android_comparison.htm

<!DOCTYPE html>
<html>
<head>
<title>Comparison of Android-based Operating Systems</title>
<meta name="description" content="Comparison of Android-based Operating Systems">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta charset="UTF-8">
<meta name="keywords" content="Technology, Browsers, Firefox, Chrome, Edge, Safari, Brave, Vivaldi, Operating Systems, Desktop Environments, GNOME, KDE, Xfce, Linux, Unix, BSD, Solaris, Windows, macOS, Instant Messengers, Chat, Software, Cloud, Sync, Email, Privacy">
<meta name="author" content="Alphonse Eylenburg">
<link rel="stylesheet" href="style.css">
<style>
:root {
--legendwidth: 280px;
--distrowidth: 268px;
}

table.comparison {
margin-top: 1em;
text-align: center;
border: none;
table-layout: fixed;
font-size: small;
width: calc(var(--legendwidth) + 6 * var(--distrowidth));
height: 100%;
}

table.comparison tr td:nth-child(2) {
border-left: 1px dotted lightgrey;
}

table.appendix {
text-align: center;
table-layout: fixed;
width: 100%;
font-size: small;
}

table.appendix td {
border: 1px solid #ddd;
overflow-wrap: break-word;
width: 25%;
}

table.appendix td:first-child {
text-align: left;
}

table.appendix thead {
position: sticky;
position: -webkit-sticky;
top: 0px;
z-index: 10;
font-size: small;
}

thead { 
border: none;
position: sticky; 
position: -webkit-sticky;
top: 0px;
z-index: 10;
font-size: large;
}

thead tr td {
background-color: white;
font-weight: bold;
}
    
@media (prefers-color-scheme: dark) {
thead tr td, .legend {background-color: #222 !important; color: white;  }
}

td {
border: none;
padding: 0px;
vertical-align: top;
overflow-wrap: break-word;
hyphens: auto;
}

td img {
padding: 15px 0px;
}

.semititle {
text-decoration: underline;
font-weight: bold;
vertical-align: bottom; }

.legend {
text-align: left;
white-space: nowrap;
padding-right: 5px;
background-color: white;
}

.center {
text-align: center;
}

.tooltip {
text-decoration: underline;
text-decoration-style: dotted;
text-decoration-color: darkred;
z-index: 99999;
}

.tooltip .tooltiptext {
visibility: hidden;
background-color: black;
color: #fff;
text-align: center;
border-radius: 6px;
padding: 5px 5px;
position: absolute;
}

.tooltip:hover .tooltiptext {
visibility: visible;
font-weight: normal;
}

.green {
background-color: #CEE6BB;
}

.lgreen {
background-color: #E7F2DD;
}

.yellow {
background-color: #E7DEB1;
}

.lred {
background-color: #F5E0D6;
}

.red {
background-color: #EBC1AD;
}

.blue {
background-color: aliceblue;
}

img.logo {
max-width: 150px;
max-height: 75px;
}

td.green,
td.lgreen,
td.red,
td.lred,
td.yellow,
td.blue,
td.line {
border-top: 1px solid ivory;
border-bottom: 1px solid ivory;
}

@media (prefers-color-scheme: dark) {
td.green, td.lgreen, td.red, td.lred, td.yellow, td.blue { color: black;  }
}

@media (min-width: 578px){
  .legend {
  position: -webkit-sticky;
  position: sticky;
  left: 0;
  }
}

sup {
font-size: x-small;
}
</style>

<body>


<script src="top.js"></script>
<header>
<p><a href="index.html">&larr; Sitemap</a></p>
</header>



<h1>Comparison of Android-based Operating Systems</h1>

<p>This is a comparison of popular Android "ROMs" (better term: AOSP distributions or Android-based OS). Please note I'm not affiliated with any of these projects and I am not giving any specific recommendation. If you think anything is factually incorrect, please let me know.</p>

<p>DivestOS was originally included in this comparison but it was discontinued at the end of 2024. <a href="old/android_comparison_2024old.htm"><strong>For an older version of this comparison which includes DivestOS, please see here.</a></strong></p>

  
<h2 class="center">Comparison of Android-based Operating Systems</h2>
<p class="center">Source: eylenburg.github.io</p>
<p class="center" style="color: red; font-size: small;">Last updated: 28 February 2025</p>

<table class="comparison">

<colgroup>
<col style="text-align: left; white-space: nowrap; padding-right: 5px; width: var(--legendwidth);"> <!-- legend -->
<col style="border-left: double; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">


