GrapheneOS without Google: five addresses in 24 hours
We recorded all network traffic of a phone running GrapheneOS for 24 hours. Over the day, the system connected to five addresses. All of them belong to GrapheneOS servers.
How the traffic was recorded
The phone is a Pixel 9a with GrapheneOS 2026110700 (Android 17), one personal profile, no Google services. It was connected to a Wi-Fi access point on a separate computer that recorded every packet. The traffic is encrypted (TLS). The recording shows which server the phone exchanged data with, when, and how much, but not the content. Server names come from the TLS connection (SNI) and DNS responses. During the recording the phone was idle with the screen locked.
Where GrapheneOS connects
| Server | Purpose | Connections | Sent | Received |
|---|---|---|---|---|
connectivitycheck.grapheneos.network | internet connectivity check | 54 | 54 KB | 70 KB |
apps.grapheneos.org | GrapheneOS App Store | 8 | 155 KB | 14.7 MB |
releases.grapheneos.org | system updates | 3 | 3 KB | 19 KB |
time.grapheneos.org | precise time | 2 | 4 KB | 12 KB |
samsung.psds.grapheneos.org | satellite data for GPS | 1 | 3 KB | 80 KB |
In total, the phone sent about 220 KB over the day.
Connectivity check. The phone checks whether it has internet access. If it does not, the system switches to another available network. There were 24 checks over the day, each with requests over HTTPS and HTTP. There is no fixed interval between checks.
App Store. The GrapheneOS App Store checks for app updates and downloads them. During the recording the phone downloaded 14.7 MB from it.
System updates. The phone requested information about a new system version three times. Each request was about 6 KB. No update was downloaded that day.
Time. The phone synchronized its clock with the GrapheneOS server twice.
Satellite data. Once, the phone downloaded 80 KB of satellite orbit data. With it, GPS determines the location faster.
Comparison with the documentation
GrapheneOS publishes a list of connections the system makes by default and calls it exhaustive. All five addresses from the recording are on this list. The documentation describes the system update check as a request approximately every six hours. The recording shows three such checks over the day.
Some connections from the list did not occur during the day: updates to Vanadium browser components, release notes in the Info app, the fallback connectivity check, hardware attestation key provisioning, Certificate Transparency log lists and the DNS-over-TLS check.
Background connections
A phone with a locked screen keeps working: the system checks connectivity, synchronizes the time and asks about updates. Over a day of idling, GrapheneOS opened 68 connections, each with a purpose from the published list. Network activity was recorded in 15 of 24 hours, and the longest pause lasted 4 hours 18 minutes.
For comparison, we recorded a day of idling on two more phones. GrapheneOS with sandboxed Google Play opened 247 connections to Google services, not counting advertising and analytics inside third-party apps. A Samsung Galaxy S23 with Chinese firmware and Google services opened 306 connections to the manufacturer and to services built into the firmware.