Feature tour

A quick map of what WraithLink adds on top of its hardened GrapheneOS/AOSP base, and where to read more about each.

Coercion resistance

• Decoy-duress PIN - opens the everyday phone while silently destroying the hidden vault. Details.
• Panic wipe - a separate credential that destroys the device keys outright.
• WraithVault - a hidden, backup-able profile for your crown jewels, kept out of the everyday phone's face.

At-rest hardening

• Auto-reboot back to a keys-evicted state after the device sits idle, so a seized phone is far harder to extract from.
• Auto-wipe after too many wrong unlock attempts.
• USB data blocked while locked (but allowed when unlocked, so backups work), and ADB off by default.

Network privacy

• Encrypted DNS to Mullvad over TLS, set up in one tap.
• Per-connection MAC randomization - a new hardware address per network.
• Disable 2G to blunt fake-tower downgrade attacks; Wi-Fi/Bluetooth auto-off timers.
• Tor "Ghost" profile plus bundled Orbot and Tor Browser. Details.

Communication

• WraithLink messenger - E2EE, P2P over Tor, disappearing messages, mandatory verification, nothing stored. Details.

Companion desktop

• X47 pairing - one phone to one desktop over an authorized onion service, for remote tooling and automatic vault backups. Details.

Preinstalled apps

• F-Droid for open-source apps, plus Mullvad VPN, Orbot, and Tor Browser.
• Sandboxed Google Play is offered as an optional step in the setup wizard - it cannot be shipped in the image for licensing reasons, but installs in one tap and runs sandboxed like an ordinary app.

Guided setup

The WraithLink Setup wizard sets safe defaults automatically and walks you through everything above. It is guided but entirely skippable.