<thead>
<tr>
<td class="legend"></td>
<td>GrapheneOS</td>
<td>CalyxOS</td>
<td>IodéOS</td>
<td>/e/</td>
<td>LineageOS</td>
<td>"Stock" Android</td>
</tr>
</thead>

<tbody>

<tr>
<td class="legend"></td>
<td><img class="logo" src="pics/logos/android/grapheneos.svg" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/calyxos.jpg" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/iodeos.png" /></td>
<td><img class="logo" src="pics/logos/android/eos.png" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/lineageos.png" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/android.svg" /></td>
</tr>

<tr>
<td class="legend">Based on</td>
<td>AOSP</td>
<td>AOSP</td>
<td>LineageOS</td>
<td>LineageOS</td>
<td>AOSP</td>
<td>AOSP</td>
</tr>

<tr>
<td class="legend semititle"><br />Freedom</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>

<tr>
<td class="legend">Free and open source (FOSS)?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Deblobbed?</td>
<td class="lgreen">Yes, significantly</td>
<td class="lgreen">Yes, significantly</td>
<td class="yellow">Yes, minimal</td>
<td class="yellow">Yes, minimal</td>
<td class="yellow">Yes, minimal</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend semititle"><br />Features</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>

<tr>
<td class="legend tooltip">Network controls for apps<span class="tooltiptext">The controls on LineageOS-based operating systems are leaky as their approach only disabled direct network access (socket) but doesn't disable indirect access via the INTERNET permission, which provides multiple ways of bypassing them not requiring collusion between apps. This functionality is regularly used by apps with no malicious intent. Collusion between apps is an issue for all kinds of granted access, permissions, etc. and not specific to the INTERNET permission. If INTERNET permission is not blocked though, no collusion is required.</span></td>
<td class="green">Direct and indirect access</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Network-based location (without GNSS)</td>
<td class="green tooltip">Emulated <sup>default</sup>, or Play Services<span class="tooltiptext">Emulated by default (redirect to GNSS-based location), can use sandboxed Google Play via toggles when installed</span></td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td class="red">No</td>
<td class="green">Play Services</td>
</tr>

<tr>
<td class="legend">System-wide connection/tracker blocking</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">iode-snort app, Private DNS, or VPN</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
</tr>

<tr>
<td class="legend">E2E-encrypted phone backups</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="yellow">Yes, but requires Google login</td>
</tr>

<tr>
<td class="legend">Notification forwarding from other user profiles</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Duress PIN (to wipe device)</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#duress" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Android Auto compatible</td>
<td class="green tooltip">Yes (<strong>sandboxed</strong>), <a href="https://grapheneos.org/usage#android-auto" target="_blank">see here</a><span class="tooltiptext">GrapheneOS has permission toggles to enable the user to provide the least amount of permissions necessary (e.g. wired Android Auto requires only USB access).</span></td>
<td class="red">No</td>
<td class="green">Yes, <a href="https://blog.iode.tech/use-android-auto-with-iodeos/" target="_blank">see here</a></td>
<td class="green">Yes, <a href="https://doc.e.foundation/support-topics/android-auto" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="green">Yes</td>
</tr>

<tr>
<td class="legend">Google Pay compatible</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="green">Yes</td>
</tr>

<tr>
<td class="legend">Call recording</td>
<td class="green">Yes</td>
<td class="yellow">Only in selected regions, <a href="https://github.com/LineageOS/android_packages_apps_Dialer/blob/lineage-20.0/java/com/android/dialer/callrecord/res/xml/call_record_states.xml" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Only in selected regions, <a href="https://github.com/LineageOS/android_packages_apps_Dialer/blob/lineage-20.0/java/com/android/dialer/callrecord/res/xml/call_record_states.xml" target="_blank">see here</a></td>
<td class="yellow">Depends on regions and manufacturer</td>
</tr>


<tr>
<td class="legend semititle"><br />Degoogling (connections to Google)
<span class="tooltip"><span style-" style="font-size: 50%; color: blue;">COLOURS</span><span class="tooltiptext">LOGIC FOR COLOUR SCHEME:
<br /><br />
RED<br />
- connects to Google, no opt-out
<br /><br />
LIGHT RED<br />
- connects to Google by default but function can be turned off (no option of using another provider)
<br /><br />
YELLOW<br />
- function is off by default but can connect to Google if needed (no option of using another provider)
<br /><br />
LIGHT GREEN<br />
- connects to Google by default but can be changed to another provider
<br /><br />
GREEN<br />
- does not connect to Google by default but instead connects to the developer of the operating system (no third party needs to be trusted)<br />
- multiple providers offered and user can decide<br />
- no data shared with any provider
<br /><br />
BLUE<br />
- does not connect to Google by default but instead connects to another (non-Google) third party provider
<br /><br />
WHITE<br />
- function is not supported</span></span></td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>

