TL;DR: To install Graphite Messenger — the free, private-messaging beta from PrivacyPortal — download the official Android APK from graphite.chat, grant your browser the per-app "Install unknown apps" permission, then open the file to install it. On Windows, get the official build and verify its SHA-256 checksum before running it. Only ever download from graphite.chat.
By the PrivacyPortal team — Last updated July 2026.
This guide shows you how to install Graphite Messenger on both Android and Windows, safely and from the correct source. Graphite Messenger is our own free, private messaging app — currently a public beta at v1.13.25 — built on a simple promise: "Private messaging with nothing to hand over." Because the word "Graphite" collides with an unofficial Telegram client, a notorious piece of spyware, and the GrapheneOS operating system, the single most important step when you install Graphite Messenger is confirming you are downloading it from graphite.chat and nowhere else. Below you'll find a back-up-first checklist, numbered install steps for phone and desktop, a verification step, and the 2026 sideloading changes every Android user should understand.
What is Graphite Messenger — and what it is not
Graphite Messenger is a lightweight, privacy-first chat app made by PrivacyPortal. The design goal is minimal data: less metadata to collect, less to store, and — as the tagline puts it — nothing to hand over if someone comes asking. It is early software, so treat it as a beta rather than a drop-in Signal or WhatsApp replacement.
Graphite Messenger is a free public beta, currently at version 1.13.25 (July 2026), published by PrivacyPortal at graphite.chat.
The naming is genuinely confusing, and that confusion is a security risk. Before you download Graphite Messenger, make sure you know which "Graphite" you actually want:
| Name | What it actually is | Where it comes from | Install it? |
|---|---|---|---|
| Graphite Messenger | PrivacyPortal's private messaging beta (v1.13.25) | graphite.chat | Yes — this guide |
| Graph Messenger | Unofficial third-party Telegram client | Package ir.ilmili.telegraph | Different app entirely |
| Graphite (Paragon) | Mercenary spyware | Not a consumer download | No — it's malware |
| GrapheneOS | Privacy-focused Android OS for Pixels | grapheneos.org | It's an OS, not a chat app |
The official graphite.chat download page — the only place you should get the Graphite Messenger installer.
Why the disambiguation matters
"Graphite" is also the name of mercenary spyware from Paragon Solutions, documented by Citizen Lab and reported in use by government agencies in 2026. You cannot "install" that as an app — it is targeted malware — but the shared name makes search results noisy. Meanwhile, the official GrapheneOS project is a hardened, de-Googled Android operating system for Pixel phones, not a messenger at all. If you want the OS rather than the app, read what GrapheneOS actually is instead. Getting the source right is the whole game.
Before you start: back up and know the risks
Installing an app is low-risk. The risky part is everything people do around it — unlocking bootloaders, enabling permissions, and downloading from mirrors. Do these first:
- Back up your phone. Photos, messages, and authenticator seeds especially. If you later unlock your bootloader for root, that step wipes the device completely.
- Only use the official source. Third-party APK mirrors are the most common way people end up with tampered or trojanised builds.
- Understand the trade-offs. A beta may change, break, or reset accounts between versions — that's normal for pre-release software.
How to install Graphite Messenger on Android
Android hasn't had a single global "allow unknown sources" switch since Android 8 Oreo (2017); instead, you grant the "Install unknown apps" permission to one specific app — usually the browser you download with. Here's the full process to sideload the Graphite APK.
You'll need: an Android phone (Android 8 or newer), roughly 100 MB free, and the official installer. You'll find the verified link in the Modules, apps & files to try section at the end of this article.
- Back up first. Make a full backup of anything you can't afford to lose before you change any settings.
- Download Graphite Messenger. Open the official graphite.chat link and download the current APK (v1.13.25).
- Grant "Install unknown apps." When your browser prompts you, tap it and toggle Allow from this source. This permission is per-app, so it applies only to the browser you granted it to.
- Open the APK. Tap the downloaded file from your notification shade or Downloads folder.
- Tap Install, wait a few seconds, then tap Open.
- Verify. In the app, go to Settings → About and confirm it reads v1.13.25, matching the version listed on graphite.chat. Then complete the Graphite Messenger setup.
- Revoke the permission (optional, tidy). Turn "Install unknown apps" back off for your browser once you're done.
Granting the per-app "Install unknown apps" permission to your browser on Android 12 and later.
If your phone already runs a de-Googled ROM, the same steps apply. On a hardened setup like the ones we ship on our de-Googled Android phones, you may need to allow the permission for your file manager instead of a browser. For a deeper walkthrough, see our guide to sideloading APKs safely.
How to install Graphite Messenger on Windows
The Graphite Messenger Windows experience follows the same principle: official source, verified download. Because beta desktop builds are often unsigned, expect Windows SmartScreen and antivirus to flag them — that's normal for new, low-reputation binaries and is not, by itself, evidence of malware.
- Download from the official source. Get the Windows build from graphite.chat (link in the Modules section below). Avoid "portable Graphite" repackages from unknown sites.
