Most **GrapheneOS setup** guides end at the same place. Flash the OS, toggle a few hardening switches, install Signal, install Mullvad, screenshot the settings page, publish. Done. Those guides aren't wrong - they're just incomplete. Once the OS is locked down, the phone still needs to *connect* to something. Carrier data, account verifications, browsing that doesn't immediately get flagged. Nobody writes about that part. Spend five minutes on r/GrapheneOS and the same questions show up every week: *"which eSIM actually works without Google Play?"* and *"how do I verify accounts without giving up a personal number?"* No authoritative answer exists. Just scattered Reddit threads pointing at providers that are either US-only, overpriced, or routing traffic through a single country. A de-Googled phone with no connectivity strategy is basically a brick that happens to respect your privacy. What you need is a complete **privacy phone stack** - OS hardening *plus* the infrastructure underneath it. Network & internet > eSIM support.", "VoIP numbers face 60-80% rejection on platforms with active fraud detection. Non-VoIP numbers backed by real SIM cards typically see 95%+ success rates on major platforms.", "Mobile proxy IPs (4G/5G carrier-assigned) are classified as legitimate residential/mobile addresses by IP intelligence databases. Datacenter VPN IPs are not.", "Profile compartmentalization on GrapheneOS lets each user profile run its own VLESS proxy config, separate SMS numbers, and independent VPN kill switch - full identity isolation per profile." ]} /> --- ## Where Every Other Guide Stops (And Why It Matters) IntelTechniques covers OS-level settings thoroughly. Permissions, sensor toggles, network preferences. Ventral Digital's guide acknowledges eSIMs exist but doesn't name a provider worth using. GitHub's GrapheneOS-Guide lists KeepGo and Cape as options. **Cape is a genuinely strong privacy carrier** - no-KYC, IMSI rotation every 24 hours, encrypted voicemail, last-mile SMS encryption, and SIM swap protection. At $99/month it's a premium US-based carrier replacement, not a toolkit. KeepGo requires an email and credit card. Silent.Link offers no-KYC eSIMs but routes all data through a single country (previously Poland, now UK), so every connection exits from the same small pool of IPs. Mullvad, while excellent as a VPN, hands out datacenter IPs that platforms like Google, Meta, and banking apps flag on sight. So the **GrapheneOS privacy** model breaks down into a surprisingly simple problem: private OS, non-private pipes. Three gaps specifically: 1. **Carrier-routed data** - not datacenter, not a single-country exit node 2. **Real-SIM SMS verification** - numbers that pass HLR lookups, not VoIP lines that get rejected 3. **Mobile-IP browsing** - traffic that looks like a normal phone user, not a server rack in Frankfurt --- ## Building the Connectivity Layer: eSIM Activation Without Google Play **GrapheneOS eSIM setup** is the first thing that trips people up. On stock Android, scanning a QR code goes through the carrier's app, which usually requires Google Play Services. **GrapheneOS handles this natively.** As of 2026, eSIM management on GrapheneOS does not require Google Play - it uses proprietary Google functionality that is isolated from Play Services and never shares data with Google. It won't connect to a Google service unless the carrier itself uses one. The [official GrapheneOS usage guide](https://grapheneos.org/usage) confirms this explicitly. To enable: navigate to **Settings > Network & internet > eSIM support** and toggle it on. This toggle is persistent across every reboot. From there, tap **+** to add a new eSIM and scan the provider's QR code. No Play Store. No sideloaded APK. No permissions granted to anything. If the eSIM installation stalls on "Checking network info..." despite a stable internet connection, dial `*#*#4636#*#*` and enable DSDS in the menu that appears. This resolves the issue on most Pixel models. Provider choice matters more than most people realize. A no-KYC [eSIM](/esim) activated with crypto, delivered as a QR code, is the baseline. VoidMob's eSIMs work this way: scan the QR from the dashboard, activate in settings, no email required, pay with crypto. Traffic provisions through standard carrier infrastructure with transparent routing - it exits through the carrier's native network in whatever region the plan covers. **Not a VPN tunnel. Not Poland.** You see the carrier name and IP exit country for every plan before purchase - pick a USA T-Mobile plan and your IP exits through USA, pick a Germany Vodafone plan and your IP exits through Germany. For a full breakdown of how no-KYC eSIM providers compare on routing transparency, anonymous activation, and actual IP behavior, see [No-KYC eSIM Providers Compared 2026](/blog/no-kyc-esim-providers-compared-2026). ### Dual SIM: Physical SIM + VoidMob eSIM GrapheneOS Pixel phones support a physical nano-SIM and eSIM simultaneously. This opens up a practical dual-SIM strategy: keep a physical SIM in the tray for calls and texts on a primary number, and use the VoidMob eSIM exclusively for data - all privacy-sensitive browsing and app traffic routes through the eSIM's carrier IP, completely separate from your voice line. GrapheneOS supports cross-SIM calling (backup calling), which lets you make calls over your primary SIM using the VoidMob eSIM's data connection when the primary SIM has no signal. Enable it at **Settings > Network & internet > SIMs > Automatic data switching.