<tr>
<td class="legend">eSIM activation</td>
<td class="green tooltip">Google eUICC w/o data sharing<span class="tooltiptext">Disabled by default. Unlike the regular Google eUICC management app, it doesn't require Google Play and cannot share data with it. It doesn't communicate with Google servers unless the carrier is hosting with them, which would involve using their servers regardless.</span></td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
</tr>

<tr>
<td class="legend">Provider for network-based location</td>
<td class="green tooltip">Emulated/GNSS <sup>default</sup>, or Google<span class="tooltiptext">Emulated by default (redirect to GNSS-based location), can use sandboxed Google Play via toggles when installed</span></td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td>n/a</td>
<td class="red">Google</td>
</tr>

<tr>
<td class="legend">SUPL (for Assisted GNSS)</td>
<td class="green">GrapheneOS <sup>default</sup>, Google or none</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or Google</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="red">Google</td>
</tr>

<tr>
<td class="legend tooltip">PSDS/XTRA <span style="font-size: 75%;">("Standard" depends on GPS chipset)</span><span class="tooltiptext">The standard server used depends on the GPS chipset, which is usually Qualcomm, Broadcom, or Samsung, or in the case of Tensor chips (Google Pixel 6 and later) they connect to a Google server. Some ROMs override these settings.<br /><a href="https://web.archive.org/web/20250111112822/https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, <span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device. At the moment, only Google Pixels are supported by GrapheneOS, for which the standard connection is Google (since the Pixel 6)</span></span>, or none</td>
<td class="blue"><span class="tooltip">Standard (excl. Google)<span class="tooltiptext">Broadcom / Qualcomm / Samsung depending on the device, for Google Pixel 6 and later (Tensor chip) the standard connection to Google is replaced with a connection to Broadcom instead <a href="https://www.kuketz-blog.de/calyxos-de-googled-geht-anders-custom-roms-teil2/" target="_blank">(source)</a></span></span> <sup>default</sup>, or none</td>
<td class="blue"><span class="tooltip">Standard (excl. Google)<span class="tooltiptext">Broadcom / Qualcomm / Samsung depending on the device, for Google Pixel 6 and later (Tensor chip) the standard connection to Google is replaced with a connection to Broadcom instead <a href="https://www.kuketz-blog.de/iodeos-datenschutzfreundlich-aber-abstriche-bei-der-sicherheit-custom-roms-teil3/" target="_blank">(source)</a></span></span> <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or <span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device</span></span></td>
<td class="lred"><span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device</span></span> <sup>default</sup>, or none</td>
<td class="red"><span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device</span></span></td>
</tr>

<!--
<tr>
<td class="legend tooltip">PSDS - Google Pixel 6 and later (Tensor SoC)<span class="tooltiptext">The default server used depends on the GPS chipset, e.g. phones with Qualcomm chips (e.g. Snapdragon) connect to a Qualcomm server, while newer Google Pixels with Tensor chips connect to a Google server, and other phones with Broadcom GPS (e.g. Exynos) connect to a Broadcom server. Some ROMs override these settings. <br /><a href="https://web.archive.org/web/20250111112822/https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, Google, or none</td>
<td class="blue">Broadcom <sup>default</sup>, or none</td>
<td class="blue">Broadcom <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or Google</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="red">Google</td>
</tr>

<tr>
<td class="legend tooltip">PSDS - other phones (no Tensor SoC)<span class="tooltiptext">The default server used depends on the GPS chipset, e.g. phones with Qualcomm chips (e.g. Snapdragon) connect to a Qualcomm server, while newer Google Pixels with Tensor chips connect to a Google server, and other phones with Broadcom GPS (e.g. Exynos) connect to a Broadcom server. Some ROMs override these settings. <br /><a href="https://web.archive.org/web/20250111112822/https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, Standard (Qualcomm/Broadcom/Samsung), or none</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung) <sup>default</sup>, or none</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung) <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or Standard (Qualcomm/Broadcom/Samsung)</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung) <sup>default</sup>, or none</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung)</td>
</tr>
-->

