GrapheneOS vs DeniableOS: which one survives a forced unlock?
GrapheneOS is the best hardening base and DeniableOS is built on it; at the forced-unlock moment a duress wipe proves you hid something while a deniable unlock proves nothing.
If you care about phone privacy, GrapheneOS should be the first thing you try.
It is the most hardened Android available; it is free, open-source, and audited, and the team behind it is excellent. We think so highly of it that we built DeniableOS on top of it. Nothing here is an argument against GrapheneOS. This is about one specific situation, the forced unlock, and what you add to handle it.
That situation is a person in front of you: a border officer, a robber, someone applying pressure. Not a remote hacker. Ask what each setup does at that exact moment.
What GrapheneOS does
GrapheneOS offers a duress PIN that wipes the device when entered. Against a remote or opportunistic attacker who just wants the hardware, that is strong.
The problem is what a wiped phone says. If someone is standing over you and the screen shows a factory-fresh or bricked device, you have just demonstrated to them that you destroyed something. In a robbery that escalates. At a border, a wiped or refused phone can mean detention, denied entry, or a seized device. The wipe protects the data and exposes you.
What DeniableOS does
DeniableOS builds on the GrapheneOS hardening base, so it inherits the same protection against malware, tracking, and remote attackers. On top of that, it adds the one thing GrapheneOS does not: a way through a forced unlock that does not appear to be destructive.
One phone, three PINs, one lock screen. The public PIN opens your ordinary, lived-in phone. The hidden PIN opens a separate environment whose data cannot be distinguished from unused space, leaving an inspector with nothing to point to. The duress PIN is the part that matters here: where a plain GrapheneOS duress PIN wipes, DeniableOS opens the normal public side as if you had cooperated and quietly erases the hidden environment in the background. To anyone watching, it is a normal unlock, not a wipe.
So at the forced-unlock moment: a duress wipe gives them an empty phone that proves you hid something. DeniableOS gives them a full phone that proves nothing.
This cuts both ways, and pretending otherwise would be dishonest.
GrapheneOS is free and open source. DeniableOS is a paid, closed-source product today, with open-core and an independent audit on the roadmap. If auditability is your hard requirement right now, stock GrapheneOS wins that line. GrapheneOS also has a large team, a long track record, and years of community scrutiny. The deniability layer we add on top is young.
This is not really GrapheneOS against DeniableOS. It is GrapheneOS, and GrapheneOS plus a coercion-survival layer. Stock GrapheneOS is the right hardening platform against malware, tracking, and stolen devices. DeniableOS is for cases where a person makes you unlock the phone. Match what you run to the threat you actually face.
What we actually recommend
Use GrapheneOS. For most people, most of the time, it is the right call, and it costs nothing. DeniableOS earns its place only if a forced unlock is a real line in your threat model, which for a lot of crypto holders, travellers, and high-visibility people, it now is. And the deniability claim is narrow: it is built to beat coercion in the moment, not a forensic lab that already knows you use this system and holds your device for weeks.
Two phones. One device. Zero evidence.
See how a hidden, deniable environment protects what matters, even when you are forced to unlock.
FAQ
Is DeniableOS a fork of GrapheneOS?
DeniableOS is built on top of GrapheneOS. It inherits the GrapheneOS hardening base and adds a deniable-encryption layer, the hidden environment and duress unlock, which GrapheneOS does not include. You get what GrapheneOS gives you, plus coercion survival.
Can I get plausible deniability on GrapheneOS for free?
Not the same thing. GrapheneOS gives you a duress wipe and multiple user profiles, not a hidden environment that is unprovable. A wiped or empty-looking phone is a different outcome from a full, ordinary decoy one.
Which should I use?
If a human forcing you to unlock is not in your threat model, stock GrapheneOS is plenty. If it is, that is what the DeniableOS layer is for.
Sources
- GrapheneOS duress PIN feature: grapheneos.org
- Wrench attacks up ~75% (CoinDesk): coindesk.com
More to read
They came for the person, not the wallet
The smart attacker skips the cryptography and goes straight for you; here is why a hardware wallet does not cover a $5 wrench attack, and what does.
Can they actually force you to unlock your phone?
Your passcode is closer to a formality than a wall; here is what the law actually allows at borders and under duress, and the one option most people miss.
They asked for my phone at the border. What now?
At many borders, an officer can make you unlock your phone, and saying no has real consequences. Here are your actual options, and the one most people don't know about.