- Verify the SHA-256 checksum. Open PowerShell and run Get-FileHash .\GraphiteMessenger-Setup.exe -Algorithm SHA256, then compare the result to the checksum published on the official page.
- Handle the SmartScreen prompt. If the checksum matches, you can proceed past "Windows protected your PC" via More info → Run anyway. If it does not match, stop and delete the file.
- Install or extract. Run the installer, or unzip the portable build into a folder of your choice.
- Launch and link. Open Graphite Messenger and follow the on-screen setup to link it to your account.
- Confirm the version matches the current release on graphite.chat.
Always verify a Windows download's SHA-256 checksum before running it; on unsigned beta builds, SmartScreen and antivirus warnings are expected, not proof of malware.
Verifying a download's SHA-256 hash with Get-FileHash in Windows PowerShell before running the installer.
This same checklist — official source, PortableApps-style hygiene, checksum verification — is exactly how you should treat any portable Windows app, not just this one.
The 2026 sideloading change you need to know
Sideloading is getting stricter. Google is rolling out Android Developer Verification, which will require that even apps installed outside the Play Store come from an identity-verified developer.
Google's Android Developer Verification begins user-facing enforcement on 30 September 2026 in Brazil, Indonesia, Singapore and Thailand, then expands through 2027.
In practice, on affected devices an unverified APK may be blocked at install time. PrivacyPortal intends to distribute Graphite Messenger as a verified developer, but if you're outside those first four countries you won't see any change yet. Keep an eye on the official Android developer verification announcements for the rollout schedule in your region.
Graphite Messenger, root and app integrity
You do not need root to install Graphite Messenger — the standard sideload above is enough. If you're a flasher already running Magisk, KernelSU or APatch, a few honest caveats:
- All three root frameworks require an unlocked bootloader, and unlocking erases all data on the phone.
- None of them can guarantee passing Play Integrity or an individual app's tamper checks. We won't promise any method defeats a specific bank's or app's detection — that cat-and-mouse game changes constantly.
- Rooting widens your attack surface. It's a deliberate trade-off, not a free upgrade.
Common pitfalls to avoid
- Installing the wrong app. "Graph Messenger" (a Telegram client) is not Graphite Messenger.
- Trusting APK mirrors. If it isn't from graphite.chat, don't install it.
- Skipping the backup before unlocking a bootloader — that step is irreversible data loss.
- Treating a SmartScreen warning as proof of a virus. Verify the checksum and judge from there.
- Leaving "Install unknown apps" enabled forever for your browser after you're finished.
- Expecting beta polish. v1.13.25 is early software; report bugs rather than assuming it's broken.
- Confusing Graphite Messenger with GrapheneOS. One is a chat app, the other is an operating system.
Frequently asked questions
Is Graphite Messenger safe to install?
Yes, provided you download Graphite Messenger from the official graphite.chat source and verify the version (Android) or checksum (Windows). The real risk with any sideloaded app comes from unofficial mirrors, not from the act of installing itself.
Is Graphite Messenger the same as the "Graphite" spyware?
No. Paragon's Graphite is targeted mercenary spyware documented by security researchers; it is not something you download or install. Graphite Messenger is an unrelated consumer chat app from PrivacyPortal that happens to share a common word.
Do I need to root my phone to install Graphite Messenger?
No. Rooting is never required. A normal APK sideload works on any Android 8+ device, rooted or not.
Can I download Graphite Messenger from the Play Store?
During the public beta, the primary route is a direct download from graphite.chat. Check the official site for the current availability of any store listing.
Will Android Developer Verification stop me sideloading it?
Not immediately. User-facing enforcement starts on 30 September 2026 in four countries and expands later. Elsewhere, sideloading works as it does today.
Is there a Graphite Messenger Windows app?
Check graphite.chat for the current desktop build. Whatever is offered, install it using the official-source-plus-SHA-256 process above.
How do I update Graphite Messenger?
Because it's sideloaded, updating usually means downloading the newer APK or Windows build from graphite.chat and installing over the top. Watch the site for release notes.
The bottom line
Installing Graphite Messenger is straightforward once you cut through the name confusion: get it from graphite.chat, sideload the APK on Android or verify the checksum on Windows, and confirm the version before you finish the Graphite Messenger setup. If privacy is the reason you're here, pairing a minimal-metadata messenger with a genuinely de-Googled device makes the most of it — and you'll find the verified Graphite Messenger download in the Modules, apps & files to try section right below.
Private messaging with nothing to hand over: end-to-end encrypted, post-quantum (ML-KEM-768), Tor by default, and no phone number required. For Windows & Android (including GrapheneOS). Download at graphite.chat →
PrivacyPortal sells ready-to-use, de-Googled GrapheneOS Pixels — hardened, kept updated, and shipped with our encrypted Graphite messenger. Browse privacy phones →
Want it done for you?
Ready to go de-Googled? Buy a Google Pixel with GrapheneOS pre-installed — bootloader re-locked, verified boot on, 70-point checked, with free tracked worldwide shipping.