<tr>
<td class="legend">Connectivity check/captive portal</td>
<td class="green">GrapheneOS <sup>default</sup>, Google, or none</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="blue"><span class="tooltip">Kuketz.de (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="green"><span class="tooltip">Murena.io (related to /e/) (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
</tr>

<tr>
<td class="legend">DNS connectivity check</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>

<tr>
<td class="legend">DNS server fallback</td>
<td class="blue">Cloudflare</td>
<td class="blue">Cloudflare</td>
<td class="blue">Quad9</td>
<td class="blue">Quad9</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>

<tr>
<td class="legend">Network time</td>
<td class="green">GrapheneOS <sup>default</sup>, or none</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> &amp; carrier</td>
<td class="blue"><span class="tooltip">NTP.org (can be changed)<span class="tooltiptext">Server pool with arbitrary providers, which can include Google-hosted servers or even malicious servers. NTP server can be changed with `adb` command.</span></span> &amp; carrier</td>
<td class="blue"><span class="tooltip">NTP.org (can be changed)<span class="tooltiptext">Server pool with arbitrary providers, which can include Google-hosted servers or even malicious servers. NTP server can be changed with `adb` command.</span></span> &amp; carrier</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> &amp; carrier</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> &amp; carrier</td>
</tr>

<tr>
<td class="legend">Hardware attestation provisioning</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>

<tr>
<td class="legend">DRM (Widevine) provisioning</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>


<tr>
<td class="legend semititle"><br />Google Play Services</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>

<tr>
<td class="legend">Implementation</td>
<td class="tooltip">GmsCompat (sandboxed Google Play)<span class="tooltiptext">GrapheneOS does not include Google Play as a preinstalled app, but it includes an open source compatibility layer for users who choose to use it. Users can alternatively install microG on GrapheneOS, albeit GrapheneOS does not support signature spoofing. Not all microG functionality requires signature spoofing, for example FCM works with microG without signatures spoofing to the extent it works without special privileges (e.g. microG needs to use a privileged API to wake apps and keep them awake for a short period of time to handle FCM messages).</span></td>
<td>microG</td>
<td>microG</td>
<td>microG</td>
<td rowspan="8">None by default. It's possible to install microG manually (LineageOS <a href="https://review.lineageos.org/c/LineageOS/android_frameworks_base/+/383574" target="_blank">supports signature spoofing for microG</a> since 2024). Alternatively, there are <a href="https://lineage.microg.org/" target="_blank">ROMs with microG preinstalled</a> or one can <a href="https://wiki.lineageos.org/gapps" target="_blank">add Google apps</a> during the installation process, but this is not officially supported by LineageOS. <!--Alternatively, there is the <a href="https://lineage.microg.org/" target="_blank">LineageOS for microG</a> project that integrates microG in LineageOS.</td>-->
<td>Google Play Services</td>
</tr>

<tr>
<td class="legend">Optional?</td>
<td class="green">Yes (not preinstalled)</td>
<td class="green">Yes (preinstalled but opt-out)</td>
<td class="green">Yes (preinstalled but opt-out)</td>
<td class="red">No (preinstalled without opt-out)</td>
<!-- skipped -->
<td class="red">No (preinstalled without opt-out)</td>
</tr>

<tr>
<td class="legend">Runs in standard app sandbox?</td>
<td class="green">Yes</td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<!-- skipped -->
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
</tr>

<tr>
<td class="legend">Can be limited to user or work profile?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td>? (TBC)</td>
<td>? (TBC)</td>
<!-- skipped -->
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Signature spoofing needed/allowed?</td>
<td class="green">No</td>
<td class="lgreen">Only for Google signature</td>
<td class="lgreen">Only for Google signature</td>
<td class="lgreen">Only for Google signature</td>
<!-- skipped -->
<td class="green">No</td>
</tr>

<tr>
<td class="legend">Push notifications via Google FCM?</td>
<td class="green">Yes</td>
<td class="green">Optional</td>
<td class="green">Optional</td>
<td class="green">Optional</td>
<!-- skipped -->
<td class="green">Yes</td>
</tr>

