← All Guides

Lockdown and Reboot Behaviour

A locked phone and a rebooted phone are not the same thing. This distinction is one of the most important concepts in mobile device security, and one of the most commonly misunderstood. GrapheneOS provides distinct tools for each state, and knowing when to use which one can be the difference between your data being practically accessible and being cryptographically sealed.

Why it matters

When your phone is sitting on a table with the screen off, it feels secure. The screen is locked. Nobody can swipe in without your PIN. But the security of that device depends heavily on what has happened since it was last powered on.

A phone that has been unlocked at least once since boot has its encryption keys loaded into memory. A phone that has just been rebooted and never unlocked does not. This difference is invisible from the outside — both phones look the same sitting on a table with a locked screen — but the security implications are fundamentally different.

Understanding the three device states, and the tools GrapheneOS gives you to move between them, lets you make deliberate choices about your exposure at any given moment.

The three device states

1. After First Unlock (AFU)

This is the state your phone is in most of the time during normal use. You have unlocked it at least once since the last reboot. In this state:

• Encryption keys are loaded into memory. The device can decrypt and access your data.
• Biometrics (fingerprint) are available for unlocking.
• Background services, notifications, and syncing all function normally.
• When you lock the screen, the phone enters a "locked but decrypted" state. The keys remain in memory.

This is the least secure of the three states. Sophisticated forensic tools target AFU devices specifically because the encryption keys are accessible in memory.

2. Lockdown Mode

Lockdown mode is an intermediate step you can activate manually. It does not reboot the device or clear encryption keys from memory, but it does:

• Disable biometric unlock (fingerprint) until you enter your PIN or password.
• Hide notification content from the lock screen.
• Disable Smart Lock and any other trust agents.

To activate Lockdown: press and hold the power button, then tap Lockdown.

The device remains in AFU state — encryption keys are still in memory — but the surface for quick, opportunistic access is reduced. Nobody can use your fingerprint while you are asleep, and sensitive notification content is not visible on the lock screen.

3. Before First Unlock (BFU)

This is the strongest local protection state. The device has been rebooted (or freshly powered on) and has not yet been unlocked. In this state:

• Encryption keys are NOT in memory. User data is encrypted and inaccessible.
• Biometrics are unavailable. Only PIN or password can perform first unlock.
• Background services are not running. No notifications, no syncing, no network activity from apps.
• The device is, from a data access perspective, a locked vault.

BFU is the state that makes physical extraction of data most difficult. Forensic tools that rely on keys being present in memory cannot function against a BFU device with a strong credential.

Auto-reboot

GrapheneOS includes an auto-reboot feature that automatically restarts the device after a configurable period of being locked. This is designed to move the device from AFU back to BFU without requiring you to remember to reboot manually.

Settings path: Settings > Security > Auto reboot

The default timeout is 18 hours. You can adjust it from as short as 10 minutes to as long as 72 hours. The timer only counts while the device is locked — it resets every time you unlock.

Choosing a timeout depends on your usage pattern:

• 18 hours (default): reasonable for daily use. If you lock your phone at night, it reboots by the next afternoon if you have not used it.
• 8-12 hours: more protective. The device returns to BFU overnight during normal sleep.
• 1-4 hours: aggressive. Suitable for high-risk environments where you want the device in BFU state quickly after any period of non-use.
• 10 minutes: maximum protection. The device reboots almost immediately after being locked. This is impractical for casual use but appropriate for specific operational scenarios.

To configure: open Settings > Security > Auto reboot and select your preferred timeout.

When to use Lockdown Mode

Lockdown is your tool for situations where you want immediate, quick hardening without a full reboot:

• Before sleep in an unfamiliar location. Lockdown disables fingerprint unlock, so someone cannot press your finger to the sensor while you sleep.
• Before handing your phone to someone briefly. If someone needs to make a call or look at something on your screen, lock down first, then unlock for them with your PIN. When they return it, biometrics remain disabled until you enter your PIN again.
• At security checkpoints or border crossings. Lockdown is fast to activate and removes the biometric bypass. For higher-risk border situations, a full reboot is preferable.
• When you want notification privacy. Lockdown hides notification content from the lock screen immediately.

How to activate: press and hold the power button, then tap Lockdown from the power menu.

When to reboot

Rebooting is your tool for situations where you want the device in its strongest local protection state:

• Before travel, especially international travel or crossing borders. A device in BFU state with a strong credential offers the most resistance to inspection.
• Before any situation where you might lose physical control of the device. Protests, crowded events, high-risk meetings.
• Before extended periods away from the device. If you are leaving your phone in a hotel room, a rebooted device is significantly more secure than a locked one.
• If you suspect the device may have been compromised. A reboot clears running processes and returns the device to a known state.

How to reboot: press and hold the power button, then tap Restart. Alternatively, hold the power button for several seconds for a forced restart.

Step-by-step: activating each state

Lockdown Mode:

1. Press and hold the power button.
2. Tap "Lockdown" from the power menu.
3. The device is now locked with biometrics disabled and notifications hidden.
4. To return to normal use, unlock with your PIN or password.

Full Reboot:

1. Press and hold the power button.
2. Tap "Restart" from the power menu.
3. The device is now in BFU state. Do not unlock until you are ready to use it.

Configuring Auto-Reboot:

1. Open Settings > Security > Auto reboot.
2. Select your preferred timeout value.

Best practices

• Set auto-reboot to a value that matches your risk level. If you are a typical user, the 18-hour default is sensible. If you carry sensitive data or travel frequently, consider 8-12 hours. Adjust downward for specific high-risk periods.
• Use Lockdown as a habit before sleep. It takes one second and prevents fingerprint-based access while you are unconscious. This is a low-effort, high-value habit.
• Reboot before crossing any border. This is the single most impactful reboot timing for most people. A BFU device with a strong credential is your best position during an inspection.
• Combine with profile separation. Closing secondary profiles before locking adds depth to your protection.

Common mistakes

• Assuming a locked phone is as secure as a rebooted phone. A locked phone in AFU state has encryption keys in memory. A rebooted phone in BFU state does not. The difference is significant.
• Setting auto-reboot too long. A 72-hour auto-reboot window means your phone could sit in AFU state for three full days after you last used it. For most people, this is longer than necessary.
• Forgetting that auto-reboot only triggers while locked. If you are actively using the phone, the timer does not count down. Auto-reboot is a safety net for periods of non-use, not a substitute for manual reboots before known high-risk moments.
• Not using Lockdown because "the phone is locked anyway." A standard screen lock still allows biometric unlock. Lockdown specifically removes that option. These are different levels of access control.

Reality check

None of these states make a device invulnerable. BFU with a weak PIN is less secure than AFU with a strong passphrase. The device state works in combination with credential strength, software updates, and disciplined data handling.

Conclusion

Your phone exists in one of three security states at any given moment, and you have direct control over which one. Lockdown mode is fast and removes biometric access. Rebooting returns the device to its strongest protection state. Auto-reboot ensures you do not stay in a weaker state longer than intended. Learn the difference, build the habits, and use each tool for the situation it was designed for. The security of your data depends not just on what protections exist, but on whether they are active when they are needed.