** When active, "Backup Calling" appears next to the carrier name. ### LTE-Only Mode After activation, switch to LTE-only mode. 5G NSA (non-standalone) can fall back to 4G control planes in ways that leak IMSI data to rogue base stations. A [2024 study published in MDPI](https://www.mdpi.com/2624-800X/4/1/2) validated three attacks on commercial 5G NSA devices, including an IMSI leak that consistently exposed user information with no security mitigation. Separate [research presented at NDSS 2025](https://www.ndss-symposium.org/ndss-paper/detecting-imsi-catchers-by-characterizing-identity-exposing-messages-in-cellular-traffic/) confirmed that IMSI-exposing messages remain a threat across 2G, 3G, 4G, and 5G-NSA networks. As [Zetier's analysis](https://zetier.com/5g-imsi-catcher/) puts it: "any 5G Non-Standalone deployments have all of the same vulnerabilities as 4G." The GrapheneOS project recommends LTE-only to reduce attack surface - it disables massive codebases for legacy 2G/3G and bleeding-edge 5G protocols. On GrapheneOS, navigate to **Settings > Network & internet > SIMs > [your eSIM] > Preferred network type** and select **LTE only**. Some Pixel models bury this under `*#*#4636#*#*` in the dialer, then Phone information > Set preferred network type. On Pixel 7 and later, the `*#*#4636#*#*` menu may be restricted. If LTE-only isn't visible in standard settings, use the ADB command: `adb shell settings put global preferred_network_mode 11` (11 = LTE only). Reboot after. LTE encryption protects against some forms of interception but is not a replacement for end-to-end encryption - always use Signal or SimpleX for calls and messages, regardless of network mode. --- ## SMS Verification That Actually Works Here's where most **GrapheneOS privacy** setups fall apart in practice. Hardened phone, no-KYC eSIM for data, everything looking good - and then ProtonMail wants a phone number. Telegram wants a phone number. Literally anything worth signing up for wants a phone number. Your personal number is the single biggest identifier tying your real identity to your digital life - linked to your name, address, bank accounts, every platform you've ever verified. Using it on a privacy phone defeats the purpose entirely. VoIP numbers face **60-80% rejection rates** on platforms with active fraud detection. Services run HLR (Home Location Register) lookups to check whether a number is attached to a real SIM on a real carrier - [phone intelligence APIs](https://www.twilio.com/docs/lookup) return the line type (mobile, landline, VoIP), carrier name, and reachability status, making it straightforward to identify and block virtual numbers. **VoIP fails. Google Voice fails. Most "free SMS" services fail.** It's become a real bottleneck for anyone running a de-Googled setup. For a deeper look at how these detection mechanisms work, see [How Platforms Detect Virtual Phone Numbers in 2026](/blog/how-platforms-detect-virtual-phone-numbers-2026). Non-VoIP [SMS verification](/sms) through real SIM-card numbers is the only reliable path at this point. VoidMob's SMS service provides this through a web dashboard with no app install, no Play Store dependency, and no account creation requiring email. Pick a number from the pool, request the verification, read the code on the dashboard. **Non-VoIP numbers typically show 95%+ success rates across major platforms**, compared to the 20-40% success rates VoIP numbers achieve. Over 250 platforms supported - Signal, Telegram, WhatsApp, Discord, Instagram, crypto exchanges, and more. Because it's web-based, verification happens in Vanadium (GrapheneOS's hardened Chromium fork) or any browser. **No sideloaded APK. No permissions granted.** --- ## Mobile Proxy as a GrapheneOS VPN Alternative Mullvad is good software. A datacenter IP is still a datacenter IP though, and platforms maintain lists. Someone logging into Instagram from a Mullvad exit node is connecting from an IP already flagged as "commercial VPN / hosting provider" in databases like MaxMind and [IP intelligence scoring APIs](https://www.ipqualityscore.com/documentation/proxy-detection-api/overview). Captchas, blocks, forced re-verification. It defeats half the purpose of having a privacy phone in the first place. A **GrapheneOS VPN alternative** that actually works for daily use relies on mobile proxy infrastructure. Real 4G/5G IPs assigned by carriers to real devices. These IPs sit in residential/mobile ranges that platforms trust because they look like a person on a phone - because they are. The difference between a mobile IP and a datacenter IP is visible at the [ASN level](https://www.cloudflare.com/learning/network-layer/what-is-an-autonomous-system/): mobile IPs belong to carrier ASNs, while datacenter IPs belong to hosting provider ASNs that platforms specifically flag. VoidMob's dedicated 5G [mobile proxies](/proxies) support VLESS protocol over Xray, meaning they can be configured in VPN mode on GrapheneOS using apps like V2rayNG (available on F-Droid via IzzyOnDroid repo). Three details worth highlighting: 1. **Carrier-native DNS resolution.