<tr>
<td class="legend">Google Play Integrity?</td>
<td class="lgreen tooltip">Passes Basic Integrity only, <a href="https://grapheneos.org/usage#banking-apps" target="_blank">see here</a><span class="tooltiptext">Passes MEETS_BASIC_INTEGRITY but not MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY which require a certification from Google.</td>
<td class="lgreen tooltip">Passes Basic Integrity only<span class="tooltiptext">microG v0.3.6.244735, which is part of CalyxOS since 2024-12-31, passes MEETS_BASIC_INTEGRITY but not MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY which require a certification from Google.</td>
<td class="lred tooltip">No but basic integrity expected soon<span class="tooltiptext">microG v0.3.6.244735, released on 2024-12-23, passes MEETS_BASIC_INTEGRITY, but the latest release of IodeOS was on 2024-12-18. This needs to be updated once microG is updated in IodeOS.</td>
<td class="lred tooltip">No but basic integrity expected soon<span class="tooltiptext">microG v0.3.6.244735, released on 2024-12-23, passes MEETS_BASIC_INTEGRITY, but the latest release of /e/ was on 2024-12-17. This needs to be updated once microG is updated in /e/.</td>
<!-- skipped -->
<td class="green">Yes</td>
</tr>

<tr>
<td class="legend semititle"><br />Privacy</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>

<tr>
<td class="legend">Storage scopes</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#storage-scopes" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Contact scopes</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#contact-scopes" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Per-app sensor controls</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#sensors-permission-toggle" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Per-connection DHCP state flushing</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">MAC address randomization</td>
<td class="green">Per connection, <a href="https://grapheneos.org/features#wifi-privacy" target="_blank">see here</a></td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
</tr>

<tr>
<td class="legend">SUPL: IMSI or phone number sent?</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="red">Yes</td>
</tr>

<tr>
<td class="legend tooltip">Qualcomm XTRA: user agent sent?<span class="tooltiptext">Only relevant for phones with Qualcomm GPS chips. Doesn't apply to Broadcom or Samsung. May include chipset serial number, device manufacturer and model, carrier, and Android version. <a href="https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">No</td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="lred">for Qualcomm GPS chips</td>
</tr>

<tr>
<td class="legend">Closed cross-profile package leaks?</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Closed device identifier leaks?</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#closed-device-identifier-leaks" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Metadata stripping for screenshots</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#private-screenshots" target="_blank">see here </a></td>
<td class="green">Yes, <a href="https://calyxos.org/news/2023/10/04/october-security-update/" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">EXIF metadata stripping for photos</td>
<td class="green">Yes, <a href="https://grapheneos.org/usage#grapheneos-camera-app" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Available as option</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Location tagging for photos</td>
<td class="green">Opt-in</td>
<td class="green">Opt-in, <a href=https://calyxos.org/docs/guide/security/location/#exif-metadata" target="_blank">see here for more info</a></td>
<td class="green">Opt-in</td>
<td class="green">Opt-in</td>
<td class="green">Opt-in</td>
<td class="lgreen">Opt-out</td>
</tr>

<tr>
<td class="legend">Tracking through Android Advertising ID?</td>
<td class="green tooltip">Not part of the system<span class="tooltiptext">if Play Services are installed by the user, the Advertising ID can be deleted in settings</span></td>
<td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td>
<td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td><td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td>
<td class="green tooltip">Not part of the system<span class="tooltiptext">if microG is installed by the user, it will generate a random Advertising ID for each request; if Play Services are installed by the user, the Advertising ID can be deleted in settings</span></td>
<td class="lgreen">Yes, but can be deleted in settings</td>
</tr>



<tr>
<td class="legend semititle"><br />Security</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>

<tr>
<td class="legend">Verified boot (if supported by device)?</td>
<td class="green">Yes, incl. system app updates</td>
<td class="yellow">Yes, but excl. system app updates</td>
<td class="yellow">Yes, but excl. system app updates</td>
<td class="lred">w/ test keys; excl. system app updates</td>
<td class="red">No</td>
<td class="yellow">Yes, but excl. system app updates</td>
</tr>

<tr>
<td class="legend">Hardware-based security verification</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#auditor" target="_blank"> see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Some devices, <a href="https://attestation.app/about" target="_blank">see here</a></td>
</tr>

<tr>
<td class="legend">System app downgrade protection</td>
<td class="green">For updates and boot, with fs-verity</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
</tr>

<tr>
<td class="legend">Secure application spawning?</td>
<td class="green">Yes (exec)</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Hardened memory allocator?</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Hardware memory tagging?</td>
<td class="green">Yes, if supported by device</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Hardened kernel?</td>
<td class="green">Yes, highest</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Hardened libc?</td>
<td class="green">Yes, highest</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Hardened webview?</td>
<td class="green">Yes (Vanadium)</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Hardened SELinux policy?</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Android Runtime <span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> compilation/profiling</td>
<td class="green"><span class="tooltip">AOT<span class="tooltiptext">Ahead-Of-Time</span></span> compilation w/o profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
</tr>

