GrapheneOS vs CalyxOS is the choice most people face once they decide to put a degoogled Android on their phone. Both are free and open source, both install from a web browser, and both relock the bootloader afterwards. They differ in how they handle Google’s apps, how far they harden the system, and which phones they run on.
CalyxOS also has a gap in its record. It stopped releasing updates for 11 months in 2025 and 2026, then came back. Everything below was checked against both projects’ own sites in October 2026.
GrapheneOS and CalyxOS Side by Side
| GrapheneOS | CalyxOS | |
|---|---|---|
| Price (Oct 2026) | Free. You supply a Pixel, such as a Pixel 10a from $599 in the US | Free. You supply a supported phone |
| Phones | Pixel 6 to Pixel 10 series, including the 10a, Folds and Tablet. Not the Pixel 11 | Pixel 4a (5G) to Pixel 9 series, plus the 10a, Fold and Tablet. Fairphone 4, 5 and 6, seven Motorola moto g models, SHIFTphone 8. Not the Pixel 10, 10 Pro or Pixel 11 |
| Google layer | Optional sandboxed Google Play, meaning Google’s real Play services running as ordinary apps with no special access | microG, an open-source stand-in for parts of Play services, on by default in the recommended setup |
| Security | Extra exploit protections, hardware memory tagging, relocked bootloader | Standard Android security, verified boot, relocked bootloader |
| Updates | Release 2026100600 (6 October 2026) on Android 17, with early patch access | CalyxOS 8 on Android 17, stable since 13 October 2026, after an 11-month pause |
| Banking apps | Most work with sandboxed Google Play. Apps that demand Play Integrity device checks fail | Depends on the app. Play Integrity checks fail with microG |
| Android Auto | Officially supported through sandboxed Google Play | Not documented. Test it with your car |
| Google Wallet tap-to-pay | Doesn’t work | Doesn’t work |
| Privacy tools | Network and Sensors toggles per app, Contact and Storage Scopes, up to 31 extra profiles, duress PIN | Datura Firewall per app, built-in Tor and Riseup VPNs, DuckDuckGo as default search |
| Apps included | GrapheneOS App Store, Vanadium browser, Auditor | F-Droid, Aurora Store, CoMaps |
| Backups | Seedvault, off until you turn it on | Seedvault to a USB drive or Nextcloud |
| Install | Web installer, about an hour | Web installer for Pixel and Motorola, command-line flasher for the others |
| Run by | A non-profit open-source project | The Calyx Institute, a US non-profit in New York |
| Open source | Yes | Yes |
Security and Updates
GrapheneOS puts security first. It adds exploit protections across the system, uses the hardware memory tagging built into recent Pixels, and restarts a locked phone after 18 hours by default. It only supports phones that meet its hardware security requirements, which today means Pixels.
CalyxOS stays closer to standard Android. It relocks the bootloader so verified boot can check the system, and it aims to ship each monthly security update in the same week Google publishes it. Major Android versions take longer. CalyxOS 8, on Android 17, began rolling out on 1 October 2026 and reached the stable channel for every supported phone on 13 October.
Patch timing now favors GrapheneOS. Since October 2025, Google gives phone makers security patches months before it publishes them. GrapheneOS gets early access through a phone-maker partner. Most other projects wait for the public release.
The track record matters too. CalyxOS paused all releases on 1 August 2025, after co-founder Nicholas Merrill left, and told users to expect no updates for four to six months. It took 11. Phones running it went without security updates for most of that time. The project returned on 1 July 2026 with a new signing system built on hardware security modules and a third-party audit of its key ceremony scripts. Anyone still on version 6.10.x has to reinstall.
Google Apps, microG and Sandboxed Google Play
Many apps expect Google Play services for push notifications, maps and sign-in. The two systems solve that differently.
- GrapheneOS ships with no Google apps and no Play services. If an app needs Google, you install Google’s real Play services from the GrapheneOS App Store, as ordinary sandboxed apps. You can put them in a separate profile so only your bank and a few other apps see them. This gives the best app compatibility of any degoogled setup.
- CalyxOS ships with microG, an open-source rewrite of parts of Play services. At first boot you choose how to set it up. CalyxOS recommends microG on, no Google account, and push notifications on. microG runs less Google code, but push messages still pass through Google’s servers and Play Integrity checks fail.
If you want no Google services at all and accept that some apps won’t work, both systems allow it. On GrapheneOS you skip sandboxed Play. On CalyxOS you choose to disable microG when you first set up the phone.
Which Phones Each One Runs On
On a Pixel, the two overlap almost completely. GrapheneOS also supports the Pixel 10, 10 Pro, 10 Pro XL and 10 Pro Fold, which CalyxOS doesn’t list. Neither supports the Pixel 11 series. The support dates for Pixels follow Google’s own update dates, so a Pixel 8 runs until at least October 2030 on either system.
