Install apps
Where to get apps from, how to check that an app is the real one, and how the everyday profile and the protected space each get their own.
01Each space installs its own
The everyday profile and the protected space are separate Android users. An app installed in one is not in the other, and each copy has its own data. To put an app in the protected space, open the protected space and install it there.
- The protected space's apps only run, and only update, while it is open.
- Fewer apps in the protected space means fewer things that can go wrong there. Keep it to what you open on purpose: see what goes where.
02Where to get apps
From the source you have to trust least, to the most:
| Source | What it is | Use for |
|---|---|---|
| Apps (preinstalled) | GrapheneOS's app store. Checks every package's signature against keys built into it. | Google Play (sandboxed), Accrescent, Vanadium and GrapheneOS's own apps. |
| Accrescent | An app store for open-source apps that pins each developer's signing key. No account. | Apps it carries, and AppVerifier (below). |
| Google Play | The usual store, running as an ordinary sandboxed app. | Banking, payment and other apps only published there. |
| Obtainium | Installs and updates apps straight from the developer's GitHub, GitLab or Codeberg releases. | Open-source apps not in Accrescent. |
| F-Droid | An open-source app repository. Many apps there are signed by F-Droid, not by their developer. | Apps whose developer doesn't publish releases anywhere else. |
| APK mirrors, "mod" sites, links in chats | Never. Fake versions of popular apps are the main way phones get compromised. | |
An app from F-Droid and the same app from the developer are signed with different keys, so one can't update the other. Pick one source per app and stay with it.
03Google Play
Google Play isn't installed by default. When you install it from Apps, it runs as a regular app in that space, with no special access to the system.
- In the space that needs it, open Apps and install Google Play Store. Apps installs Google Play services with it.
- Sign in with a Google account, or skip and use it without one where apps allow.
Install it only in the space that needs it. If only your bank needs Play, install it in the protected space and not in the everyday profile, or the other way round.
04Check the first install
Android lets an app update only if the update is signed with the same key as the installed version. So the first install is the one that matters: if it is genuine, every later update has to be signed by the same developer (or a key they rotated to). That proves who signed it, not that the code is safe: you still trust the developer.
- Install AppVerifier from Accrescent.
- Find the app's signing certificate fingerprint (SHA-256) where the developer publishes it: their website, the README of their repository, or the release notes.
- Before installing a downloaded APK, share it to AppVerifier (or, for an installed app, open AppVerifier and pick the app). It shows the fingerprint and says whether it matches one it knows.
- Compare with the developer's fingerprint. Match: install. No match: delete the file.
Obtainium can't vouch for a first install unless you give it the right fingerprint, so do this step for every app you add through it. Apps, Accrescent and Google Play check signatures on their own.
On a computer with the Android SDK, the same check is:
apksigner verify --print-certs app.apk05Banking apps
Most banking apps work with sandboxed Google Play. Some don't, and you only find out by trying:
- Google's Play Integrity check. Many banks use it. Its strict level fails on any OS that isn't Google's own, so an app that requires it refuses to run, here and on GrapheneOS alike.
- Banks that support GrapheneOS usually do so by trusting GrapheneOS's own signing key. This OS is signed with a different key, so those banks may not recognise it even though they work on GrapheneOS.
Install each banking app and log in before you depend on it. If one refuses, use the bank's website in Vanadium instead.
06From a computer
For your own builds or test APKs, with USB debugging turned on in Developer options:
adb shell pm list users
adb install --user 0 app.apkUser 0 is the everyday profile. Installing into the protected space this way needs it open, and anything that can reach the phone over USB then reaches it too. Prefer installing from inside the protected space, and turn USB debugging off when you're done.
Wallets have more to check than other apps: see crypto wallets.