There's no single "best" privacy phone — it depends on what you need. Some options prioritize open hardware, others focus on software hardening, and some include private communications infrastructure. Here's what's actually available, what each option does well, and where it falls short.

1. DIY GrapheneOS (flash it yourself)

~$500 (Pixel 9a) + your time | 2-year cost: ~$500

The free option. Buy a Google Pixel, flash GrapheneOS using their web installer, and configure everything yourself.

What you get:

  • GrapheneOS with all its security hardening
  • No Google telemetry
  • Full control over every setting

What you don't get:

  • No private messaging infrastructure — you're using public servers
  • No Tor routing unless you set it up yourself
  • No encrypted messenger pre-configured — you pick and install your own
  • No private relay servers — your messages pass through shared public infrastructure
Best for: Technical users who want full control and don't mind doing their own research and setup. If you know what you're doing, this is the cheapest path.

2. null

$1,249 one-time (includes 2 years of private server access) | 2-year cost: $1,249

A Pixel 9a with GrapheneOS, SimpleX Chat, and a private Tor-routed relay network — pre-configured and ready to use.

What you get:

  • GrapheneOS fully configured
  • SimpleX Chat pre-installed — encrypted messaging, voice, and video calls with no phone number or account required
  • All messaging traffic routed through Tor via dedicated private relay servers
  • Cryptographic client authentication — only null devices can access the relay network
  • Duress PIN, auto-reboot re-encryption, scrambled PIN, isolated user profiles
  • 2 years of private server access and maintenance included

What you don't get:

  • No cellular plan included — you provide your own SIM or use Wi-Fi
  • No ongoing software updates from null — GrapheneOS handles its own OTA updates
  • Server access expires after 2 years (renewable)
Best for: Anyone who wants a complete private communications setup without building and maintaining the infrastructure themselves.

3. Cape

Pixel 9 from $799 + $99/month service | 2-year cost: $3,175 (or $2,675 with their $500 bill credit)

Cape is a privacy-focused cellular carrier. They sell Pixels with optional GrapheneOS installation ($50 extra) and pair them with a privacy-first mobile plan.

What you get:

  • Pixel with optional GrapheneOS installation
  • Cellular plan that doesn't require your name or SSN
  • SIM swap protection — your number is secured by a private key
  • No personal information required to sign up

What you don't get:

  • No private messaging relay infrastructure — your messages still go through Signal's, WhatsApp's, or whatever messenger's centralized servers
  • No Tor routing — your IP address is visible to messaging servers
  • No pre-configured encrypted messenger
  • You still have a phone number — a persistent identifier tied to every app that requires one
  • Over 2x the cost of null over a 2-year period
Best for: People who want cellular privacy specifically — protection from SIM swapping and carrier-level tracking. Cape protects your identity at the carrier level. It does not protect your message content, metadata, or network identity. These are different problems.

4. Above Phone

From $999 for a Pixel 9a | 2-year cost: $999+ (more with optional subscription services)

Above Phone sells Pixels pre-loaded with GrapheneOS and bundles them with optional privacy services (VPN, encrypted email, cloud storage).

What you get:

  • Pre-installed GrapheneOS
  • Optional "Above Suite" with private email, calendar, cloud storage, VPN
  • Data-only eSIM option

What you don't get:

  • No private messaging relay infrastructure
  • No Tor-routed communications
  • Privacy services are subscriptions on top of the phone price
Best for: Non-technical users who want a de-Googled phone with consumer-friendly privacy services bundled in.

5. Purism Librem 5

$699 (standard) / $1,999 (USA-assembled) | 2-year cost: $699–$1,999

A Linux phone built from scratch with hardware kill switches for camera, microphone, Wi-Fi, and cellular modem. Runs PureOS, not Android.

What you get:

  • Hardware kill switches that physically disconnect components
  • Fully open source hardware and software
  • Removable battery
  • No Android, no Google anything
  • USA-assembled option for supply chain security

What you don't get:

  • Usable daily performance — reviewers consistently report slow speeds and poor battery life
  • A mature app ecosystem — most Android and iOS apps don't work
  • A good camera
  • Modern specs — 3GB RAM, 32GB storage, a dated processor
  • Reliable software — the experience is rough
Best for: People who prioritize open hardware principles above daily usability. This is more of a statement than a daily driver.

How they compare over 2 years

DIY GrapheneOS null Cape Above Phone Librem 5
2-year cost ~$500 $1,249 $3,175+ $999+ $699–$1,999
OS GrapheneOS GrapheneOS GrapheneOS (optional) GrapheneOS PureOS (Linux)
Private relay servers No Yes (2 years included) No No No
Tor-routed messaging out of the box No Yes No No No
Encrypted messenger pre-configured No SimpleX Chat No No No
Phone number required Yes No Yes Yes Yes

The bottom line

If you're technical and just want a de-Googled phone, flash GrapheneOS yourself. It's free and well-documented.

If you want cellular anonymity — an untraceable phone number with SIM swap protection — look at Cape. But know that a private phone number doesn't make your messages private. Your communications still flow through centralized servers that can see your metadata.

If you want a complete private communications system — encrypted messaging over Tor, through private relay servers that only your devices can access, with no phone number, no account, and no identifier — that's what null builds. And at $1,249 for 2 years, it's less than half the cost of Cape.

Private phone. Private network. No subscriptions.

Order now · $1,249 →