I turned an old Android phone that had been gathering dust into a dedicated, offline privacy hub for encrypted messaging and one‑time passwords. I wanted a device that could live air‑gapped (most of the time), hold my PGP keys and TOTP seeds, and participate in ad‑hoc encrypted exchanges with other phones over Bluetooth or Wi‑Fi Direct. If you’ve got a spare handset and the patience to do a bit of rebuilding, you can create something similar — more secure than a typical second phone and far cheaper than a purpose‑built hardware token.
Who this is for and what it actually does
This guide is practical: I’ll show the steps I followed, tools I used and tradeoffs I accepted. The device I built is intended for: secure TOTP generation (Aegis/FreeOTP), holding private PGP keys (OpenKeychain), offline or peer‑to‑peer encrypted messaging (Briar or Signal where networked), and occasional secure file transfer via QR/Bluetooth/USB. It is not a full replacement for a daily driver — it’s a hardened, compartmentalised privacy appliance.
Threat model and constraints
Before you start, define what you want to protect against. For me the priorities were:
I did not aim to protect against a determined, state‑level adversary with physical access and unlimited resources. That would require hardware security modules and tamper‑resistant hardware.
Choose the right handset
Not every old Android phone is a good candidate. My checklist:
I used an older Pixel for a smooth GrapheneOS/LineageOS experience. If you’re stuck with a Samsung or Huawei, LineageOS is the realistic option. Don’t try to salvage devices that no longer boot or have failed radios unless you like hardware repair.
High‑level plan
- Inspect and prepare the device (battery, SIM removal).
- Factory wipe and install a privacy‑focused ROM (GrapheneOS for Pixel; LineageOS + hardened kernel otherwise).
- Install a minimal app set from F‑Droid or verified APKs: Briar, Aegis, OpenKeychain, Signal (optional), and a QR/clipboard manager.
- Configure device encryption, strong PIN/password, and lockscreen timeouts.
- Use offline transfer methods and set up secure backups (encrypted, offline).
Step-by-step rebuild
Here’s the step sequence I followed. Be careful with unlocking bootloaders and flashing—these steps will wipe your device.
| ROM | Pros | Cons |
|---|---|---|
| GrapheneOS (Pixel only) | Best security baseline, hardened, privacy features | Pixel only; learning curve |
| LineageOS | Wide device support, active community | Less hardened by default; add security tweaks |
| /e/ OS | Friendly UI, de‑Googleed | Not as security‑focused as GrapheneOS |
- Generate a new PGP key in OpenKeychain, ideally 4096‑bit RSA or modern ECC (Ed25519) depending on your partners’ compatibility.
- Set up Aegis and add TOTP seeds. For seeds you want to keep isolated, generate them on the phone and scan the QR from the online service using the air‑gapped workflow (see below).
- Use Briar for messaging because it works over Bluetooth and Wi‑Fi Direct — perfect for offline peer-to-peer chats. It also supports store-and-forward via Tor when connected, but you can keep it offline.
- For exchanging PGP keys or TOTP QR codes with another device, use QR code exports (OpenKeychain and Aegis both support exports) and scan them with the other device’s camera. If you want an auditable transfer, export to an encrypted file and transfer via USB OTG or Bluetooth with a strong password.
Operational tips I learned
Limitations and tradeoffs
This setup balances practicality and security. Some tradeoffs:
If you follow these steps, you’ll end up with a compact, secure privacy hub that is great for long‑term secrets and offline encrypted interactions. It’s an approachable, low‑cost way to step up your personal security with hardware you already own.
