has storage scopes which make the app think it has full folder/file access but in reality you can choose the exact files or folders to give access." ([source](https://news.ycombinator.com/item?id=49031924)) "For me it's the added security features: per-app network permissions, scoped storage/contacts permissions, and a bunch of system hardening measures." ([source](https://news.ycombinator.com/item?id=48567565)) "This is good for compatability (apps generally take into account that a network can be down) and too avoid apps knowing you are using the feature." ([source](https://news.ycombinator.com/item?id=47067001))
- Fast, easy, just works (3 comments): "Everyone should use Graphene. You don't have to be a privacy nut - it's also a version of Android that just works, efficiently, without bullshit, for you and not for Google." ([source](https://news.ycombinator.com/item?id=48426596)) "I've been using GrapheneOS for years, I can't go back to another OS due to its ease of use, speed, and awesome features baked into my day to day use now." ([source](https://news.ycombinator.com/item?id=46454348)) "Consumers don't care how interesting the developer's problems are. They want their own problems to be solved and GrapheneOS does a better job of that." ([source](https://news.ycombinator.com/item?id=46571519))

## What people warn about

- Some banking apps won't work (5 comments): "It is very ironic that the solution is using an old, insecure phone full of unpatched holes for all important banking and id business, because that one is vendor-allowed while your state-of-the-art GrapheneOS is not." ([source](https://news.ycombinator.com/item?id=46556882)) "unlike other non-rooted custom ROMs, allows re-locking the bootloader. But, whether a banking app will work depends on what level of Google Play attestation they require" ([source](https://news.ycombinator.com/item?id=46556823)) "privacy-aware family members running up-to-date Lineage or Graphene OS with recent kernels and frequent updates constantly run into apps refusing to work for "security" reasons" ([source](https://news.ycombinator.com/item?id=48759508))
- Updates limited by OEM drivers (2 comments): "It's effectively a hardened variety of LineageOS/AOSP, hence entirely reliant on device-specific downstream kernels/BSPs that will never see a feature update." ([source](https://news.ycombinator.com/item?id=46565707)) "GrapheneOS is fully dependant on the OEM of the phone to supply them with up to date drivers and can't support their builds longer than that." ([source](https://news.ycombinator.com/item?id=49493108))

## Cite as

Hacker Approved, "GrapheneOS", https://hackerapproved.com/p/grapheneos/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).