Notes 
Android app by GrapheneOS that uses hardware-backed attestation to verify the integrity and authenticity of a supported device and its operating system, confirming it has not been tampered with.
Reviewed by Marcus Holmberg
Auditor
attestation.app 3 ratings so far*
Rate Auditor: No account needed
Threat level
Hardened
A hardened pick. Worth the effort once you have chosen to shrink your footprint on purpose. Enough for most people. Threat levels
Our take
Auditor does something most security tools cannot: it gives you a cryptographic proof, not just a software assertion, that a device is running the OS it claims to run. Using Android’s hardware-backed keystore and verified boot chain, it lets one Android device audit another over QR codes, or run scheduled remote checks with email alerts. The catch is narrow hardware support: it works best with Pixel devices running GrapheneOS or stock Android, and the value only lands if you understand what attestation failure actually means. For GrapheneOS users, it is a natural companion that rounds out the trust model.
GitHub at a glance
GrapheneOS/Auditor MIT androidattestationauthenticitycryptographygrapheneoshsmintegritymonitoringremote-attestationsecure-bootsecurebootsecuritystrongboxverifiedboot
Stars
731
+1 this week
Forks
123
26 watching
Last commit
1d ago
healthy
Latest release
92
5mo ago, 92 total
Star history
Issues
74% closed
35
open
100
closed
+1 / -0
opened / closed, last 4 weeks
Opened vs closed, last 12 weeks
Commits, last 26 weeks
32 commits, active 15 of 26 weeks
25 contributors since Jan 2018
Languages
- Java 93.6%
- Kotlin 6.4%
Updated daily from the GitHub API. Star tracking since Jun 22, 2026.
Website at a glance
attestation.app
A+ score 160
Strong website security headers
Graded by Mozilla HTTP Observatory, tested today
Inspect this site yourself
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
Auditor alternatives
iMazing iOS and iPadOS device manager for Windows and macOS that includes a free built-in spyware analyzer, powered by MVT detection logic, to scan a device backup for signs of compromise.
Mobile Verification Toolkit Command-line forensic tool developed by Amnesty International's Security Lab to analyze iOS and Android device backups and logs for indicators of compromise by mercenary spyware such as Pegasus.
Auditor license, in plain English
MIT Permissive
Do almost anything: use, change, and ship it, even inside closed-source products. The only condition is keeping the copyright notice.
Permits
- Commercial use
- Modification
- Distribution
- Private use
Requires
- License and copyright notice
Does not provide
- Liability cover
- Warranty
Why it matters: Permissive licensing lets anyone reuse this, including inside closed products. That is freedom to build on, but no guarantee that downstream copies stay open.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.
* Average ratings will show on this page once the threshold of 5 ratings is reached.