How to back up your GrapheneOS phone

A backup is a spare copy of your files, so that you do not lose them if the phone is lost, broken or taken. The safest way on GrapheneOS is to back up into a Cryptomator vault. Cryptomator encrypts every file on your phone before it goes anywhere, so whoever holds the copy sees only scrambled data.

Why Cryptomator is the best place for backups

• The lock is yours. Files are encrypted on your phone. The storage provider never has the key.
• It works with anything. The vault can live on a USB-C flash drive, in a cloud storage service, or both.
• It is open source and easy to use.
• It is simple to restore. Install Cryptomator on any device, enter your password, and your files are back.

What to avoid

• Plain cloud backups. They store readable copies of your data on someone else's computer. A Cryptomator vault in the cloud is different: it is encrypted first.
• Plugging the phone into a computer to copy everything. This means trusting the computer with broad access to the phone.
• Seedvault. GrapheneOS has a backup tool called Seedvault, but it is not reliable enough yet to depend on.

Step 1: Set up Cryptomator

Follow how to set up Cryptomator to install the app and create a vault. Choose where the vault is stored:

• Cloud storage if you want a copy that survives losing your home and phone.
• A USB-C flash drive if you want a copy that is fully offline.
• For best protection, do both, with two vaults.

Pick a long, unique password and save it in your password manager (KeePass guide). If you lose the vault password, nobody can recover your files, including us and Cryptomator. Also keep the vault's recovery key, written on paper, in a safe place.

Step 2: Choose what to back up

• Photos and videos you want to keep
• Documents and notes
• Your password manager database
• Your Aegis 2FA backup file (Aegis guide)
• Your PGP keys, exported and protected (OpenKeychain guide)
• Wallet seed words, if you must store them digitally. Prefer paper.

Step 3: Copy the files into the vault

1. Open Cryptomator and unlock the vault.
2. Choose Add files (or share files from the Files app into Cryptomator).
3. Pick your files or folders and wait for the copy to finish.
4. Lock the vault again.
5. If the vault is in the cloud, wait until the sync is complete before you close the app.

Step 4: Add a second lock (optional, for the most sensitive files)

Encrypt very sensitive files with PGP before you put them in the vault. See how to use PGP to encrypt files. You then need both the vault password and your PGP key to read them.

Step 5: Test your backup

This is the step most people skip.

1. On a different profile or device, install Cryptomator and open the vault.
2. Open a few files and check they work.
3. Do this again every few months.

How often?

Once a month is fine for most people. Back up straight away after something important, such as new photos or a new password.

Other options

• Send a file to yourself in an encrypted messaging app such as SimpleX, using a "Note to self" chat. This is fine for a single file, but not for a full backup.
• Keep the flash drive somewhere else, such as a trusted friend's house.

Quick checklist

1. Create a Cryptomator vault (cloud, flash drive, or both).
2. Save the password and recovery key safely.
3. Copy your files in.
4. Test restoring.
5. Repeat every month.

This guide is based on the public AnarSec guide "GrapheneOS for Anarchists" (anarsec.guide), rewritten in plain language and adapted to use Cryptomator. Their guide is written for people at high risk, so some advice is stricter than most people need. Use what fits your situation.