Away from Pixels, only CalyxOS is an option. Check how long it will keep updating your phone before you flash it.
| Phone | CalyxOS security updates until (CalyxOS estimate) |
|---|---|
| Fairphone (Gen. 6) | June 2033 |
| Fairphone 5 | September 2031 |
| Fairphone 4 | December 2026 |
| moto g 5G (2024) | March 2027 |
| moto g34 5G and g45 5G | January 2027 |
| moto g84 5G, g52, g42 and g32 | December 2026 |
| SHIFTphone 8 | December 2026 |
That table is the real case for CalyxOS. On a Fairphone 5 or 6 it gives you years of updates on a repairable phone that GrapheneOS can’t run. On a Motorola or a Fairphone 4, support ends within months, so flash it only to keep a phone you already own going a little longer.
GrapheneOS says Motorola support is on track for 2027, after a partnership announced in March 2026. No Motorola phone runs it yet. Our GrapheneOS guide lists every supported Pixel with its end date.
Everyday Use
Banking, Payments and the Car
- Banking apps. On GrapheneOS, most work once you add sandboxed Google Play. CalyxOS says it depends on the app. Apps that insist on Google’s Play Integrity device check fail on both. Look yours up on the PrivSec.dev list for GrapheneOS and on Plexus, which rates apps on microG setups.
- Tap-to-pay. Google Wallet contactless payments don’t work on either. CalyxOS lists Google Pay and most other payment apps as not working. Plan on a card or a watch, as our Google Wallet alternatives page explains.
- Second phone numbers. CalyxOS lists apps such as Google Voice, Line2 and MySudo as not working.
- Android Auto. GrapheneOS supports it officially through sandboxed Google Play. CalyxOS doesn’t document it, so test it with your car before you rely on it.
Privacy Tools and Included Apps
GrapheneOS gives you fine-grained controls. You can cut any app off from the network or the motion sensors, show an app only the contacts or files you pick, run up to 31 extra profiles, and set a duress PIN that wipes the phone.
CalyxOS focuses on ready-made tools. The Datura Firewall controls network access per app, Tor and Riseup VPNs are built in, and DuckDuckGo is the default search engine. F-Droid and Aurora Store come preinstalled, and CoMaps is the default maps app.
Backups
Both include Seedvault, an encrypted backup tool. On CalyxOS it backs up to a USB drive or Nextcloud. On GrapheneOS it’s off until you turn it on, and GrapheneOS plans to replace it. On either one, back up Signal and your 2FA app with their own export tools, because many apps opt out of system backups.
What It Costs
Both systems are free. The phone is the cost. GrapheneOS needs a Pixel, from $599 for a new Pixel 10a in the US (Oct 2026), or less for a used Pixel 8, 8a or 9a. CalyxOS lets you keep a Fairphone you already own, which is often the cheapest route of all. Our guide to the best degoogled phones compares prices for both.
How to Switch From the Google Side
Installing either system wipes the phone. Do the backups first, then follow the official installer.
- Export your two-factor codes, move your photos and download anything else you want with Google Takeout.
- Check your must-have apps on PrivSec.dev and Plexus.
- Confirm your exact model is on the supported list. Buy Pixels unlocked, because Verizon Pixels can’t be unlocked. Motorola phones need an unlock code from Motorola.
- For CalyxOS, remove your Google account from the phone first. Factory Reset Protection must be off before you flash.
- Turn on OEM unlocking in Developer options, then run the web installer at grapheneos.org/install/web or calyxos.org/install.
- Lock the bootloader again when the installer asks. Both systems depend on it.
Our GrapheneOS guide walks through every screen of that install, including sandboxed Google Play and profiles.
If Neither One Fits
- /e/OS suits people who want to buy a phone that works out of the box. Murena sells Fairphones and refurbished Pixels with it, and its list covers 217 phones. It also uses microG, adds Murena’s own store and cloud, and usually lags GrapheneOS on security patches.
- LineageOS runs on the widest range of phones. LineageOS 24, on Android 17, started reaching an initial set of devices in October 2026. Official builds have no microG, and the bootloader usually stays unlocked, which weakens security and breaks more banking apps. Use it to keep an older phone alive.
- An iPhone, or stock Android with Google stripped back, keeps every banking app and tap-to-pay. Our phone guide covers both paths.
When Google’s Android Is Still Better
Partial is fine. If a must-have app fails, keep stock Android for now and degoogle it from the settings.
Before you wipe anything, find out which accounts depend on your Google address. Our free scan builds that list from files you download yourself.