ARTICLE DOSSIER

How to flash a hardened operating system and pair it with a no-KYC eSIM for a fully private phone.

GUIDESHARDWARE
REVIEW2026-03-27
DATE2025-11-01
READ~8 min read

Setting Up a Ghost Phone

GuidesHardwareNovember 2025~8 min read

Snapshot

GrapheneOS
RECOMMENDED OS
Only hardened Android with verified boot
Pixel 6+
DEVICE
Only hardware supporting GrapheneOS verified boot
~$10–30
ESIM COST
Silent.link anonymous eSIM, paid in BTC
Sandboxed
GOOGLE SERVICES
Optional. Runs in an isolated container with no system access

Key points

  • A ghost phone has zero connection to your legal identity. No carrier contract, no Google or Apple account, no payment trail.
  • GrapheneOS is the only mobile OS with verified boot, sandboxed Google Play, and per-app controls worth trusting.
  • Buy the hardware with cash. Flash the OS yourself. Install an anonymous eSIM. Do not mix it with your real identity.

Practical steps

1
Buy a Pixel with cash. Google Pixel phones are the only devices that support GrapheneOS with full verified boot. Buy from a physical store. No online orders, no loyalty cards, no trade-ins. The Pixel 8a is the best balance of price and security in 2026. Avoid carrier-locked models.
2
Flash GrapheneOS. Use the web installer from a separate computer. It wipes stock Android and installs GrapheneOS with verified boot. On each boot, the bootloader checks that the OS was not modified. This is the foundation, not an extra.
3
Anonymous eSIM. Silent.link sells eSIMs you can buy with Bitcoin. No name, no email, no registration. Activate over TorThe Tor network uses onion routing to obscure IP addresses and browsing paths by relaying traffic through multiple volunteer-run nodes.Glossary → or VPNA virtual private network encrypts traffic between your device and a provider-run server, hiding activity from local networks while shifting trust to the VPN operator.Glossary →. For a higher threat model, use a prepaid SIM bought with cash away from home.
4
Encrypted communications. Install Signal (needs a phone number, so use the anonymous SIM), SimpleX (no phone number), or Briar (peer to peer, works offline over Bluetooth or Wi-Fi). For VPN, use Mullvad and pay with Monero.
5
Maintain separation. The ghost phone fails if you log into real accounts, connect to home Wi-Fi, or carry it next to your daily phone. Cell data can link the two. Treat it as a separate device and a separate identity.

Frequently Asked Questions

What is a ghost phone?

A ghost phone is a phone running a hardened, de-Googled OS with an anonymous eSIM or prepaid SIM. It is not tied to your legal identity. No Google account, no Apple ID, no carrier contract. It should use encrypted messengers and route traffic through Tor or a VPN.

Which phone should I buy for a ghost phone?

Buy a Google Pixel 6 or newer. Those are the only phones that support GrapheneOS with verified boot. Pay cash in a physical store and avoid carrier-locked models. The Pixel 8a is a strong value pick.

Can I still use apps on a ghost phone?

Yes. GrapheneOS supports sandboxed Google Play Services, so most apps still work without giving Google system access. You can also use Aurora Store to download many apps without a Google account.

← PreviousThe Lobby and the Law: How Pro-Israel Groups Silence Political SpeechNext →PGP Basics: Encrypt Messages Without a Central Server

Related