privacyguides.org/docs/android/distributions.md

meta_title	title	description	schema
The Best Custom Android OSes (aka Custom ROMs) - Privacy Guides	Alternative Distributions	You can replace the operating system on your Android phone with these secure and privacy-respecting alternatives.	@context @type name url http://schema.org WebPage Private Android Operating Systems ./ @context @type name image url sameAs subjectOf http://schema.org CreativeWork GrapheneOS /assets/img/android/grapheneos.svg https://grapheneos.org/ https://en.wikipedia.org/wiki/GrapheneOS @context @type url http://schema.org WebPage ./ @context @type name image url sameAs subjectOf http://schema.org CreativeWork Divest /assets/img/android/divestos.svg https://divestos.org/ https://en.wikipedia.org/wiki/DivestOS @context @type url http://schema.org WebPage ./

A custom Android-based operating system (often known as a custom ROM) is a popular way to achieve higher levels of privacy and security on your device. This is in contrast to the "stock" version of Android which comes with your phone from the factory, and is often deeply integrated with Google Play Services.

We recommend installing one of these custom Android operating systems on your device, listed in order of preference, depending on your device's compatibility with these operating systems.

AOSP Derivatives

GrapheneOS

{ align=right } { align=right }

GrapheneOS is the best choice when it comes to privacy and security.

GrapheneOS provides additional security hardening and privacy improvements. It has a hardened memory allocator, network and sensor permissions, and various other security features. GrapheneOS also comes with full firmware updates and signed builds, so verified boot is fully supported.

:octicons-home-16: Homepage{ .md-button .md-button--primary } :octicons-eye-16:{ .card-link title="Privacy Policy" } :octicons-info-16:{ .card-link title=Documentation} :octicons-code-16:{ .card-link title="Source Code" } :octicons-heart-16:{ .card-link title=Contribute }

GrapheneOS supports sandboxed Google Play, which runs Google Play Services fully sandboxed like any other regular app. This means you can take advantage of most Google Play Services, such as push notifications, while giving you full control over their permissions and access, and while containing them to a specific work profile or user profile of your choice.

Google Pixel phones are the only devices that currently meet GrapheneOS's hardware security requirements.

DivestOS

{ align=right }

DivestOS is a soft-fork of LineageOS. DivestOS inherits many supported devices from LineageOS. It has signed builds, making it possible to have verified boot on some non-Pixel devices.

:octicons-home-16: Homepage{ .md-button .md-button--primary } :simple-torbrowser:{ .card-link title="Onion Service" } :octicons-eye-16:{ .card-link title="Privacy Policy" } :octicons-info-16:{ .card-link title=Documentation} :octicons-code-16:{ .card-link title="Source Code" } :octicons-heart-16:{ .card-link title=Contribute }

DivestOS has automated kernel vulnerability (CVE) patching, fewer proprietary blobs, and a custom hosts file. Its hardened WebView, Mulch, enables CFI for all architectures and network state partitioning, and receives out-of-band updates. DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via defconfig hardening. All kernels newer than version 3.4 include full page sanitization and all ~22 Clang-compiled kernels have -ftrivial-auto-var-init=zero enabled.

DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's INTERNET and SENSORS permission toggle, hardened memory allocator, exec-spawning, JNI constification, and partial bionic hardening patchsets. 17.1 and higher features GrapheneOS's per-network full MAC randomization option, ptrace_scope control, automatic reboot, and Wi-Fi/Bluetooth timeout options.

DivestOS uses F-Droid as its default app store. We normally recommend avoiding F-Droid, but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, DivestOS Official. We recommend disabling the official F-Droid app and using F-Droid Basic with the DivestOS repository enabled to keep those components up to date. For other apps, our recommended methods of obtaining them still apply.

Warning

DivestOS firmware update status and quality control varies across the devices it supports. We still recommend GrapheneOS depending on your device's compatibility. For other devices, DivestOS is a good alternative.

Not all of the supported devices have verified boot, and some perform it better than others.

Criteria

Please note we are not affiliated with any of the projects we recommend. In addition to our standard criteria, we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.

• Must be open-source software.
• Must support bootloader locking with custom AVB key support.
• Must receive major Android updates within 0-1 months of release.
• Must receive Android feature updates (minor version) within 0-14 days of release.
• Must receive regular security patches within 0-5 days of release.
• Must not be "rooted" out of the box.
• Must not enable Google Play Services by default.
• Must not require system modification to support Google Play Services.