Home › Guides › Choosing and buying

CalyxOS vs GrapheneOS

Checked against the makers' own pages · Last reviewed October 15, 2026

At a glance

[1][2][3][4][5][6][9][10][11][12]

Google apps: sandboxed Google Play vs microG

GrapheneOS says it "will never include either Google Play services or another implementation of Google services like microG." You can instead install Google's official Play Services and Play Store from the GrapheneOS App Store. They run in the standard app sandbox and receive "absolutely no special access or privileges," and they work only in the user profile where you install them. The project says this gives "near complete compatibility" with apps that depend on Google Play, with "only a small subset of privileged functionality" missing. Android Auto is available through an extension of the same layer.

CalyxOS ships microG, which it calls "a open source replacement for Google Play Services" that "only includes the useful parts." During setup you choose: microG off ("Many apps refuse to run"), on without a Google account with or without push notifications (push on is the default), or on with a Google account, which lets "some additional apps and services" such as Google Fi work. CalyxOS says microG "is not yet a mature replacement for Play Services," but "most apps are able to run fine with microG." Apps from the Play catalog come through Aurora Store.

Banking apps. GrapheneOS says many banking apps work once sandboxed Google Play is set up, but it "isn't certified by Google," so apps that enforce Google certification fail. We found no CalyxOS statement on banking apps; see our banking apps guide. [1][3][4][10]

Security approach

GrapheneOS focuses on hardening. Its features page lists its own hardened memory allocator (hardened_malloc), use of hardware memory tagging on newer Pixels, a hardened kernel, network and sensors permission toggles, Storage and Contact Scopes, a USB-C port control setting, auto reboot, and a duress PIN that wipes the phone. It supports only devices that meet a published list of requirements, including complete monthly security patches, at least five years of device updates (Pixels now have seven) and hardware memory tagging, which it says Pixels from the Pixel 8 on meet.

CalyxOS focuses on privacy tools for everyday users. Its features page lists the Datura firewall for per-app network access, built-in Tor and Riseup VPNs, automatic monthly over-the-air security updates, Verified Boot, timers that switch off Wi-Fi, Bluetooth, camera and microphone, a USB restriction setting, encrypted Seedvault backups and Work Profile. CalyxOS is meant to run with a relocked bootloader after installation.

CalyxOS also says that because Google stopped publishing source code for some quarterly Android releases, its Pixel updates on those versions can't include timely updates to proprietary components, and its Fairphone, Motorola and SHIFTphone updates depend on those makers' schedules, which are "usually behind AOSP updates by a month or two." [5][6][11][12][13]

Supported phones

As of Oct. 15, 2026, GrapheneOS has official production support for the Pixel 6, 6 Pro, 6a, 7, 7 Pro, 7a, Fold, Tablet, 8, 8 Pro, 8a, 9, 9 Pro, 9 Pro XL, 9 Pro Fold, 9a, 10, 10 Pro, 10 Pro XL, 10 Pro Fold and 10a. It announced a long-term partnership with Motorola on March 2, 2026. It says the current 2026 Motorola Signature, Razr Fold and Razr Ultra lack memory tagging (MTE) and "other features being added for 2027." On Sept. 22, 2026 it said the Motorola Signature 27 "will be the initial supported phone," with support expected "at some point in 2027 for the initial flagship, hopefully in the first half of the year." See GrapheneOS phones.

CalyxOS lists builds for the Pixel 6 through 9a and the Pixel 10a, plus the Fairphone 4, 5 and Gen. 6, the moto g 5G (2024), g84 5G, g34/g45 5G, g52, g42 and g32, and the SHIFTphone 8, plus the older Pixel 4a (5G), 5 and 5a. The Pixel 10, 10 Pro, 10 Pro XL and 10 Pro Fold are not on its list.

Both projects warn about US carrier phones: GrapheneOS says carrier-locked devices may block installation, and CalyxOS says Pixels from Verizon can't install it because their bootloaders can't be unlocked. [5][6][14][15][16][17]

CalyxOS's 2025-2026 pause and return

On Aug. 1, 2025, the Calyx Institute said its founder had left and that it would switch to new signing keys; until then, "current CalyxOS users will not be able to receive further security software updates." It estimated four to six months, recommended that users uninstall CalyxOS in the meantime, and said it had "no reason to believe the security of CalyxOS and its signing keys have been compromised."

On July 1, 2026 the project announced "CalyxOS is back" with release 7.2.2.0, which "will receive all future updates" and is signed with a new hardware security module (HSM) based system. Anyone on 6.10.10/20 or older, or on another Android system, needs a clean install. Monthly security updates followed in August and September, and CalyxOS 8.0.0.0, based on Android 17, began rolling out on Oct. 1, 2026. [7][8][11][18]

How they compare day to day

Neither project sells phones. GrapheneOS's official recommendation is to "buy a supported device and install GrapheneOS yourself" with its web installer; companies that sell phones with it preinstalled are not affiliated with or endorsed by the project. CalyxOS installs through its Web Installer or device-flasher tool.

In short, from the projects' own descriptions: GrapheneOS keeps Google's real Play apps available but boxed in, on Pixels only, with frequent releases. CalyxOS replaces Google's software with microG and bundles privacy apps such as Tor Browser and VPNs, on a wider range of phones, after an 11-month gap in updates. For other systems, see operating systems compared. [2][3][4][5][6][7][8][9][12]

Questions people ask