<tr>
<td class="legend tooltip">Dynamic code loading prevention for apps<span class="tooltiptext"><a href="https://github.com/eylenburg/eylenburg.github.io/issues/85" target="_blank" style="color: white;">see here for details</a></span></td>
<td class="green">System, opt-in for non-system apps</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
</tr>

<tr>
<td class="legend">Additional hardening</td>
<td class="green">Yes, <a href="https://grapheneos.org/features" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend">Secure TLS for SUPL?</td>
<td class="green">TLSv1.2</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
</tr>

<tr>
<td class="legend">Fallback DNS server with DNSSEC?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red tooltip">No<span class="tooltiptext">uses Quad9's unsecured endpoint (9.9.9.10) with provides no security blacklist and no DNSSEC</span></td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
</tr>

<tr>
<td class="legend">Secure connection to network time server?</td>
<td class="green">HTTPS via GrapheneOS server</td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
</tr>

<tr>
<td class="legend tooltip">Can disable USB-C and pogo pins data?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green">Default (while locked), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend tooltip">Can disable USB-C charging?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green">Opt-in (after boot), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>


<tr>
<td class="legend tooltip">Can disable USB connections?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green tooltip">Default (while locked), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a><span class="tooltiptext">Hardware and software</span></td>
<td class="lgreen tooltip">Default (while locked), software only<span class="tooltiptext">Incomplete implementation. Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections. The mode for disabling USB connections while locked continues allowing new connections until existing connections end, including a connection through another method such as a pogo pins USB connection to a stand.</span></td>
<td class="lred"><em>? (TBC - like Lineage or stock?)</em></td>
<td class="lred"><em>? (TBC - like Lineage or stock?)</em></td>
<td class="yellow tooltip">Opt-in, software only<span class="tooltiptext">Incomplete implementation. Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections. The mode for disabling USB connections while locked continues allowing new connections until existing connections end, including a connection through another method such as a pogo pins USB connection to a stand.</span></td>
<td class="lred tooltip">Device admin API<span class="tooltiptext">Requires installing a device admin app like Sentry. Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections.</span></td>
</tr>

<tr>
<td class="legend">Auto-reboot timer for locked devices</td>
<td class="green">Yes</td>
<td class="yellow tooltip">Yes, with flaws (no proper BFU state)<span class="tooltiptext">CalyxOS has a disabled-by-default port of an older GrapheneOS implementation of the auto-reboot feature, which was determined to not be as robust due to being able to bypass it by crashing `system_server`. It also lacks the memory clearing required to get the device properly back at rest for reboots. Therefore it can't return the device to a proper BFU (before first unlock) state like the GrapheneOS and iOS implementations.</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend tooltip">2-factor fingerprint unlock</td>
<td class="green">Yes (fingerprint + PIN), <a href="https://discuss.grapheneos.org/d/18585-2-factor-fingerprint-unlock-feature-is-now-fully-implemented" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>

<tr>
<td class="legend semititle"><br />Updates</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>

<tr>
<td class="legend tooltip">Security update speed (AOSP subset of ASB)<span class="tooltiptext" style="width: 550px; display: inline; white-space: pre-wrap;">It doesn't include information on how the device-related patches in the 2nd half of each ASB (Android Security Bulletin) get shipped, if they do at all. It's also missing the fact that full security patches require the latest monthly/quarterly/yearly updates. Additionally, you need to keep up with the vendor's releases which means falling behind on quarterly or yearly releases results in missing many of the High/Critical severity patches for Pixels or another device launching the new quarterly/yearly version in a reasonable time. The issue is that this heavily varies by device. Pixels require the alternate OS to always keep up to ship updates. Some other device ship yearly updates quickly too. Devices not shipping the latest OS release make it harder for the alternate OS to do it but it is possible, especially if they don't build the vendor image, etc. If the vendor doesn't ship the releases, then the firmware/driver code used from them will be missing the patches. For example, Fairphone is consistently 1 or 2 months behind on the Android Security Bulletin patches so CalyxOS, LineageOS, etc. on it is at least that far behind at all times for the non-AOSP half of the ASB. This is one of the reasons why GrapheneOS currently only supports Google Pixel devices. Every other OEM doesn't ship the monthly/quarterly updates and typically has major delays for yearly updates. Most also do a bad job shipping the backported patches.<br /><a href="https://divestos.org/misc/a-dates.txt" target="_blank" style="color: white;">Click here for update speed data</a></span></td>
<td class="green">Usually same day</td>
<td class="lgreen">Days to weeks</td>
<td class="yellow">2-4 weeks, sometimes longer</td>
<td class="lred">1-2 months, sometimes longer</td>
<td class="lgreen">1-2 weeks, sometimes longer</td>
<td>Depends on phone vendor</td>
</tr>

