PGP Phone in 2026: What It Is, What It Costs and How to Choose One
What a PGP phone really is, what PGP encrypts, why EncroChat and Sky ECC failed, and what a GrapheneOS PGP setup costs in 2026.
By GhostSims Team ·
A PGP phone is a smartphone set up so that your email and files are encrypted with OpenPGP keys that only you hold. That's the honest definition. In practice the name now covers two very different things: closed "encrypted phones" sold on subscription by specialist vendors, and ordinary hardened phones (usually a Google Pixel running GrapheneOS) with open-source PGP apps installed.
This guide explains where the term came from, what PGP actually protects, why several famous PGP phone networks ended up handing their users to the police, and what a sensible setup costs today. Prices were checked in November 2026.
Where the name "PGP phone" comes from
Phil Zimmermann released PGP (Pretty Good Privacy) in 1991 to encrypt email and files. In 1995 he released PGPfone, a program for encrypted voice calls over modems and the early internet. Despite the name, it shared almost nothing with PGP email encryption. It worked out a fresh key for each call and had both people read a short code aloud to spot an interception. MIT, which used to distribute PGPfone, says it hasn't been maintained since 1997.
Zimmermann's successor was Zfone and its protocol, ZRTP (around 2006, later published as RFC 6189). ZRTP is still used by some encrypted calling apps. Signal's early calling app, RedPhone, was built on it. Signal now encrypts calls with keys from its own protocol.
The phrase "PGP phone" took off later, in the 2010s, when companies started selling locked-down BlackBerry and Android handsets that ran only PGP email or a private messaging app, at monthly or six-monthly subscription prices.
What PGP actually encrypts (and what it doesn't)
OpenPGP, the current standard (RFC 9580, published 2024), protects content: the body of an email, an attachment, or a file sitting on a drive. If someone intercepts the message, they see ciphertext.
It does not hide much else. With PGP email, the sender and recipient addresses, the time, and usually the subject line stay readable to the mail servers. It also doesn't touch your voice calls, SMS or what the mobile network knows about you. PGP was never designed to encrypt phone calls. Calls need an end-to-end protocol such as Signal's or ZRTP.
The network layer is a separate problem again. Any phone connected to a mobile network can be located through the towers it uses, whatever is installed on it. That part is handled by the SIM and how it's registered, which we explain in our guide to PGP SIM cards.
The warning: EncroChat, Sky ECC and ANOM
The best-known PGP-style phone networks all failed their users in the same way. The encryption maths wasn't broken. The vendor was.
- EncroChat sold modified Android phones on six-month contracts that cost upwards of €1,000. In 2020, French and Dutch investigators got into its servers and pushed an implant to the handsets, reading messages before they were encrypted. Europol later put the results at more than 6,500 arrests.
- Sky ECC, with around 170,000 users, was penetrated by Belgian, Dutch and French police in early 2021. Messages users believed were private were read at scale.
- ANOM was worse: it was secretly run by the FBI from the start (Operation Trojan Shield). About 12,000 devices were sold before the June 2021 takedown, and more than 800 arrests followed.
The lesson for anyone buying a "PGP phone" in 2026: if you can't see the software, can't choose your own apps, and have to trust one company's servers and update channel, then you're trusting that company completely. A good setup uses open-source software that's audited in public, keys generated on your own device, and no single vendor that can read your messages or switch your phone remotely.
Old-style PGP phone vs GrapheneOS Pixel vs stock phone with Signal
| Closed "PGP phone" (subscription) | Pixel with GrapheneOS | Stock phone + Signal | |
|---|---|---|---|
| Software you can inspect | No, it's proprietary | Yes, open source | Signal is open source; the OS isn't fully |
| Who holds the keys | Often the vendor's servers | You, on the device | You, on the device |
| PGP email and files | Usually, in the vendor's own app | Yes, with OpenKeychain + Thunderbird or FairEmail | Possible on Android with the same apps |
| Encrypted calls | Sometimes, vendor-specific | Yes, via Signal or similar | Yes, via Signal |
| Google services and tracking | Removed, but you can't verify it | None by default; sandboxed Play optional | Full Google or Apple services |
| Security updates | Whenever the vendor ships them | Fast, from the GrapheneOS project | From the manufacturer |
| Typical cost | Recurring subscription | One-off device price | The phone you already own |
For most people who say they want a PGP phone, the middle column is the right answer. You get a hardened operating system on hardware with a dedicated security chip, and you choose the encryption apps yourself. We explain the OS side in more detail in why GrapheneOS phones are hard to break into.
