Your phone, on your terms - even under pressure.

WraithLink is a hardened mobile OS for Pixel devices. It keeps a believable everyday phone up front while your real data lives in a hidden vault - and it can make that vault vanish the instant someone forces you to unlock.

Install in your browser Read the docs

What makes it different

Every feature below is real, on-device behavior - not a screen that pretends to be secure.

Decoy-duress PIN coercion

Enter your normal PIN and your everyday phone opens as usual. Enter the decoy-duress PIN and the phone still opens normally - but the hidden WraithVault is silently destroyed in the background. Nothing on screen changes.

Panic wipe last resort

A separate panic credential destroys the disk-encryption keys for the whole device. Keys are killed first, so the data is unrecoverable even if the wipe is interrupted.

WraithVault hidden profile

A hardened secondary profile for your crown jewels. It respects your VPN and Tor routing, can be backed up, and stays out of the everyday phone's face.

Auto-reboot & auto-wipe at rest

Idle devices reboot back to a keys-evicted state, and too many wrong attempts trigger a wipe - shrinking the window where your data is extractable.

Encrypted DNS network

DNS-over-TLS to Mullvad by default via the setup wizard, so lookups aren't handed to your carrier or a captive resolver in the clear.

Per-connection MAC randomization network

A fresh, random hardware address for every network you join - no persistent MAC to track you across Wi-Fi.

Anti-IMSI-catcher radio

Turn off 2G entirely to defeat the downgrade attacks that fake cell towers rely on, plus Wi-Fi/Bluetooth auto-off timers.

USB & ADB lockdown physical

USB data is blocked while the phone is locked to defeat forensic bridges - but allowed when unlocked, so your encrypted USB-C backups still work.

Tor "Ghost" profile anonymity

A profile that routes everything through Tor with Tor Browser, isolated from your everyday identity.

WraithLink Chat no logs

End-to-end encrypted, peer-to-peer over Tor, with disappearing messages and mandatory contact verification. Nothing is stored on any server - there is no server.

X47 desktop pairing exclusive

Pair one phone to one desktop over a Tor onion service with client authorization and a verification code. Heavy tools stay on the desktop; the phone stays hardened.

Verified boot, intact integrity

WraithLink relocks the bootloader against its own key. Attestation and the hardware security model are preserved - not sacrificed for customization.

A guided first-boot wizard

WraithLink Setup walks you through the hardening that needs your input, and sets the safe defaults automatically. Every step is optional and skippable.

Set once, protected always. Strong screen lock, duress and panic credentials, auto-reboot and auto-wipe, USB lockdown, disable-2G, encrypted DNS, WraithVault creation, and an enforced backup step before you arm the duress destroy.

Supported devices

Pixel-only, by hardware requirement - relockable bootloader with a custom key, a secure element for the real wipe, and monthly firmware.

Pixel 9 / 9 Pro / 9 Pro XL

Recommended. Codenames tokay, caiman, komodo.

Pixel 8 / 8 Pro

Supported. Codenames shiba, husky.

Why not other phones?

Without custom-key verified boot and a secure element you lose the genuine duress guarantee - WraithLink's whole point. More in the FAQ.

Honest about the ceiling

Read this before you rely on it. The decoy-duress destroy defeats theft, coercion, and casual inspection. It is not designed to beat a forensic lab that images storage before you ever touch the phone. For state-level threats, use the panic wipe. WraithLink states its limits plainly rather than overselling them - see the security model.