<tr>
<td class="legend tooltip">Full patches on fully supported devices<span class="tooltiptext">Requires 1. being on the latest OS release (as Android doesn't backport all security patches), 2. shipping all the vendor code</span></td>
<td class="green">Several days</td>
<td class="lgreen">Weeks to months</td>
<td class="yellow">Several to many months</td>
<td class="lred">Many months to over a year</td>
<td class="yellow">Several to many months</td>
<td>Depends on phone vendor</td>
</tr>

<tr>
<td class="legend tooltip">Partial security updates (ASB) after EoL date<span class="tooltiptext">missing most driver and firmware patches after the phone's end of life date</span></td>
<td class="lgreen tooltip">until 5 years from launch<span class="tooltiptext">e.g. 2 years of extended support for 4th and 5th generation Pixels</span></td>
<td class="lgreen">1-3 years</td>
<td class="green">Several years</td>
<td class="green">Several years</td>
<td class="green">Several years</td>
<td class="red">By definition: No</td>
</tr>

<tr>
<td class="legend tooltip">Number of Android versions supported<span class="tooltiptext" style="width: 550px; display: inline; white-space: pre-wrap;">Only the latest major release of AOSP has full security patches. Most privacy fixes are in fact only included for the new OS versions, not in the security patches. The ASB patches patches rarely include fixes for permission model / sandbox flaws resulting in privacy leaks since they're given Moderate severity and often require invasive changes including potential compatibility breaks.</span></td>
<td>Usually 1 Android version</td>
<td>Usually 1 Android version</td>
<td>Usually 1 Android version</td>
<td>2-3 Android versions</td>
<td>Usually 3 Android versions</td>
<td>Usually 3 Android versions</td>
</tr>

<tr>
<td class="legend tooltip">Webview update speed<span class="tooltiptext"><a href="https://divestos.org/misc/ch-dates.txt" target="_blank" style="color: white;">Click here for details</a></span></td>
<td class="green"><2 days</td>
<td class="yellow"><1 week, sometimes longer delays</td>
<td class="yellow"><2 weeks</td>
<td class="red">Several weeks/months</td>
<td class="yellow"><2 weeks</td>
<td>Depends on phone vendor</td>
</tr>


<tr>
<td class="legend semititle"><br />Supported devices</td>
<td style="vertical-align: bottom;"><a href="https://grapheneos.org/faq#future-devices" target="_blank">Hardware requirements</a></td><td style="vertical-align: bottom;"><a href="https://calyxos.org/docs/guide/device-support/#preferences-for-supporting-a-new-device" target="_blank">Hardware requirements</a></td><td></td><td></td><td></td><td></td>
</tr>

<tr>
<td class="legend">Asus*</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Older devices only</td>
<td class="yellow">Older devices only</td>
<td class="green">Yes (ZenUI)</td>
</tr>

<tr>
<td class="legend">Fairphone</td>
<td class="red">No</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
</tr>

<tr>
<td class="legend">Google</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
</tr>

<tr>
<td class="legend">Motorola</td>
<td class="red">No</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
</tr>

<tr>
<td class="legend">Oneplus</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="green">Yes</td>
<td class="yellow">Older devices only</td>
<td class="green">Yes</td>
<td class="green">Yes (OxygenOS)</td>
</tr>

<tr>
<td class="legend">Samsung*</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Older devices only</td>
<td class="yellow">Older devices only</td>
<td class="yellow">Older devices only</td>
<td class="green">Yes (OneUI)</td>
</tr>

<tr>
<td class="legend">Sony</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="green">Yes</td>
<td class="yellow">Older devices only</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
</tr>

<tr>
<td class="legend">Xiaomi</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Older devices only</td>
<td class="yellow">Older devices only</td>
<td class="green">Yes</td>
<td class="green">Yes (HyperOS)</td>
</tr>

<tr>
<td class="legend" style="text-align: right; font-style: italic;">* these manufacturers don't support bootloader unlocking anymore for all or most of their new devices. "Older devices only" = no devices released since 2023.</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>