How to set up PGP email on an Android or GrapheneOS phone
- Install OpenKeychain from F-Droid or the Play Store. It stores your keys and does the encryption for other apps.
- Create a key pair in OpenKeychain with your email address and a strong passphrase. Back up the key to somewhere offline. If you lose it, nobody can recover your encrypted mail.
- Install a mail app that talks to OpenKeychain: Thunderbird for Android (the app formerly called K-9 Mail) or FairEmail.
- Link them. In Thunderbird, open the account settings, turn on end-to-end encryption and pick OpenKeychain. In FairEmail, choose OpenKeychain under the encryption settings.
- Swap public keys with the people you write to, and check their fingerprints over a second channel such as a Signal call.
- Send a test message and check that it arrives encrypted.
One honest caveat: OpenKeychain is now in maintenance mode. Its developers say they still apply security fixes but aren't adding features. It still works with Thunderbird and FairEmail. If you only need private conversations rather than email, Signal is simpler and protects calls too.
What a PGP phone costs in 2026
Prices checked November 2026, in US dollars unless stated.
| Option | What you get | Price |
|---|---|---|
| GhostSims Pixel 8 | GrapheneOS pre-installed and configured | $550 |
| GhostSims Pixel 10a | GrapheneOS pre-installed and configured | $900 |
| GhostSims Pixel 10 | GrapheneOS pre-installed and configured | $950 |
| GhostSims Pixel Fold 10 | GrapheneOS pre-installed and configured | $1,500 |
| Latenis (another GrapheneOS reseller) | Pixel 10a to Pixel 10 Pro XL with GrapheneOS | $648 to $1,085 |
| Jolla Phone | Sailfish OS, not GrapheneOS; ships within Europe | €699 to €749 |
Closed subscription phones rarely publish prices. EncroChat charged upwards of €1,000 for six months, and that was for a phone you never really controlled. You can also install GrapheneOS yourself on a Pixel you buy outright, which costs nothing beyond the phone and an hour or two of your time.
If you'd rather not do the setup, our GrapheneOS Pixel phones ship ready to use, with free worldwide shipping.
What to check before you buy any PGP phone
- Can you name the operating system? "Custom secure OS" with no public source code is a red flag.
- Who generates the keys? They should be created on your phone, never supplied by the seller.
- Can you install your own apps? If you're locked into one vendor messenger, you inherit all of that vendor's risk.
- Is there a remote-wipe or update channel the seller controls? That's exactly what police used against EncroChat users.
- Is the price a one-off or a subscription? A recurring fee for "encryption" usually means you're paying for access to someone else's server.
PGP phone FAQ
Is a PGP phone legal?
Owning and using an encrypted phone is legal in the UK, the US and most of Europe. Journalists, lawyers and businesses use them every day. In the UK, police can serve a notice under Part III of RIPA requiring you to hand over a password or key, and refusing is an offence. Encryption laws differ elsewhere, so check before you travel.
Can a PGP phone be tracked?
Yes, if it's connected to a mobile network. The network sees which towers the SIM uses, whatever encryption is on the handset. PGP protects the content of your email and files, not your location. Reducing network tracking is a SIM and registration question, not a phone question.
PGP phone vs Signal: which is better?
They do different jobs. Signal encrypts messages and calls end to end and is far easier to use. PGP encrypts email and files, and lets you work with people who don't use Signal. Many people run both on the same GrapheneOS phone.
Does a GrapheneOS phone count as a PGP phone?
Once you add OpenKeychain and a compatible mail app, yes, and it's a more trustworthy one than most closed PGP phones, because the operating system and the apps are open source and the keys never leave your device.
Where can I buy a PGP phone in the UK?
You can buy a Pixel and install GrapheneOS yourself, or order one pre-installed. GhostSims ships GrapheneOS Pixels to the UK and 180+ other countries with free standard shipping, usually dispatched within 24 to 48 hours. Avoid sellers who only offer a closed handset on a subscription.
Can PGP encrypt phone calls or SMS?
No. PGP handles email, files and some messaging apps. For private calls, use an app with end-to-end encrypted calling such as Signal. Ordinary SMS isn't end-to-end encrypted at all.
Do I still need a special SIM?
Not for encryption. The phone and apps do that. A privacy SIM matters if you also want to limit how much the mobile network can tie the line to your identity, which is a separate layer from anything PGP does.