PF SHIELD
Wipes before they get in.
PF Shield is our security app for GrapheneOS. It runs the duress PINs, wipe timers, quick and remote wipe, anti-snatch lock and the rest of the protections on every PF Secured phone, and it can't be switched off or bypassed.
LIVE DEMO
See it in action.
A PF Secured phone, in your browser. Unlock it, open the hidden Private Profile, or try what an attacker might do and watch PF Shield respond.
- · Verifying boot image (Verified Boot)
- · Starting GrapheneOS
- · Encrypted storage ready
- · PF Shield active
Behind the scenes
Booting device…
Unlock this phone (TapClick this box to enter the unlock codes automatically on any screen if typing is too difficult)
- Unlock (Both Profiles): PIN
1234 - Duress PIN:
0000(wipes the phone) - Private Profile: open the calculator, type
7897then=
Trigger self wipe
Automated wipes
Anti adversary
Additional security
A simulation that mirrors how the phone behaves. Timers are shortened, and the log is illustrative.
EVERY FEATURE
What PF Shield does.
Trigger a self wipe
- Duress PINs
- PINs that look like a normal unlock but wipe the phone instantly. It powers off and next starts at the setup screen.
- Quick wipe
- Press the power button 8 times quickly to wipe, even with the screen locked.
- Remote wipe
- Text the phone a secret code from any other phone and it wipes on receipt.
Automated wipes
- Lock timer
- Wipes if the phone isn't unlocked within the time you set, for example two weeks.
- Network-loss timer
- Wipes if it's cut off from every network for too long, as in a signal-blocking bag.
- Incorrect password wipe
- Wipes after the number of wrong PINs you choose. A blank attempt isn't counted.
Anti adversary
- Anti-snatch lock
- Turns the screen off and locks the instant the phone is grabbed from your hand.
- USB data off
- The port only charges. Forensic tools like Cellebrite and GrayKey get no data connection.
- Battery removal protection
- Pulling the battery to stop a wipe doesn't work: when power returns, it detects the removal and wipes on boot.
- Temperature and voltage monitoring
- Freezing or voltage tampering triggers a reboot back to the fully locked state.
- Exploit window protection
- The Admin profile reboots itself every 6 minutes while in use, so an exploit never has long enough to work. The Private Profile is left alone.
- Automatic reboot
- Restarts every four hours, clearing memory and returning to its most protected state (BFU).
Privacy
- Private Profile
- A separate profile with your real apps and data, opened only by your secret code.
- Hidden login
- Unlock the Private Profile through the calculator or another secret method, with no visible way in.
- Locked-down settings
- The everyday profile shows no other users or apps, and its settings can't be changed.
- Safe and developer modes off
- Nobody can restart into safe mode or connect a computer to get around the protections.
- VPN kill switch
- Mullvad VPN with its kill switch on: nothing leaves the phone outside the VPN.
GET PF SHIELD
Two ways to get it.
Buy a device now
A PF Secured phone with GrapheneOS and PF Shield installed, set up and checked before it ships.
Shop PF Secured phones →USE YOUR OWN PIXELPurchase a license and install it yourself
Already have a compatible Pixel? Buy a Software Flash License and install PF Shield from your browser.
Buy a Software Flash License →Installing it yourself? Read the step-by-step install guide.