</tbody>
</table>

<h3>Appendix: using different profiles in Android</h3>
<p>It is possible to use different profiles to separate apps, files and other data from each other. From least to most separate from the main user profile, the options are: work profile, private space (since Android 15), and secondary users. Below is a comparison how they differ:</p>

<table class="appendix">
<thead>
<tr><td></td><td style="font-weight: bold;">Work profile (with Shelter)</td><td style="font-weight: bold;">Private space</td><td style="font-weight: bold;">Secondary user profiles</td></tr>
</thead>

<tr><td colspan="4" style="text-decoration: underline;"><br />Privacy &amp; data access</td></tr>
<tr><td>File access</td><td colspan="3">Separate</td></tr>
<tr><td>Contact access</td><td colspan="3">Separate</td></tr>
<tr><td>Calendar storage</td><td colspan="3">Separate</td></tr>
<tr><td>Clipboard</td><td colspan="2">Shared with main profile</td><td>Separate</td></tr>
<tr><td>VPN connections</td><td colspan="3">Separate</td></tr>
<tr><td>Saved WiFi &amp; Bluetooth connections</td><td colspan="3">Shared with main profile</td></tr>
<tr><td>Private DNS (in settings)</td><td colspan="3">Shared with main profile</td></tr>
<tr><td class="tooltip">System settings<span class="tooltiptext">including basic settings such as gestures vs buttons, light vs dark mode, sound etc.</span></td><td colspan="2">Mostly shared with main profile</td><td>Completely separate</td></tr>
<tr><td>Call and SMS history</td><td colspan="2">Cannot access calls & SMS</td><td>Optional access ("turn on phone calls &amp; SMS")</td></tr>
<tr><td>Communication with other apps</td><td colspan="3">Limited to other apps in same profile</td></tr>
<tr><td>See which other apps are installed</td><td colspan="3">Limited to other apps in same profile</td></tr>

<tr><td colspan="4" style="text-decoration: underline;"><br />Convenience</td></tr>
<tr><td>Profile can run in background?</td><td colspan="3">Yes</td></tr>
<tr><td>Profile can auto-start after reboot?</td><td>Yes</td><td colspan="2">No (need to unlock profile first)</td></tr>
<tr><td>Clone apps from/to main profile</td><td>Yes, both ways (via Shelter)</td><td>No</td><td>GrapheneOS only, from main to secondary</td></tr>
<tr><td>Can use biometrics in apps?</td><td>Yes</td><td colspan="2">Only if separate biometrics are set up for this profile</td></tr>

<tr><td colspan="4" style="text-decoration: underline;"><br />Integration with main profile</td></tr>
<tr><td>Quick switch between apps from different profiles?</td><td colspan="2">Yes, apps appear in main profile's recent app list</td><td>No, need to switch active user</td></tr>
<tr><td>Integration in file manager as storage location</td><td>Yes (via Shelter)</td><td colspan="2">No</td></tr>
<tr><td>Share files across profiles via "Share" menu</td><td colspan="2">Yes</td><td>No</td></tr>
<tr><td>Can add app shortcut to (main profile's) home screen?</td><td>Yes</td><td colspan="2">No</td></tr>
<tr><td>Can add widgets to (main profile's) home screen?</td><td colspan="3">No</td></tr>
<tr><td>Can show app notifications in main profile?</td><td>Yes; same as notifications from apps running in main profile</td><td>Yes; no notification content, just app name shown</td><td>GrapheneOS only &amp; optional for each profile; no notification content, just app name shown</td></tr>

<tr><td colspan="4" style="text-decoration: underline;"><br />Protection &amp; security</td></tr>
<tr><td>PIN &amp; biometrics</td><td colspan="2">Can use same as main profile or set up a separate authentication</td><td>Needs to be set up separately but can also use none ("skip")</td></tr>
<tr><td>Need to enter PIN/fingerprint to unlock profile</td><td>Only if separate work profile PIN was set up</td><td>Yes (can be after rebooting or after turning screen off)</td><td>Optional (only if a PIN was set up for the profile)</td></tr>
<tr><td>After unlocking profile, need to enter PIN/fingerprint to start apps</td><td>No</td><td>Yes, after turning screen off</td><td>No</td></tr>
<tr><td>Profile session can be shut down or paused?</td><td colspan="3">Yes</td></tr>

</table>



<script src="bottom.js "></script>

</body>
</html>