Nitrokey · Hardened phone
NitroPhone 10
A hardened Google Pixel 10 running GrapheneOS with a Titan M2 security chip, verified boot, and optional physical removal of microphones, sensors, and cameras for high-threat mobile users.
$1,035
EU equivalent: €829 incl. VAT · nitrokey.comShips direct from Nitrokey (Germany) · typically 5–10 business days
Vegas batch closed — buy direct on Nitrokey, or get notified when the next bulk batch opens.
STORAGE
MICROPHONES & SENSORS
Get the next Nitrokey batch
The Vegas batch has closed. Need it now? Buy direct on Nitrokey. Rather wait for the next bulk run — group pricing, PO/invoicing, and event pickup? Tell us what you’d order and we’ll email you the moment it opens. No commitment; enough interest is what schedules the next batch.
Lithium-ion battery installedUN 3481
Contains a lithium-ion battery, so it ships by ground or on approved air services only. We handle the dangerous-goods paperwork; nothing is needed from you.
Carriers & cellular
Will it work on your network?
Partial US frequency coverage — check your carrier
GSM, LTE, 5G (sub-6 GHz) — no complete frequency coverage in the USA. NitroPhones work with all major carriers but not with all 5G networks. Check with your carrier to make sure your phone works on its 5G network.
— Google Pixel hardware manufacturer specification
CDMA is no longer the question
The old GSM-vs-CDMA split is history — US carriers retired their CDMA networks, and everything now runs on LTE and 5G. Any unlocked LTE/5G handset can technically attach to all three major networks.
VoLTE provisioning is the real gotcha
With 2G and 3G shut down, voice calls ride VoLTE. Carriers maintain lists of device models they enable it for, and an imported or less common model is not always on them. Data may work perfectly while calls do not. Check your specific model with your carrier before you buy — this is the single most common problem with any imported phone, ours included.
Sub-6 5G only, no mmWave
These handsets do sub-6 GHz 5G. The very high-frequency mmWave tier some US carriers deploy in dense areas is not supported, so you get normal 5G rather than the headline speeds advertised in a stadium.
Bands are a per-model fact, not a brand fact
A phone sold into the European market does not necessarily carry the same band set as the North American variant of the same handset. Where a vendor publishes the band list we show it; where they publish a caveat instead, we show the caveat rather than guessing.
Radio hardening on this device
- The baseband radio processor is isolated using an IOMMU, so a compromised modem cannot reach the rest of the system.
- Optional LTE-only mode disables 2G and 3G, removing the downgrade path most IMSI catchers rely on.
- Per-connection MAC randomisation stops nearby Wi-Fi scanners correlating the device across locations.
- Apps cannot read the IMEI, serial number, SIM serial or subscriber ID.
Consider skipping the carrier entirely
Every one of these handsets runs perfectly well with no SIM and no eSIM at all — Wi-Fi only, with calls and messages over an encrypted app instead of the carrier network. For some threat models that is the stronger configuration, and it is worth understanding why.
It removes the cell-site attack surface
IMSI catchers — the devices commonly called stingrays — work by impersonating a cell tower, persuading nearby handsets to attach, and harvesting the identifiers they present. Many attacks depend on forcing a downgrade to older, weaker 2G or 3G protocols. A handset with no cellular connection has nothing to catch. Short of that, GrapheneOS LTE-only mode closes the downgrade path while keeping the phone usable on a network.
It removes the carrier as a data holder
A SIM ties a subscriber identity to a location history held by a company that can be subpoenaed, breached, or socially engineered. No SIM means no carrier record of where the device has been, because the carrier never sees it.
What it costs you, honestly
No cellular data away from Wi-Fi. Emergency calling behaves differently and may not be available without a carrier connection — verify how your device and jurisdiction handle this before you rely on it. Anyone expecting to reach you on a normal phone number will need another route.
What it does not do
This is not invisibility. Wi-Fi networks, the IP addresses you use, and the services you sign into all produce their own metadata, and an app-based identity can be just as identifying as a phone number. Removing the SIM narrows one specific channel — a significant one — rather than closing all of them.
Why the NitroPhone 10
What this hardened phone does that alternatives don't.
GrapheneOS hardening
Ships with GrapheneOS, providing a hardened memory allocator, exploit mitigations, baseband isolation, and granular network/sensor permission controls beyond stock Android.
Hardware root of trust
Pixel 10 Titan M2 secure chip plus verified boot ensures firmware and OS integrity from power-on, resisting tampering and persistent malware.
Physical sensor removal
Optional factory removal of microphones, cameras, and motion sensors eliminates entire eavesdropping and tracking attack surfaces for the highest-threat users.
Specifications
Full technical details.
Compliance framework mapping
Controls this product satisfies across 12 frameworks.
Mobile device access control
Hardened mobile OS with per-app sensor controls, verified boot, and no background telemetry. Satisfies mobile device management and bring-your-own-device security requirements.
Supply chain risk — hardware and firmware
Open-source firmware is publicly auditable and reproducibly built. EU jurisdiction hardware is not subject to US National Security Letters. Directly addresses hardware supply chain risk in CMMC and NIS2.
Transmission confidentiality and integrity
Verified boot ensures the TLS stack is unmodified before communication. VPN gateway encrypts all remote access traffic. Hardware-backed keys prevent interception even if endpoints are observed.
Compared to
Honest comparisons against the most likely alternatives.
vs. stock Pixel 10
Same trusted hardware and verified boot, but GrapheneOS replaces Google's OS with a hardened, de-Googled stack and finer permission controls.
vs. generic 'secure' Android phones
Built on Pixel's hardware-backed key storage and 7-year firmware support rather than aftermarket ROMs on commodity hardware with weaker roots of trust.
Shipping & returns
What to expect after you order.
Shipping
Ships from our Tennessee 3PL. 2-day FedEx to most US addresses, expedited options at checkout. Signature required. Business day processing — orders placed before 2pm ET ship same day.
Returns & RMA
30-day return window for unopened units. Defective units handled under Nitrokey's 2-year warranty — we manage the US-side RMA so you don't ship to Berlin.
Purchase orders
Net-30 terms available for approved organizations. W-9 on file. Generate a quote from the stack builder or email sales@securitygadgets.shop with your PO requirements.
Authorized reseller
We are an official Nitrokey authorized reseller. Full manufacturer warranty applies. Identical hardware and firmware to buying direct from nitrokey.com — with US inventory and support.