** DNS queries don't leak to Google or Cloudflare - they resolve through the carrier's own DNS servers. Exactly what a normal phone does. No DNS/IP mismatch for platforms to detect. 2. **Full UDP support** via SOCKS5 and VPN mode. VoIP calls, QUIC/HTTP3, [WebRTC](/tools/webrtc-leak-test) all work natively - most proxy providers only support TCP, silently dropping or encapsulating UDP traffic. 3. **Real device p0f fingerprint.** The proxy runs on actual 5G hardware, so TCP/IP stack [fingerprints](/tools/fingerprint-test) (TTL, window size, MSS) match a real mobile device. Datacenter VPNs leak Linux server fingerprints that platforms detect with passive OS fingerprinting. The combination of carrier-native DNS, real device fingerprint, and full UDP means the proxy is indistinguishable from a normal phone connection at every layer platforms inspect. ### VLESS Configuration for V2rayNG After importing the config and connecting, verify everything is clean. Run the [platform trust score tool](/tools/platform-trust-score) - it checks your IP type, fingerprint, WebRTC leaks, and location consistency in one pass. If the proxy is configured correctly, you'll see a mobile/residential IP classification, no WebRTC leak, and matching timezone/geolocation signals. For more on VLESS proxy configuration patterns and why the protocol handles geo-access better than standard VPNs, see [VLESS Xray Private Mobile Proxies: Undetected Geo Access](/blog/vless-xray-mobile-proxies-geo-access). ### Enabling the VPN Kill Switch After configuring V2rayNG, enable GrapheneOS's kill switch: **Settings > Network & internet > VPN > [V2rayNG] > Always-on VPN + Block connections without VPN.** All traffic now routes through the **GrapheneOS mobile proxy** with a carrier-grade IP. No leaks. ### Private DNS: Don't Override Your Carrier-Native DNS This is a detail most guides get wrong. If you've set Private DNS to Quad9 (`dns.quad9.net`) or Cloudflare (`1dot1dot1dot1.cloudflare-dns.com`) in **Settings > Network & internet > Private DNS**, it will override the carrier-native DNS that VoidMob's proxy provides. The result: your IP says T-Mobile but your DNS queries resolve through Cloudflare - a mismatch that sophisticated platforms detect and flag. [DNS resolution](https://www.cloudflare.com/learning/dns/what-is-dns/) is one of the first signals checked when platforms assess whether a connection is consistent with its claimed origin. When using VoidMob proxy in VPN mode, set Private DNS to **Off** or **Automatic**. This allows DNS queries to resolve through the carrier's own infrastructure, matching your IP's ASN perfectly. If you're not connected to the proxy (e.g., on trusted home wifi), you can switch Private DNS back to your preferred resolver. If you use separate GrapheneOS profiles with different proxy configs, each profile has its own Private DNS setting. Set it to Automatic in profiles that use VoidMob proxy, and to your preferred resolver in profiles that don't. --- ## Profile Compartmentalization With Separate Proxy IPs **GrapheneOS** supports multiple user profiles (Owner, Work, and additional user profiles), each sandboxed from the others. Apps and data cannot cross between profiles. This is where things get genuinely interesting for operational security. Each profile can have its own V2rayNG configuration pointing to a different VoidMob proxy IP. Owner profile gets a US mobile IP. Work profile gets a UK mobile IP. A third profile for sensitive accounts gets a rotating IP from a different region entirely. Traffic from each profile exits through a completely different carrier endpoint, so even if one profile is compromised or correlated, the others stay isolated. Setting this up is straightforward: install V2rayNG separately in each profile (GrapheneOS treats each profile as an independent Android user with its own app sandbox), import distinct VLESS configs, enable the VPN kill switch per-profile. On top of that, each profile can use separate VoidMob SMS numbers for verification. Profile A verifies with number X, Profile B with number Y. No cross-contamination between identities. GrapheneOS also offers **Private Space** - a newer feature that lets you lock and hide apps with separate VPN configurations directly in the app drawer, without full profile switching. Simpler for users who don't need complete profile isolation but want to compartmentalize a few sensitive apps behind a different proxy IP. The **End Session** function fully shuts down a profile when you're done, stopping all background processes and telemetry. The profile's data remains encrypted and inaccessible until you switch back to it and authenticate. --- ## Duress PIN, Auto-Reboot, and Border Crossing OPSEC ### Duress PIN and eSIM Wipe **GrapheneOS** supports a duress PIN - a secondary PIN/password that triggers a full device wipe when entered at the lock screen. When triggered, the device deletes decryption keys, shuts down, and presents as a factory-fresh device on next boot. Critically, **the wipe includes all installed eSIM profiles** - the number, the carrier association, and any session data are destroyed along with everything else. A softer approach exists though. Before crossing, delete the eSIM profile entirely (**Settings > Network & internet > SIMs > [eSIM] > Delete**). Now the phone presents as a clean device with no carrier connection, no call logs, no SMS history tied to a number. After crossing, re-scan the QR code from VoidMob's dashboard (accessible via any browser on any device) and re-provision in under 60 seconds. Same data plan, fully restored. No interaction with a carrier store. No ID check. Save the eSIM QR code to an encrypted Proton Drive or print it on paper stored separately from the device. If the phone is wiped at the border, the eSIM can be re-provisioned on a fresh GrapheneOS flash within minutes. ### Auto-Reboot: Clearing Memory Automatically GrapheneOS's auto-reboot feature (**Settings > Security & privacy > Exploit protection > Auto reboot**) automatically reboots the device after a configurable period of inactivity (recommended: 18-24 hours). After reboot, the device returns to a fully encrypted BFU (Before First Unlock) state - all user data, eSIM session tokens, decrypted keys, and cached credentials are purged from memory. This protects against forensic extraction tools that exploit data sitting in RAM on unlocked devices. Set it and forget it. If your phone sits overnight without being unlocked, it reboots into a state where even Cellebrite can't extract meaningful data without your PIN. ### MAC Randomization GrapheneOS randomizes your device's MAC address on every wifi connection by default. Combined with the VoidMob stack, this means: your device doesn't leak a persistent hardware identifier on networks (MAC randomization), your IP doesn't trace back to your identity (no-KYC eSIM + mobile proxy), and your phone verification doesn't link to your real number (non-VoIP SMS). Three layers of separation between your physical device and your digital footprint. The [EFF's privacy guidance](https://www.eff.org/deeplinks/2025/09/opt-out-october-daily-tips-protect-your-privacy-and-security) frames this kind of layered approach - identifier separation at hardware, network, and application layers - as the baseline for effective privacy hygiene. --- ## Troubleshooting Common Issues **eSIM won't activate after QR scan:** Reboot into safe mode and re-scan. Some Pixel firmware versions cache a failed provisioning attempt. Clearing the carrier services cache (**Settings > Apps > Show system > Carrier Services > Clear cache**) resolves this in most cases. Also confirm the eSIM support toggle is enabled at **Settings > Network & internet > eSIM support** - this is separate from the SIM management screen. **V2rayNG shows "failed to start" with VLESS config:** Check that the UUID and WebSocket path match exactly. A trailing slash in the path (`/vless/` vs `/vless`) will silently break the handshake. Also confirm the system clock is accurate - [TLS certificate validation](https://www.cloudflare.com/learning/ssl/transport-layer-security-tls/) fails with clock drift beyond approximately 90 seconds. Once connected, run the [platform trust score tool](/tools/platform-trust-score) to confirm your IP registers as mobile/residential and not datacenter. **"Block connections without VPN" kills eSIM data:** Expected behavior. That kill switch blocks ALL non-VPN traffic, including carrier data that isn't tunneled. V2rayNG needs to be set as the system VPN *before* enabling the toggle. If data drops, toggle airplane mode on/off to force a reconnection through the proxy. **DNS queries still resolving through Cloudflare/Google despite proxy:** Check Private DNS settings. If set to a specific provider hostname, it overrides the proxy's carrier-native DNS. Set to **Off** or **Automatic** when using VoidMob proxy in VPN mode. **SMS code never arrives:** Confirm the target platform isn't geo-restricting the number. Some services reject US numbers for non-US account creation. In those cases, request a number matching the account's region from the VoidMob SMS dashboard. --- ## FAQ --- ## Wrapping Up A proper **GrapheneOS setup** doesn't end at the OS layer. Carrier connectivity, SMS verification, and browsing through trusted IPs are what actually determine whether the phone works as a daily driver or just sits in a drawer looking secure. VoidMob consolidates all three into a single no-KYC dashboard with crypto payments and no app dependencies: eSIM, non-VoIP SMS, and mobile proxy. That's the full **GrapheneOS privacy** stack, from silicon to signal. For a deeper comparison of eSIM providers and how their routing affects your privacy posture, see [No-KYC eSIM Providers Compared 2026](/blog/no-kyc-esim-providers-compared-2026).

#Grapheneos

GrapheneOS Privacy Stack: eSIM + Proxy + SMS